SailPoint IdentityNow Event Collector
This Integration is part of the SailPoint IdentityNow Pack.#
Supported versions
Supported Cortex XSOAR versions: 8.4.0 and later.
This is the SailPoint IdentityNow event collector integration for Cortex XSIAM. This integration was integrated and tested with version 3 of SailPoint API.
Configure SailPoint IdentityNow Event Collector in Cortex#
| Parameter | Required |
|---|---|
| IdentityNow Server URL (e.g., https://{tenant}.api.identitynow.com) In order to get the tenant name, follow this link. | True |
| Client ID In order to generate the Client ID and Client Secret, follow this link. | True |
| Client Secret | True |
| Max number of events per fetch | False |
| Minutes to look back when fetching | False |
| Trust any certificate (not secure) | False |
| Use system proxy settings | False |
Note: The Minutes to look back when fetching parameter is recommended when missing events due to API indexing delay. It should be increased with caution, since in cases of dense events within a minute, increasing the lookback for several minutes can affect performance.
Note: After generating client credentials, it is required to allow the following scopes: sp, search, read.
Commands#
You can execute these commands from the CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.
identitynow-get-events#
Gets events from SailPoint IdentityNow. This command is used for developing/debugging and is to be used with caution, as it can create events, leading to event duplication and exceeding API request limitations.
Base Command#
identitynow-get-events
Input#
| Argument Name | Description | Required |
|---|---|---|
| should_push_events | If true, the command will create events, otherwise it will only display them. Possible values are: true, false. Default is false. | Optional |
| limit | Maximum number of results to return. Default is 50. | Optional |
| from_date | Date from which to get events in the format of %Y-%m-%dT%H:%M:%S. | Optional |
| from_id | An ID of the event to retrieve events from. | Optional |
Context Output#
There is no context output for this command.