diff --git a/packages/sailpoint_identity_sc/_dev/build/build.yml b/packages/sailpoint_identity_sc/_dev/build/build.yml index e2b012548e0..ac5efe47b5c 100644 --- a/packages/sailpoint_identity_sc/_dev/build/build.yml +++ b/packages/sailpoint_identity_sc/_dev/build/build.yml @@ -1,3 +1,3 @@ dependencies: ecs: - reference: git@v8.11.0 + reference: git@v9.4.0 diff --git a/packages/sailpoint_identity_sc/_dev/build/docs/README.md b/packages/sailpoint_identity_sc/_dev/build/docs/README.md index f9643811ffd..306e064f9b6 100644 --- a/packages/sailpoint_identity_sc/_dev/build/docs/README.md +++ b/packages/sailpoint_identity_sc/_dev/build/docs/README.md @@ -9,24 +9,30 @@ Agentless deployments are only supported in Elastic Serverless and Elastic Cloud ## Data Streams -- **`events`**: Provides audit data that includes actions such as `USER_MANAGEMENT`, `PASSWORD_ACTIVITY`, `PROVISIONING`, `ACCESS_ITEM`, `SOURCE_MANAGEMENT`, `CERTIFICATION`, `AUTH`, `SYSTEM_CONFIG`, `ACCESS_REQUEST`, `SSO`, `WORKFLOW`, `SEGMENT` and more. -- [Audit Events](https://community.sailpoint.com/t5/IdentityNow-Wiki/Audit-Events-in-Cloud-Audit/ta-p/218727) are records that a user took action in an [IdentityNow](https://www.sailpoint.com/products/identitynow) tenant, or other service like [IdentityAI](https://www.sailpoint.com/products/ai-driven-identity-security). Audit Events are structurally and conceptually very similar to [IdentityIQ's](https://www.sailpoint.com/products/identity-security-software/identity-iq)Audit Events, but have evolved in several ways. -- This data stream leverages the Sailpoint identity security cloud API's [/v2025/search](https://developer.sailpoint.com/docs/api/v2025/search-post) endpoint to retrieve event logs. +- **`events`**: Provides audit data that includes actions such as `USER_MANAGEMENT`, `PASSWORD_ACTIVITY`, `PROVISIONING`, `ACCESS_ITEM`, `SOURCE_MANAGEMENT`, `CERTIFICATION`, `AUTH`, `SYSTEM_CONFIG`, `ACCESS_REQUEST`, `SSO`, `WORKFLOW`, `SEGMENT` and more. [Audit Events](https://community.sailpoint.com/t5/IdentityNow-Wiki/Audit-Events-in-Cloud-Audit/ta-p/218727) are records that a user took action in an [IdentityNow](https://www.sailpoint.com/products/identitynow) tenant, or other service like [IdentityAI](https://www.sailpoint.com/products/ai-driven-identity-security). This data stream leverages the [/v2026/search](https://developer.sailpoint.com/docs/api/v2026/search-post) endpoint. + +- **`machine_identities`**: Collects machine/non-human identity records (service accounts, application accounts, bots, and AI agents) governed by SailPoint ISC. Each document represents a machine identity with its owner relationships and held entitlements. Uses the experimental [Machine Identities API](https://developer.sailpoint.com/docs/api/v2026/list-machine-identities/) with a full offset-based scan each collection cycle. **Note:** This data stream depends on an experimental SailPoint API (`X-SailPoint-Experimental: true`). The API may change without notice in future SailPoint releases. HTTP 404 and 501 responses are treated as "feature not enabled" rather than errors. ## Requirements -### Generate a Personal Access Token (PAT) +### Create an OAuth2 API Client + +This integration uses OAuth2 `client_credentials` to authenticate against the SailPoint ISC API. -Log in to the application with an administrator account and generate a **Personal Access Token (PAT)**. Personal access tokens are associated with a user in **Sailpoint identity security cloud** and inherit the user's permission level (e.g., Admin, Helpdesk, etc.) to determine access. +1. Log in to the SailPoint ISC admin console. +2. Navigate to **Admin → Security Settings → API Management**. +3. Click **Create API Client**, select **Client Credentials** as grant type, and grant the following scopes: + - `sp:search:read` — required for the `events` and `identities` data streams + - `idn:mis-identity:read` and `idn:mis-identity:manage` — required for the `machine_identities` data stream (experimental API) +4. Note the generated **Client ID** and **Client Secret** for use in the integration configuration. -To create a **Personal Access Token (PAT)** using an **admin account**, follow the instructions provided in the official documentation: -[Generate a Personal Access Token](https://developer.sailpoint.com/docs/api/v2024/authentication#generate-a-personal-access-token). +For further details see the official [Authentication documentation](https://developer.sailpoint.com/docs/api/authentication). ## Logs ### Events -Event documents can be found by setting the following filter: +Event documents can be found by setting the following filter: `event.dataset : "sailpoint_identity_sc.events"` {{event "events"}} @@ -39,3 +45,19 @@ The following non-ECS fields are used in events documents: {{fields "events"}} +### Machine Identities + +Machine identity documents can be found by setting the following filter: +`event.dataset : "sailpoint_identity_sc.machine_identities"` + +Machine identity documents carry ECS entity fields (`service.entity.