category: Analytics & SIEM
provider: Saviynt
sectionorder:
- Connect
- Collect
commonfields:
  id: SaviyntEICEventCollector
  version: -1
configuration:
- display: Server URL
  name: url
  required: true
  type: 0
  section: Connect
- display: Username
  name: credentials
  required: true
  type: 9
  section: Connect
- display: Analytics Name
  name: analytics_name
  required: false
  type: 0
  section: Collect
  defaultvalue: SIEMAuditLogs
  additionalinfo: The name of the Analytics Runtime Control to fetch events from. This value must match an existing Analytics Record configured in Saviynt. Multiple values are not supported.
- defaultvalue: '30000'
  section: Collect
  display: Maximum number of events per fetch
  name: max_fetch
  required: false
  type: 0
- display: Trust any certificate (not secure)
  name: insecure
  required: false
  type: 8
  section: Connect
- name: eventFetchInterval
  section: Collect
  display: Events Fetch Interval
  advanced: true
  defaultvalue: "1"
  type: 19
  required: false
- display: Use system proxy settings
  name: proxy
  required: false
  type: 8
  section: Connect
description: Collector for Saviynt Enterprise Identity Cloud (EIC) audit logs using Analytics Runtime Control V2.
display: Saviynt Enterprise Identity Cloud
name: SaviyntEICEventCollector
script:
  commands:
  - arguments:
    - name: should_push_events
      auto: PREDEFINED
      defaultValue: 'false'
      description: If true, the command creates events, otherwise, it only displays them.
      isArray: false
      predefined:
      - 'true'
      - 'false'
      required: false
    - name: limit
      default: false
      description: Maximum number of results to return (max 10000).
      isArray: false
      required: true
      secret: false
    - name: time_frame
      default: false
      description: Time frame in minutes back from now to query.
      isArray: false
      required: false
      secret: false
    - name: offset
      default: false
      description: Offset for paging.
      isArray: false
      required: false
      secret: false
    deprecated: false
    description: Gets events from Saviynt EIC. This command is supported in Cortex XSIAM only and is intended to be used for debugging purposes as it may result in duplicate events.
    execution: false
    name: saviynt-eic-get-events
  dockerimage: demisto/python3:3.12.13.10116658
  isfetchevents: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
marketplaces:
- marketplacev2
- platform
fromversion: 8.4.0
tests:
- No tests (auto formatted)
supportedModules:
- xsiam