SaviyntEICEventCollector

Details

ID	`SaviyntEICEventCollector`
Provider	Saviynt
Category	Analytics & SIEM
From Version	8.4.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	XSIAM

README

Collector for Saviynt Enterprise Identity Cloud (EIC) audit logs using Analytics Runtime Control V2.
This integration was tested with Saviynt EIC API Reference for Amsterdam GA Release (API v5).

Configure Saviynt EIC Event Collector in Cortex

Parameter	Description	Required
Server URL	The Saviynt EIC server URL (e.g., `https://your-tenant.saviyntcloud.com`).	True
Username	The username for authenticating with the Saviynt EIC API.	True
Password	The password for authenticating with the Saviynt EIC API.	True
Analytics Name	The name of the Analytics Runtime Control to fetch events from. This value must match an existing Analytics Record configured in Saviynt. Default is `SIEMAuditLogs`.	False
Maximum number of events per fetch	The maximum number of events to fetch per interval. Default is 30000.	False
Trust any certificate (not secure)	When selected, certificates are not checked. Not recommended for production environments.	False
Events Fetch Interval	The interval in minutes between event fetches. Default is 1 minute.	False
Use system proxy settings	When selected, uses the system proxy settings to connect to the Saviynt EIC API.	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

saviynt-eic-get-events

Gets events from Saviynt EIC.

Base Command

saviynt-eic-get-events

Input

Argument Name	Description	Required
should_push_events	If true, the command creates events, otherwise, it only displays them. Possible values are: true, false. Default is false.	Required
limit	Maximum number of results to return (max 10000).	Required
time_frame	Time frame in minutes back from now to query.	Optional
offset	Offset for paging.	Optional

Context Output

There is no context output for this command.

Configuration parameters

url — Server URL (required)
credentials — Username (required)
analytics_name — Analytics Name
max_fetch — Maximum number of events per fetch
insecure — Trust any certificate (not secure)
eventFetchInterval — Events Fetch Interval
proxy — Use system proxy settings

Commands (1)

saviynt-eic-get-events
Gets events from Saviynt EIC. This command is supported in Cortex XSIAM only and is intended to be used for debugging purposes as it may result in duplicate events.

Source

SaviyntEICEventCollector.py SaviyntEICEventCollector_test.py SaviyntEICEventCollector.yml SaviyntEICEventCollector_description.md

Download History Raw

**Important:** This integration is supported by Palo Alto Networks.

## Saviynt Enterprise Identity Cloud

Collector for Saviynt Enterprise Identity Cloud (EIC) audit logs.
This integration was integrated and tested with the [API Reference for Amsterdam GA Release](https://documenter.getpostman.com/view/40843358/2sAYdctCto) (v5).

## Prerequisites

### Step 1: Creating an Analytics Record
Create a new runtime analytics control (V2) using an SQL query. For more information, see [Creating Elasticsearch-based Analytics Controls (Version 2)](https://docs.saviyntcloud.com/bundle/EIC-Admin-25/page/Content/Chapter17-EIC-Analytics/Managing-Analytics-v232-Earlier/Creating-Elasticsearch-based-Analytics-Controls-Analytics-V2.htm).
While creating an analytics control, copy the following query in the Analytics Query parameter:
```sql
select ua.TYPEOFACCESS as 'Object Type',ua.ActionType as 'Action Taken',u.username as 'Accessed By', ua.IPADDRESS as 'IP Address',ua.ACCESSTIME as 'Event Time',ua.DETAIL as 'Message' from users u , userlogin_access ua, userlogins l where l.loginkey = ua.LOGINKEY and l.USERKEY = u.userkey and ua.AccessTime >= (NOW() - INTERVAL ${timeFrame} Minute) and ua.Detail is not NULL
```

### Step 2: Setting up Permissions
Saviynt recommends that you create a dedicated user with least privileges required to call the Saviynt fetchRuntimeControlsDataV2 API to obtain the audit logs. For example, you can associate a ROLE_ADMIN SAV role or a custom SAV role with required permissions to the user to call the API.
Perform the following steps to set up permissions:

1. Create a user, for example, `siem-sid`. For more information, see [Creating Users](https://docs.saviyntcloud.com/bundle/EIC-Admin-25/page/Content/Chapter03-User-Management/Creating-Users.htm).
2. Change the password for the user. For more information, see [Administrator Functions](https://docs.saviyntcloud.com/bundle/EIC-Admin-25/page/Content/Chapter07-General-Administrator/Administrator-Functions.htm).
3. Create a SAV role, for example, `ROLE_SIEM`.
4. Assign permissions to the newly created SAV role.
   1. Assign the permission to access the web service URL of the Saviynt fetchRuntimeControlsDataV2 API. For more information, see [Understanding the SAV Role Parameters](https://docs.saviyntcloud.com/bundle/EIC-Admin-25/page/Content/Chapter09-SAV-Roles/Understanding-the-SAV-Role-Parameters.htm).
   2. Assign the permission to verify the analytics record that you created. For more information, see [Understanding the SAV Role Parameters](https://docs.saviyntcloud.com/bundle/EIC-Admin-25/page/Content/Chapter09-SAV-Roles/Understanding-the-SAV-Role-Parameters.htm).
5. Associate the SAV role with the user created in Step 1. For more information, see [Understanding the SAV Role Parameters](https://docs.saviyntcloud.com/bundle/EIC-Admin-25/page/Content/Chapter09-SAV-Roles/Understanding-the-SAV-Role-Parameters.htm).

> Note: If you want to associate the `ROLE_ADMIN` SAV role with a user, you need not perform steps 4.1 and 4.2.