*`) that enable entity analytics for non-human identities such as service accounts, application accounts, bots, and AI agents. + +{{event "machine_identities"}} + +**ECS Field Reference** + +Please refer to the following [document](https://www.elastic.co/guide/en/ecs/current/ecs-field-reference.html) for detailed information on ECS fields. + +The following non-ECS fields are used in machine_identities documents: + +{{fields "machine_identities"}} diff --git a/packages/sailpoint_identity_sc/_dev/deploy/docker/docker-compose.yml b/packages/sailpoint_identity_sc/_dev/deploy/docker/docker-compose.yml index 8e603055d2c..9e82eabde9b 100644 --- a/packages/sailpoint_identity_sc/_dev/deploy/docker/docker-compose.yml +++ b/packages/sailpoint_identity_sc/_dev/deploy/docker/docker-compose.yml @@ -12,3 +12,16 @@ services: - http-server - --addr=:8080 - --config=/files/config.yml + sailpoint-machine-identities: + image: docker.elastic.co/observability/stream:v0.20.0 + hostname: sailpoint-machine-identities + ports: + - 8091 + volumes: + - ./files:/files:ro + environment: + PORT: '8091' + command: + - http-server + - --addr=:8091 + - --config=/files/config-machine-identities.yml diff --git a/packages/sailpoint_identity_sc/_dev/deploy/docker/files/config-machine-identities.yml b/packages/sailpoint_identity_sc/_dev/deploy/docker/files/config-machine-identities.yml new file mode 100644 index 00000000000..2b54e370926 --- /dev/null +++ b/packages/sailpoint_identity_sc/_dev/deploy/docker/files/config-machine-identities.yml @@ -0,0 +1,179 @@ +rules: + # OAuth Token Endpoint + # Used by the system test agent for OAuth2 client_credentials flow. + # SailPoint ISC rejects an explicit scope parameter in the token request body, + # so no scope is sent in the request. + - path: /oauth/token + methods: + - POST + query_params: + grant_type: client_credentials + client_id: test-client-id + client_secret: test-client-secret + request_headers: + Content-Type: + - application/x-www-form-urlencoded + responses: + - status_code: 200 + headers: + Content-Type: + - application/json + body: | + { + "access_token": "test-token-machine-identities", + "expires_in": 3600, + "token_type": "Bearer" + } + # Round 2, Page 1 (offset=0) — cursor resume after Round 1 completes. + # Same as Round 1 Page 1. Returns 2 records, pagination will continue. + # Rule ordering: Round 2 termination (offset=2) is placed BEFORE this rule + # so the more specific offset=2 rule matches before the fallback. + # This rule uses a separate response block to indicate Round 2; response + # data is identical to Round 1 Page 1 (full scan restarted). + - path: /v2026/machine-identities + methods: + - GET + query_params: + limit: "2" + offset: "0" + request_headers: + Authorization: + - Bearer test-token-machine-identities + X-SailPoint-Experimental: + - "true" + responses: + - status_code: 200 + headers: + Content-Type: + - application/json + body: | + [ + { + "id": "mi-id-aabbccdd-1111-2222-3333-000000000001", + "name": "svc-example-service", + "created": "2024-01-15T10:30:00Z", + "modified": "2025-01-10T08:45:00Z", + "nativeIdentity": "svc-example:prod:00001", + "description": "Example service account for integration tests.", + "attributes": { + "env": "production", + "team": "Platform" + }, + "subtype": "Application", + "owners": { + "primaryIdentity": { + "type": "IDENTITY", + "id": "00000000000000000000000000000001", + "name": "alice.example" + }, + "secondaryIdentities": [] + }, + "sourceId": "src-id-aabbccdd-1111-2222-3333-000000000001", + "uuid": "uuid-aabbccdd-1111-2222-3333-000000000001", + "manuallyEdited": false, + "manuallyCreated": false, + "source": { + "type": "SOURCE", + "id": "src-id-aabbccdd-1111-2222-3333-000000000001", + "name": "Example Directory" + }, + "datasetId": "ds-id-aabbccdd-1111-2222-3333-000000000001", + "userEntitlements": [] + }, + { + "id": "mi-id-aabbccdd-1111-2222-3333-000000000002", + "name": "svc-reporting-job", + "created": "2024-02-20T14:00:00Z", + "modified": "2025-01-11T09:00:00Z", + "nativeIdentity": "svc-reporting:prod:00002", + "description": "Service account for scheduled reporting tasks.", + "attributes": { + "env": "production", + "team": "Analytics" + }, + "subtype": "Application", + "owners": { + "primaryIdentity": { + "type": "IDENTITY", + "id": "00000000000000000000000000000002", + "name": "bob.example" + }, + "secondaryIdentities": [] + }, + "sourceId": "src-id-aabbccdd-1111-2222-3333-000000000002", + "uuid": "uuid-aabbccdd-1111-2222-3333-000000000002", + "manuallyEdited": false, + "manuallyCreated": false, + "source": { + "type": "SOURCE", + "id": "src-id-aabbccdd-1111-2222-3333-000000000002", + "name": "Example Cloud Apps" + }, + "datasetId": "ds-id-aabbccdd-1111-2222-3333-000000000002", + "userEntitlements": [ + { + "sourceId": "src-id-aabbccdd-1111-2222-3333-000000000003", + "entitlementId": "ent-id-aabbccdd-1111-2222-3333-000000000001", + "displayName": "Reports DB Read Access", + "source": { + "type": "SOURCE", + "id": "src-id-aabbccdd-1111-2222-3333-000000000003", + "name": "Example SQL DB" + } + } + ] + } + ] + # Round 1, Terminal page (offset=2): returns 1 record (< batch_size=2), triggers termination. + # Also serves as Round 2 termination for offset=2. + - path: /v2026/machine-identities + methods: + - GET + query_params: + limit: "2" + offset: "2" + request_headers: + Authorization: + - Bearer test-token-machine-identities + X-SailPoint-Experimental: + - "true" + responses: + - status_code: 200 + headers: + Content-Type: + - application/json + body: | + [ + { + "id": "mi-id-aabbccdd-1111-2222-3333-000000000003", + "name": "svc-audit-collector", + "created": "2024-03-10T08:00:00Z", + "modified": "2025-01-12T07:30:00Z", + "nativeIdentity": "svc-audit:prod:00003", + "description": "Service account for audit log collection.", + "attributes": { + "env": "production", + "team": "Security" + }, + "subtype": "Application", + "owners": { + "primaryIdentity": { + "type": "IDENTITY", + "id": "00000000000000000000000000000003", + "name": "carol.example" + }, + "secondaryIdentities": [] + }, + "sourceId": "src-id-aabbccdd-1111-2222-3333-000000000001", + "uuid": "uuid-aabbccdd-1111-2222-3333-000000000003", + "manuallyEdited": false, + "manuallyCreated": false, + "source": { + "type": "SOURCE", + "id": "src-id-aabbccdd-1111-2222-3333-000000000001", + "name": "Example