Workday IAM

Details

ID	`Workday IAM`
Provider	Workday
Category	Identity and Access Management
From Version	6.0.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM Cloud Posture Security

README

Use the Workday IAM Integration as part of the IAM premium pack.
For more information, please refer to the Identity Lifecycle Management article.

Configure Workday IAM in Cortex

Parameter	Description	Required
Username		False
Password		False
Workday Report URL		True
Fetch Limit (Recommended less than 200)		False
Fetch incidents	Whether or not to fetch events from Workday report. Enable only when all required configurations are set properly.	False
Incident type		False
Trust any certificate (not secure)		False
Use system proxy settings		False
Mapper (incoming)	Used to map Workday report entries to XSOAR indicators format.	False
Sync user profiles on first run	If checked, the first fetch won’t trigger incidents but all of the User Profile indicators will be created.	False
Fetch Samples	If checked, the fetch incidents command will sample (at most) five incidents. Use only to sample incidents for classification & mapping.	False
Date Format in Workday Report		False
Deactivation date field	Select the field that determines when to trigger a termination incident for deactivated employees.	False
Number of days before hire date to sync hires	Determines when employees are synced from Workday, i.e., when are the User Profile in XSOAR, and the users in the applications, created. Set to 0 to sync hires on their hire date. Leave empty to sync the hires immediately.	False
Number of days before hire date to enable Active Directory account	Determines when to enable the Active Directory accounts of employees. Set to 0 to enable the Active Directory accounts on their hire date. Leave empty to enable the accounts immediately. Note that this is effective only when the employees are already synced to XSOAR, so you should set a number lower, or equal to, the value in the Number of days before hire date to sync hires parameter.	False
Source Priority Level	Events will be fetched only for User Profiles with a Source Priority value less than or equal to the value of this parameter.	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

workday-iam-get-full-report

Gets the report entries from Workday.

Base Command

workday-iam-get-full-report

Input

There are no input arguments for this command.

Context Output

Path	Type	Description
WorkdayIAM.ReportEntry.email	String	Email address of the employee in Workday.
WorkdayIAM.ReportEntry.employeeid	String	Employee ID in Workday.
WorkdayIAM.ReportEntry.username	String	Username of the employee in Workday.
WorkdayIAM.ReportEntry.displayname	String	Display name of the employee.
WorkdayIAM.ReportEntry.locationregion	String	Location of the employee in Workday.

Command Example

!workday-iam-get-full-report

Human Readable Output

Results

city	costcenter	costcentercode	countryname	department	displayname	email	employeeid	employeetype	employmentstatus	givenname	hiredate	jobcode	jobfamily	jobfunction	lastdayofwork	leadership	location	locationregion	manageremailaddress	personalemail	prehireflag	rehiredemployee	sourceoftruth	sourcepriority	state	streetaddress	surname	terminationdate	title	username	zipcode
Santa Clara	Channel Sales	120100	United States Of America	Sales NAM:NAM Channel Sales	Ronny Rahardjo	rrahardjo@test.com	100122	Regular		Ronny	03/25/2021	2245	Product Management	Product Management Function	02/15/2032	Yes-HQ	Office - USA - CA - Headquarters	Americas	test@test.com	ronnyrahardjo@test.com	True	Yes	Workday IAM	1	California	3000 Tannery Way	Rahardjo	02/15/2032	Dir, Product Line Manager	rrahardjo@test.com	95054
San Francisco	Magnifier Sales Inc	101100	United States Of America	WW Sales Functions:Cortex Sales	Steve Testman	sarnold@test.com	101351	Regular		Stephen	03/26/2021	2163	Software Engineering	Engineering Function	02/15/2032	No	Office - USA - CA - San Francisco	Americas	test@test.com	stevearnoldtstc@test.com	True	Yes	Workday IAM	1	California	WeWork Embarcadero Center	Arnold	02/15/2032	Mgr, SW Engineering	sarnold@test.com	94111

Configuration parameters

credentials — Username
report_url — Workday Report URL (required)
max_fetch — Fetch Limit (Recommended less than 200)
isFetch — Fetch incidents
incidentType — Incident type
incidentFetchInterval — Incidents Fetch Interval
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
mapper_in — Mapper (incoming)
first_run — Sync user profiles on first run
fetch_samples — Fetch Samples
workday_date_format — Date Format in Workday Report
deactivation_date_field — Deactivation date field
days_before_hire_to_sync — Number of days before hire date to sync hires
days_before_hire_to_enable_ad — Number of days before hire date to enable Active Directory account
source_priority — Source Priority Level

Commands (1)

workday-iam-get-full-report
Gets the report entries from Workday.