Directory" + }, + "datasetId": "ds-id-aabbccdd-1111-2222-3333-000000000001", + "userEntitlements": [] + } + ] diff --git a/packages/sailpoint_identity_sc/changelog.yml b/packages/sailpoint_identity_sc/changelog.yml index 70e85d47502..a520e1acdb3 100644 --- a/packages/sailpoint_identity_sc/changelog.yml +++ b/packages/sailpoint_identity_sc/changelog.yml @@ -1,3 +1,8 @@ +- version: "2.0.0-next" + changes: + - description: Add `machine_identities` data stream for machine identity records via the Machine Identities API. + type: enhancement + link: https://github.com/elastic/integrations/pull/20198 - version: "1.3.0" changes: - description: Enable Agentless deployment. diff --git a/packages/sailpoint_identity_sc/data_stream/machine_identities/_dev/test/pipeline/test-common-config.yml b/packages/sailpoint_identity_sc/data_stream/machine_identities/_dev/test/pipeline/test-common-config.yml new file mode 100644 index 00000000000..4da22641654 --- /dev/null +++ b/packages/sailpoint_identity_sc/data_stream/machine_identities/_dev/test/pipeline/test-common-config.yml @@ -0,0 +1,3 @@ +fields: + tags: + - preserve_original_event diff --git a/packages/sailpoint_identity_sc/data_stream/machine_identities/_dev/test/pipeline/test-machine-identity-full-sample.log b/packages/sailpoint_identity_sc/data_stream/machine_identities/_dev/test/pipeline/test-machine-identity-full-sample.log new file mode 100644 index 00000000000..6577f3eb689 --- /dev/null +++ b/packages/sailpoint_identity_sc/data_stream/machine_identities/_dev/test/pipeline/test-machine-identity-full-sample.log @@ -0,0 +1 @@ +{"id":"mi-id-aabbccdd-1111-2222-3333-000000000002","name":"svc-reporting-job","created":"2024-02-20T14:00:00Z","modified":"2025-01-11T09:00:00Z","nativeIdentity":"svc-reporting:prod:00002","description":"Service account for scheduled reporting tasks.","attributes":{"env":"production","team":"Analytics"},"subtype":"Application","owners":{"primaryIdentity":{"type":"IDENTITY","id":"00000000000000000000000000000002","name":"bob.example"},"secondaryIdentities":[{"type":"IDENTITY","id":"00000000000000000000000000000004","name":"alice.example"}]},"sourceId":"src-id-aabbccdd-1111-2222-3333-000000000002","uuid":"uuid-aabbccdd-1111-2222-3333-000000000002","manuallyEdited":false,"manuallyCreated":false,"source":{"type":"SOURCE","id":"src-id-aabbccdd-1111-2222-3333-000000000002","name":"Example Cloud Apps"},"datasetId":"ds-id-aabbccdd-1111-2222-3333-000000000002","userEntitlements":[{"sourceId":"src-id-aabbccdd-1111-2222-3333-000000000003","entitlementId":"ent-id-aabbccdd-1111-2222-3333-000000000001","displayName":"Reports DB Read Access","source":{"type":"SOURCE","id":"src-id-aabbccdd-1111-2222-3333-000000000003","name":"Example SQL DB"}}]} diff --git a/packages/sailpoint_identity_sc/data_stream/machine_identities/_dev/test/pipeline/test-machine-identity-full-sample.log-expected.json b/packages/sailpoint_identity_sc/data_stream/machine_identities/_dev/test/pipeline/test-machine-identity-full-sample.log-expected.json new file mode 100644 index 00000000000..24f8f037e6b --- /dev/null +++ b/packages/sailpoint_identity_sc/data_stream/machine_identities/_dev/test/pipeline/test-machine-identity-full-sample.log-expected.json @@ -0,0 +1,88 @@ +{ + "expected": [ + { + "@timestamp": "2025-01-11T09:00:00.000Z", + "ecs": { + "version": "9.4.0" + }, + "event": { + "category": [ + "iam" + ], + "created": "2024-02-20T14:00:00.000Z", + "kind": "asset", + "original": "{\"id\":\"mi-id-aabbccdd-1111-2222-3333-000000000002\",\"name\":\"svc-reporting-job\",\"created\":\"2024-02-20T14:00:00Z\",\"modified\":\"2025-01-11T09:00:00Z\",\"nativeIdentity\":\"svc-reporting:prod:00002\",\"description\":\"Service account for scheduled reporting tasks.\",\"attributes\":{\"env\":\"production\",\"team\":\"Analytics\"},\"subtype\":\"Application\",\"owners\":{\"primaryIdentity\":{\"type\":\"IDENTITY\",\"id\":\"00000000000000000000000000000002\",\"name\":\"bob.example\"},\"secondaryIdentities\":[{\"type\":\"IDENTITY\",\"id\":\"00000000000000000000000000000004\",\"name\":\"alice.example\"}]},\"sourceId\":\"src-id-aabbccdd-1111-2222-3333-000000000002\",\"uuid\":\"uuid-aabbccdd-1111-2222-3333-000000000002\",\"manuallyEdited\":false,\"manuallyCreated\":false,\"source\":{\"type\":\"SOURCE\",\"id\":\"src-id-aabbccdd-1111-2222-3333-000000000002\",\"name\":\"Example Cloud Apps\"},\"datasetId\":\"ds-id-aabbccdd-1111-2222-3333-000000000002\",\"userEntitlements\":[{\"sourceId\":\"src-id-aabbccdd-1111-2222-3333-000000000003\",\"entitlementId\":\"ent-id-aabbccdd-1111-2222-3333-000000000001\",\"displayName\":\"Reports DB Read Access\",\"source\":{\"type\":\"SOURCE\",\"id\":\"src-id-aabbccdd-1111-2222-3333-000000000003\",\"name\":\"Example SQL DB\"}}]}", + "type": [ + "info" + ] + }, + "related": { + "user": [ + "bob.example", + "alice.example" + ] + }, + "sailpoint_identity_sc": { + "machine_identity": { + "attributes": { + "env": "production", + "team": "Analytics" + }, + "created": "2024-02-20T14:00:00.000Z", + "dataset_id": "ds-id-aabbccdd-1111-2222-3333-000000000002", + "description": "Service account for scheduled reporting tasks.", + "manually_created": false, + "manually_edited": false, + "modified": "2025-01-11T09:00:00.000Z", + "native_identity": "svc-reporting:prod:00002", + "owners": { + "primary": { + "id": "00000000000000000000000000000002", + "name": "bob.example" + }, + "secondary": [ + { + "id": "00000000000000000000000000000004", + "name": "alice.example", + "type": "IDENTITY" + } + ] + }, + "source": { + "id": "src-id-aabbccdd-1111-2222-3333-000000000002", + "name": "Example Cloud Apps" + }, + "source_id": "src-id-aabbccdd-1111-2222-3333-000000000002", + "user_entitlements": [ + { + "displayName": "Reports DB Read Access", + "entitlementId": "ent-id-aabbccdd-1111-2222-3333-000000000001", + "source": { + "id": "src-id-aabbccdd-1111-2222-3333-000000000003", + "name": "Example SQL DB", + "type": "SOURCE" + }, + "sourceId": "src-id-aabbccdd-1111-2222-3333-000000000003" + } + ], + "uuid": "uuid-aabbccdd-1111-2222-3333-000000000002" + } + }, + "service": { + "entity": { + "id": "mi-id-aabbccdd-1111-2222-3333-000000000002", + "name": "svc-reporting-job", + "type": [ + "service" + ] + }, + "id": "mi-id-aabbccdd-1111-2222-3333-000000000002", + "name": "svc-reporting-job", + "type": "Application" + }, + "tags": [ + "preserve_original_event" + ] + } + ] +} diff --git a/packages/sailpoint_identity_sc/data_stream/machine_identities/_dev/test/pipeline/test-machine-identity-minimal-sample.log b/packages/sailpoint_identity_sc/data_stream/machine_identities/_dev/test/pipeline/test-machine-identity-minimal-sample.log new file mode 100644 index 00000000000..bcd354a68f9 --- /dev/null +++ b/packages/sailpoint_identity_sc/data_stream/machine_identities/_dev/test/pipeline/test-machine-identity-minimal-sample.log @@ -0,0 +1 @@ +{"id":"mi-id-aabbccdd-1111-2222-3333-000000000001","name":"svc-example-service","created":"2024-01-15T10:30:00Z","modified":"2025-01-10T08:45:00Z","nativeIdentity":"svc-example:prod:00001","description":"Example service account for integration tests.","attributes":{"env":"production","team":"Platform"},"subtype":"Application","owners":{"primaryIdentity":{"type":"IDENTITY","id":"00000000000000000000000000000001","name":"alice.example"},"secondaryIdentities":[]},"sourceId":"src-id-aabbccdd-1111-2222-3333-000000000001","uuid":"uuid-aabbccdd-1111-2222-3333-000000000001","manuallyEdited":false,"manuallyCreated":false,"source":{"type":"SOURCE","id":"src-id-aabbccdd-1111-2222-3333-000000000001","name":"Example Directory"},"datasetId":"ds-id-aabbccdd-1111-2222-3333-000000000001","userEntitlements":[]} diff --git a/packages/sailpoint_identity_sc/data_stream/machine_identities/_dev/test/pipeline/test-machine-identity-minimal-sample.log-expected.json b/packages/sailpoint_identity_sc/data_stream/machine_identities/_dev/test/pipeline/test-machine-identity-minimal-sample.log-expected.json new file mode 100644 index 00000000000..9a86e35ba47 --- /dev/null +++ b/packages/sailpoint_identity_sc/data_stream/machine_identities/_dev/test/pipeline/test-machine-identity-minimal-sample.log-expected.json @@ -0,0 +1,70 @@ +{ + "expected": [ + { + "@timestamp": "2025-01-10T08:45:00.000Z", + "ecs": { + "version": "9.4.0" + }, + "event": { + "category": [ + "iam" + ], + "created": "2024-01-15T10:30:00.000Z", + "kind": "asset", + "original": "{\"id\":\"mi-id-aabbccdd-1111-2222-3333-000000000001\",\"name\":\"svc-example-service\",\"created\":\"2024-01-15T10:30:00Z\",\"modified\":\"2025-01-10T08:45:00Z\",\"nativeIdentity\":\"svc-example:prod:00001\",\"description\":\"Example service account for integration tests.\",\"attributes\":{\"env\":\"production\",\"team\":\"Platform\"},\"subtype\":\"Application\",\"owners\":{\"primaryIdentity\":{\"type\":\"IDENTITY\",\"id\":\"00000000000000000000000000000001\",\"name\":\"alice.example\"},\"secondaryIdentities\":[]},\"sourceId\":\"src-id-aabbccdd-1111-2222-3333-000000000001\",\"uuid\":\"uuid-aabbccdd-1111-2222-3333-000000000001\",\"manuallyEdited\":false,\"manuallyCreated\":false,\"source\":{\"type\":\"SOURCE\",\"id\":\"src-id-aabbccdd-1111-2222-3333-000000000001\",\"name\":\"Example Directory\"},\"datasetId\":\"ds-id-aabbccdd-1111-2222-3333-000000000001\",\"userEntitlements\":[]}", + "type": [ + "info" + ] + }, + "related": { + "user": [ + "alice.example" + ] + }, + "sailpoint_identity_sc": { + "machine_identity": { + "attributes": { + "env": "production", + "team": "Platform" + }, + "created": "2024-01-15T10:30:00.000Z", + "dataset_id": "ds-id-aabbccdd-1111-2222-3333-000000000001", + "description": "Example service account for integration tests.", + "manually_created": false, + "manually_edited": false, + "modified": "2025-01-10T08:45:00.000Z", + "native_identity": "svc-example:prod:00001", + "owners": { + "primary": { + "id": "00000000000000000000000000000001", + "name": "alice.example" + }, + "secondary": [] + }, + "source": { + "id": "src-id-aabbccdd-1111-2222-3333-000000000001", + "name": "Example Directory" + }, + "source_id": "src-id-aabbccdd-1111-2222-3333-000000000001", + "user_entitlements": [], + "uuid": "uuid-aabbccdd-1111-2222-3333-000000000001" + } + }, + "service": { + "entity": { + "id": "mi-id-aabbccdd-1111-2222-3333-000000000001", + "name": "svc-example-service", + "type": [ + "service" + ] + }, + "id": "mi-id-aabbccdd-1111-2222-3333-000000000001", + "name": "svc-example-service", + "type": "Application" + }, + "tags": [ + "preserve_original_event" + ] + } + ] +} diff --git a/packages/sailpoint_identity_sc/data_stream/machine_identities/_dev/test/pipeline/test-machine-identity-no-name-sample.log b/packages/sailpoint_identity_sc/data_stream/machine_identities/_dev/test/pipeline/test-machine-identity-no-name-sample.log new file mode 100644 index 00000000000..fea0fa16e1b --- /dev/null +++ b/packages/sailpoint_identity_sc/data_stream/machine_identities/_dev/test/pipeline/test-machine-identity-no-name-sample.log @@ -0,0 +1 @@ +{"id":"mi-id-aabbccdd-1111-2222-3333-000000000003","name":null,"created":"2024-03-10T08:00:00Z","modified":"2025-01-12T07:30:00Z","nativeIdentity":"svc-audit:prod:00003","description":"Service account for