Source

Workday_IAM.py Workday_IAM_test.py Workday_IAM.yml Workday_IAM_description.md

Download History Raw

category: Identity and Access Management
provider: Workday
commonfields:
  id: Workday IAM
  version: -1
sectionorder:
- Connect
- Collect
configuration:
- display: Username
  name: credentials
  type: 9
  required: false
  section: Connect
- display: Workday Report URL
  name: report_url
  required: true
  type: 0
  section: Connect
- defaultvalue: '50'
  display: Fetch Limit (Recommended less than 200)
  name: max_fetch
  type: 0
  required: false
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
  supportedModules:
  - agentix
  - xsiam
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- defaultvalue: IAM Sync User - Workday
  display: Mapper (incoming)
  name: mapper_in
  type: 0
  required: false
  section: Collect
- defaultvalue: 'true'
  display: Sync user profiles on first run
  name: first_run
  type: 8
  required: false
  section: Collect
- additionalinfo: If checked, the fetch incidents command will sample (at most) five incidents. Use only to sample incidents for classification & mapping.
  defaultvalue: 'false'
  display: Fetch Samples
  name: fetch_samples
  type: 8
  required: false
  section: Collect
- defaultvalue: '%m/%d/%Y'
  display: Date Format in Workday Report
  name: workday_date_format
  type: 0
  required: false
  section: Collect
- additionalinfo: Select the field that determines when to trigger a termination incident for deactivated employees.
  defaultvalue: Termination_Date
  display: Deactivation date field
  name: deactivation_date_field
  options:
  - Termination_Date
  - Last_Day_of_Work
  type: 15
  required: false
  section: Collect
- additionalinfo: Determines when employees are synced from Workday, i.e., when are the User Profile in XSOAR, and the users in the applications, created. Set to 0 to sync hires on their hire date. Leave empty to sync the hires immediately.
  display: Number of days before hire date to sync hires
  name: days_before_hire_to_sync
  type: 0
  required: false
  section: Collect
- additionalinfo: Determines when to enable the Active Directory accounts of employees. Set to 0 to enable the Active Directory accounts on their hire date. Leave empty to enable the accounts immediately. Note that this is effective only when the employees are already synced to XSOAR, so you should set a number lower, or equal to, the value in the *Number of days before hire date to sync hires* parameter.
  display: Number of days before hire date to enable Active Directory account
  name: days_before_hire_to_enable_ad
  type: 0
  required: false
  section: Collect
- additionalinfo: Events will be fetched only for User Profiles with a Source Priority value less than or equal to the value of this parameter.
  defaultvalue: '1'
  display: Source Priority Level
  name: source_priority
  type: 0
  required: false
  section: Collect
description: Use the Workday IAM Integration as part of the IAM premium pack.
display: Workday IAM
name: Workday IAM
script:
  commands:
  - description: Gets the report entries from Workday.
    name: workday-iam-get-full-report
    outputs:
    - contextPath: WorkdayIAM.ReportEntry.email
      description: Email address of the employee in Workday.
      type: String
    - contextPath: WorkdayIAM.ReportEntry.employeeid
      description: Employee ID in Workday.
      type: String
    - contextPath: WorkdayIAM.ReportEntry.username
      description: Username of the employee in Workday.
      type: String
    - contextPath: WorkdayIAM.ReportEntry.displayname
      description: Display name of the employee.
      type: String
    - contextPath: WorkdayIAM.ReportEntry.locationregion
      description: Location of the employee in Workday.
      type: String
  dockerimage: demisto/python3:3.12.13.10116658
  isfetch: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- No tests
defaultmapperin: IAM Sync User - Workday
fromversion: 6.0.0