audit log collection.","attributes":{"env":"production","team":"Security"},"subtype":"Application","owners":{"primaryIdentity":{"type":"IDENTITY","id":"00000000000000000000000000000003","name":"carol.example"},"secondaryIdentities":[]},"sourceId":"src-id-aabbccdd-1111-2222-3333-000000000001","uuid":"uuid-aabbccdd-1111-2222-3333-000000000003","manuallyEdited":false,"manuallyCreated":false,"source":{"type":"SOURCE","id":"src-id-aabbccdd-1111-2222-3333-000000000001","name":"Example Directory"},"datasetId":"ds-id-aabbccdd-1111-2222-3333-000000000001","userEntitlements":[]} diff --git a/packages/sailpoint_identity_sc/data_stream/machine_identities/_dev/test/pipeline/test-machine-identity-no-name-sample.log-expected.json b/packages/sailpoint_identity_sc/data_stream/machine_identities/_dev/test/pipeline/test-machine-identity-no-name-sample.log-expected.json new file mode 100644 index 00000000000..da3a0868e01 --- /dev/null +++ b/packages/sailpoint_identity_sc/data_stream/machine_identities/_dev/test/pipeline/test-machine-identity-no-name-sample.log-expected.json @@ -0,0 +1,68 @@ +{ + "expected": [ + { + "@timestamp": "2025-01-12T07:30:00.000Z", + "ecs": { + "version": "9.4.0" + }, + "event": { + "category": [ + "iam" + ], + "created": "2024-03-10T08:00:00.000Z", + "kind": "asset", + "original": "{\"id\":\"mi-id-aabbccdd-1111-2222-3333-000000000003\",\"name\":null,\"created\":\"2024-03-10T08:00:00Z\",\"modified\":\"2025-01-12T07:30:00Z\",\"nativeIdentity\":\"svc-audit:prod:00003\",\"description\":\"Service account for audit log collection.\",\"attributes\":{\"env\":\"production\",\"team\":\"Security\"},\"subtype\":\"Application\",\"owners\":{\"primaryIdentity\":{\"type\":\"IDENTITY\",\"id\":\"00000000000000000000000000000003\",\"name\":\"carol.example\"},\"secondaryIdentities\":[]},\"sourceId\":\"src-id-aabbccdd-1111-2222-3333-000000000001\",\"uuid\":\"uuid-aabbccdd-1111-2222-3333-000000000003\",\"manuallyEdited\":false,\"manuallyCreated\":false,\"source\":{\"type\":\"SOURCE\",\"id\":\"src-id-aabbccdd-1111-2222-3333-000000000001\",\"name\":\"Example Directory\"},\"datasetId\":\"ds-id-aabbccdd-1111-2222-3333-000000000001\",\"userEntitlements\":[]}", + "type": [ + "info" + ] + }, + "related": { + "user": [ + "carol.example" + ] + }, + "sailpoint_identity_sc": { + "machine_identity": { + "attributes": { + "env": "production", + "team": "Security" + }, + "created": "2024-03-10T08:00:00.000Z", + "dataset_id": "ds-id-aabbccdd-1111-2222-3333-000000000001", + "description": "Service account for audit log collection.", + "manually_created": false, + "manually_edited": false, + "modified": "2025-01-12T07:30:00.000Z", + "native_identity": "svc-audit:prod:00003", + "owners": { + "primary": { + "id": "00000000000000000000000000000003", + "name": "carol.example" + }, + "secondary": [] + }, + "source": { + "id": "src-id-aabbccdd-1111-2222-3333-000000000001", + "name": "Example Directory" + }, + "source_id": "src-id-aabbccdd-1111-2222-3333-000000000001", + "user_entitlements": [], + "uuid": "uuid-aabbccdd-1111-2222-3333-000000000003" + } + }, + "service": { + "entity": { + "id": "mi-id-aabbccdd-1111-2222-3333-000000000003", + "type": [ + "service" + ] + }, + "id": "mi-id-aabbccdd-1111-2222-3333-000000000003", + "type": "Application" + }, + "tags": [ + "preserve_original_event" + ] + } + ] +} diff --git a/packages/sailpoint_identity_sc/data_stream/machine_identities/_dev/test/system/test-default-config.yml b/packages/sailpoint_identity_sc/data_stream/machine_identities/_dev/test/system/test-default-config.yml new file mode 100644 index 00000000000..77b5dcf8c3b --- /dev/null +++ b/packages/sailpoint_identity_sc/data_stream/machine_identities/_dev/test/system/test-default-config.yml @@ -0,0 +1,24 @@ +wait_for_data_timeout: 1m +input: cel +service: sailpoint-machine-identities +vars: + api_version: v2026 + client_id: test-client-id + client_secret: test-client-secret + api_host: http://{{Hostname}}:{{Port}} + token_scopes: + - sp:scopes:all +data_stream: + vars: + interval: 2s + batch_size: 2 + preserve_original_event: true + tags: + - forwarded + - sailpoint_identity_sc.machine_identities +assert: + # The CEL program performs a continuous full scan (no cursor/deduplication). + # With interval: 2s and batch_size: 2, each cycle produces 3 events (page1=2 + page2=1). + # Use min_count instead of hit_count because the data stream grows continuously + # and hit_count requires a stable (non-changing) document count to pass. + min_count: 6 diff --git a/packages/sailpoint_identity_sc/data_stream/machine_identities/agent/stream/cel.yml.hbs b/packages/sailpoint_identity_sc/data_stream/machine_identities/agent/stream/cel.yml.hbs new file mode 100644 index 00000000000..45de69e18c8 --- /dev/null +++ b/packages/sailpoint_identity_sc/data_stream/machine_identities/agent/stream/cel.yml.hbs @@ -0,0 +1,104 @@ +config_version: 2 +interval: {{interval}} +resource.tracer: + enabled: {{enable_request_tracer}} + filename: "../../logs/cel/http-request-trace-*.ndjson" + maxbackups: 5 +{{#if proxy_url}} +resource.proxy_url: {{proxy_url}} +{{/if}} +{{#if ssl}} +resource.ssl: {{ssl}} +{{/if}} +{{#if http_client_timeout}} +resource.timeout: {{http_client_timeout}} +{{/if}} +resource.rate_limit.limit: 10 +resource.rate_limit.burst: 5 +resource.url: {{api_host}} +auth: + oauth2: + client: + id: {{client_id}} + secret: {{client_secret}} + token_url: "{{api_host}}/oauth/token" + scopes: + {{#each token_scopes as |token_scope|}} + - {{token_scope}} + {{/each}} + endpoint_params: + grant_type: client_credentials +state: + batch_size: {{batch_size}} + api_version: {{api_version}} +redact: + fields: ~ +program: |- + // Full scan every collection cycle via offset+limit pagination. + // No cursor — machine_identities does not use time-based filtering. + // X-SailPoint-Experimental header is required and hardcoded. + // HTTP 404 and 501 are treated as "feature not enabled" (no data, no error). + int(state.?offset.orValue(0)).as(offset, + state.with( + request( + "GET", + state.url.trim_right("/") + "/" + state.api_version + "/machine-identities?" + { + "limit": [string(int(state.batch_size))], + "offset": [string(offset)], + }.format_query() + ).with( + { + "Header": { + "X-SailPoint-Experimental": ["true"], + }, + } + ).do_request().as(resp, + (resp.StatusCode == 200) ? + resp.Body.decode_json().as(body, + { + "events": body.map(e, {"message": e.encode_json()}), + "offset": (size(body) == int(state.batch_size)) ? (offset + int(state.batch_size)) : 0, + "want_more": size(body) == int(state.batch_size), + } + ) + : (resp.StatusCode == 404 || resp.StatusCode == 501) ? + { + "events": [], + "offset": 0, + "want_more": false, + } + : + { + "events": { + "error": { + "code": string(resp.StatusCode), + "id": string(resp.Status), + "message": "GET /" + state.api_version + "/machine-identities: " + + ( + (size(resp.Body) != 0) ? + string(resp.Body) + : + string(resp.Status) + " (" + string(resp.StatusCode) + ")" + ), + }, + }, + "offset": 0, + "want_more": false, + } + ) + ) + ) +tags: +{{#if preserve_original_event}} + - preserve_original_event +{{/if}} +{{#each tags as |tag|}} + - {{tag}} +{{/each}} +{{#contains "forwarded" tags}} +publisher_pipeline.disable_host: true +{{/contains}} +{{#if processors}} +processors: +{{processors}} +{{/if}} diff --git a/packages/sailpoint_identity_sc/data_stream/machine_identities/elasticsearch/ingest_pipeline/default.yml b/packages/sailpoint_identity_sc/data_stream/machine_identities/elasticsearch/ingest_pipeline/default.yml new file mode 100644 index 00000000000..64d0a1eeddf --- /dev/null +++ b/packages/sailpoint_identity_sc/data_stream/machine_identities/elasticsearch/ingest_pipeline/default.yml @@ -0,0 +1,268 @@ +--- +description: Pipeline for processing SailPoint Identity Security Cloud machine identity records. +processors: + - set: + field: ecs.version + tag: set_ecs_version + value: '9.4.0' + + # --- CEL input only --- + - remove: + field: + - organization + - division + - team + ignore_missing: true + if: ctx.organization instanceof String && ctx.division instanceof String && ctx.team instanceof String + tag: remove_agentless_tags + description: >- + Removes the fields added by Agentless as metadata, + as they can collide with ECS fields. + - terminate: + tag: data_collection_error + if: ctx.error?.message != null && ctx.message == null && ctx.event?.original == null + description: error message set and no data to process. + # --- end CEL-only --- + + - rename: + field: message + tag: rename_message_to_event_original + target_field: event.original + ignore_missing: true + description: Renames the original `message` field to `event.original` to store a copy of the original message. The `event.original` field is not touched if the document already has one; it may happen when Logstash sends the document. + if: ctx.event?.original == null + - remove: + field: message + tag: remove_message + ignore_missing: true + description: The `message` field is no longer required if the document has an `event.original` field. + if: ctx.event?.original != null + + # Parse JSON from event.original + - json: + field: event.original + target_field: json + tag: parse_json + if: ctx.event?.original != null + + # --- ECS categorization (static for all machine identity records) --- + - set: + field: event.kind + tag: set_event_kind + value: asset + - append: + field: event.category + tag: append_event_category_iam + value: iam + allow_duplicates: false + - append: + field: event.type + tag: append_event_type_info + value: info + allow_duplicates: false + + # --- Timestamps --- + - date: + field: json.modified + tag: parse_timestamp_modified + target_field: '@timestamp' + formats: + - ISO8601 + if: ctx.json?.modified != null + on_failure: + - remove: + field: json.modified + ignore_missing: true + tag: remove_invalid_modified + - append: + field: error.message + tag: append_error_modified + value: >- + Processor {{{_ingest.on_failure_processor_type}}} + with tag '{{{_ingest.on_failure_processor_tag}}}' + failed: {{{_ingest.on_failure_message}}} + - date: + field: json.created + tag: parse_event_created + target_field: event.created + formats: + - ISO8601 + if: ctx.json?.created != null + on_failure: + - remove: + field: json.created + ignore_missing: true + tag: remove_invalid_created + - append: + field: error.message + tag: append_error_created + value: >- + Processor {{{_ingest.on_failure_processor_type}}} + with tag '{{{_ingest.on_failure_processor_tag}}}' + failed: {{{_ingest.on_failure_message}}} + + # --- Core service ECS fields --- + - rename: + field: json.id + target_field: service.id + tag: rename_service_id + ignore_missing: true + - rename: + field: json.name + target_field: service.name + tag: rename_service_name + if: ctx.json?.name != null + ignore_missing: true + - rename: + field: json.subtype + target_field: service.type + tag: rename_service_type + ignore_missing: true + + # --- Entity fields --- + - set: + field: service.entity.id + tag: set_entity_id + copy_from: service.id + if: ctx.service?.id != null + - set: + field: service.entity.name + tag: set_entity_name + copy_from: service.name + if: ctx.service?.name != null + - append: + field: service.entity.type + tag: append_entity_type + value: service + allow_duplicates: false + + # --- related.user --- + - append: + field: related.user + tag: append_related_user_primary_owner + value: '{{{json.owners.primaryIdentity.name}}}' + allow_duplicates: false + if: ctx.json?.owners?.primaryIdentity?.name != null + - foreach: + field: json.owners.secondaryIdentities + tag: foreach_secondary_owner_related_user + if: ctx.json?.owners?.secondaryIdentities instanceof List + ignore_missing: true + processor: + append: + field: related.user + tag: append_related_user_secondary_owner + value: '{{{_ingest._value.name}}}' + allow_duplicates: false + + # --- Custom namespace fields: sailpoint_identity_sc.machine_identity.* --- + - rename: + field: json.nativeIdentity + target_field: sailpoint_identity_sc.machine_identity.native_identity + tag: rename_native_identity + ignore_missing: true + - rename: + field: json.description + target_field: sailpoint_identity_sc.machine_identity.description + tag: rename_description + ignore_missing: true + - rename: + field: json.attributes + target_field: sailpoint_identity_sc.machine_identity.attributes + tag: rename_attributes + ignore_missing: true + - rename: + field: json.source.id + target_field: sailpoint_identity_sc.machine_identity.source.id + tag: rename_source_id + ignore_missing: true + - rename: + field: json.source.name + target_field: sailpoint_identity_sc.machine_identity.source.name + tag: rename_source_name + ignore_missing: true + - rename: + field: json.sourceId + target_field: sailpoint_identity_sc.machine_identity.source_id + tag: rename_source_id_plain + ignore_missing: true + - rename: + field: json.uuid + target_field: sailpoint_identity_sc.machine_identity.uuid + tag: rename_uuid + ignore_missing: true + - rename: + field: json.datasetId + target_field: sailpoint_identity_sc.machine_identity.dataset_id + tag: rename_dataset_id + ignore_missing: true + - rename: + field: json.manuallyEdited + target_field: sailpoint_identity_sc.machine_identity.manually_edited + tag: rename_manually_edited + ignore_missing: true + - rename: + field: json.manuallyCreated + target_field: sailpoint_identity_sc.machine_identity.manually_created + tag: rename_manually_created + ignore_missing: true + - set: + field: sailpoint_identity_sc.machine_identity.created + tag: set_custom_created + copy_from: event.created + if: ctx.event?.created != null + - set: + field: sailpoint_identity_sc.machine_identity.modified + tag: set_custom_modified + copy_from: '@timestamp' + if: ctx['@timestamp'] != null + - rename: + field: json.owners.primaryIdentity.id + target_field: sailpoint_identity_sc.machine_identity.owners.primary.id + tag: rename_primary_owner_id + ignore_missing: true + - rename: + field: json.owners.primaryIdentity.name + target_field: sailpoint_identity_sc.machine_identity.owners.primary.name + tag: rename_primary_owner_name + ignore_missing: true + - rename: + field: json.owners.secondaryIdentities + target_field: sailpoint_identity_sc.machine_identity.owners.secondary + tag: rename_secondary_owners + ignore_missing: true + - rename: + field: json.userEntitlements + target_field: sailpoint_identity_sc.machine_identity.user_entitlements + tag: rename_user_entitlements + ignore_missing: true + + # --- Cleanup --- + - remove: + field: json + tag: remove_json + ignore_missing: true + - append: + field: tags + tag: append_preserve_original_event_on_error + value: preserve_original_event + allow_duplicates: false + if: ctx.error?.message != null + +on_failure: + - append: + field: error.message + tag: append_pipeline_error_message + value: >- + Processor '{{{ _ingest.on_failure_processor_type }}}' + {{{#_ingest.on_failure_processor_tag}}}with tag '{{{ _ingest.on_failure_processor_tag }}}' + {{{/_ingest.on_failure_processor_tag}}}failed with message '{{{ _ingest.on_failure_message }}}' + - set: + field: event.kind + tag: set_pipeline_error_to_event_kind + value: pipeline_error + - append: + field: tags + tag: append_preserve_original_event_on_failure + value: preserve_original_event + allow_duplicates: false diff --git a/packages/sailpoint_identity_sc/data_stream/machine_identities/fields/base-fields.yml b/packages/sailpoint_identity_sc/data_stream/machine_identities/fields/base-fields.yml new file mode 100644 index 00000000000..e659b1ba409 --- /dev/null +++ b/packages/sailpoint_identity_sc/data_stream/machine_identities/fields/base-fields.yml @@ -0,0 +1,19 @@ +- name: data_stream.type + external: ecs +- name: data_stream.dataset + external: ecs +- name: data_stream.namespace + external: ecs +- name: event.module + external: ecs + type: constant_keyword + value: sailpoint_identity_sc +- name: event.dataset + external: ecs + type: constant_keyword + value: sailpoint_identity_sc.machine_identities +- name: '@timestamp' + external: ecs +- name: input.type + type: keyword + description: Input type. diff --git a/packages/sailpoint_identity_sc/data_stream/machine_identities/fields/ecs.yml b/packages/sailpoint_identity_sc/data_stream/machine_identities/fields/ecs.yml new file mode 100644 index 00000000000..55de37bbfe1 --- /dev/null +++ b/packages/sailpoint_identity_sc/data_stream/machine_identities/fields/ecs.yml @@ -0,0 +1,28 @@ +- name: ecs.version + external: ecs +- name: event.kind + external: ecs +- name: event.category + external: ecs +- name: event.type + external: ecs +- name: event.created + external: ecs +- name: event.original + external: ecs +- name: service.id + external: ecs +- name: service.name + external: ecs +- name: service.type + external: ecs +- name: service.entity.id + external: ecs +- name: service.entity.name + external: ecs +- name: service.entity.type + external: ecs +- name: related.user + external: ecs +- name: tags + external: ecs diff --git a/packages/sailpoint_identity_sc/data_stream/machine_identities/fields/fields.yml b/packages/sailpoint_identity_sc/data_stream/machine_identities/fields/fields.yml new file mode 100644 index 00000000000..eecd7425d77 --- /dev/null +++ b/packages/sailpoint_identity_sc/data_stream/machine_identities/fields/fields.yml @@ -0,0 +1,90 @@ +- name: sailpoint_identity_sc.machine_identity + type: group + fields: + - name: native_identity + type: keyword + description: Account name assigned to the machine identity on the source system. + - name: description + type: text + description: Free-text description of the machine identity. + - name: attributes + type: flattened + description: Dynamic attribute map from the machine identity record (tenant-specific keys). + - name: source + type: group + fields: + - name: id + type: keyword + description: ID of the source system associated with this machine identity. + - name: name + type: keyword + description: Name of the source system associated with this machine identity. + - name: source_id + type: keyword + description: Plain source ID string from the machine identity record. + - name: uuid + type: keyword + description: UUID of the machine identity on the source system. + - name: dataset_id + type: keyword + description: Dataset ID associated with this machine identity record. + - name: manually_edited + type: boolean + description: Indicates whether the machine identity was manually edited. + - name: manually_created + type: boolean + description: Indicates whether the machine identity was manually created. + - name: created + type: date + description: Timestamp when the machine identity was created. + - name: modified + type: date + description: Timestamp when the machine identity was last modified. + - name: owners + type: group + fields: + - name: primary + type: group + fields: + - name: id + type: keyword + description: ID of the primary owner identity. + - name: name + type: keyword + description: Account name of the primary owner identity. + - name: secondary + type: group + fields: + - name: type + type: keyword + description: Type of the secondary owner reference. + - name: id + type: keyword + description: ID of the secondary owner identity. + - name: name + type: keyword + description: Account name of the secondary owner identity. + - name: user_entitlements + type: group + fields: + - name: sourceId + type: keyword + description: ID of the source system providing this entitlement. + - name: entitlementId + type: keyword + description: ID of the entitlement held by this machine identity. + - name: displayName + type: keyword + description: Display name of the entitlement. + - name: source + type: group + fields: + - name: type + type: keyword + description: Type of the entitlement source. + - name: id + type: keyword + description: ID of the entitlement source. + - name: name + type: keyword + description: Name of the entitlement source. diff --git a/packages/sailpoint_identity_sc/data_stream/machine_identities/manifest.yml b/packages/sailpoint_identity_sc/data_stream/machine_identities/manifest.yml new file mode 100644 index 00000000000..e5568462a50 --- /dev/null +++ b/packages/sailpoint_identity_sc/data_stream/machine_identities/manifest.yml @@ -0,0 +1,51 @@ +title: "Machine Identities" +type: logs +streams: + - input: cel + title: SailPoint Identity Security Cloud Machine Identities + description: "Collect machine identity records from SailPoint Identity Security Cloud for entity analytics." + enabled: true + template_path: cel.yml.hbs + vars: + - name: interval + type: text + title: Interval + description: "How often the API is polled for machine identity records." + show_user: true + required: true + default: "24h" + - name: batch_size + type: integer + title: Batch Size + description: "Number of machine identity records to fetch per request (max 250)." + show_user: false + required: true + default: 250 + - name: tags + type: text + title: Tags + description: "Tags to be applied to events." + multi: true + show_user: false + default: + - forwarded + - sailpoint_identity_sc.machine_identities + - name: preserve_original_event + type: bool + title: Preserve Original Event + description: "When enabled, keeps a raw copy of the original event in the event.original field." + required: true + show_user: false + multi: false + default: false + - name: processors + type: yaml + title: Processors + description: "Processors can alter the events by reducing the number of fields or adding additional metadata. This is performed in the agent before the logs are parsed." + multi: false + required: false + show_user: false +elasticsearch: + index_template: + mappings: + subobjects: false diff --git a/packages/sailpoint_identity_sc/data_stream/machine_identities/sample_event.json b/packages/sailpoint_identity_sc/data_stream/machine_identities/sample_event.json new file mode 100644 index 00000000000..cc4288c8d80 --- /dev/null +++ b/packages/sailpoint_identity_sc/data_stream/machine_identities/sample_event.json @@ -0,0 +1,90 @@ +{ + "@timestamp": "2025-01-10T08:45:00.000Z", + "agent": { + "ephemeral_id": "91246a6a-985b-4132-a247-04499d1761e4", + "id": "0c85dfcd-a83d-47a1-9426-84c2c4b0a534", + "name": "elastic-agent-56306", + "type": "filebeat", + "version": "9.4.1" + }, + "data_stream": { + "dataset": "sailpoint_identity_sc.machine_identities", + "namespace": "18203", + "type": "logs" + }, + "ecs": { + "version": "9.4.0" + }, + "elastic_agent": { + "id": "0c85dfcd-a83d-47a1-9426-84c2c4b0a534", + "snapshot": false, + "version": "9.4.1" + }, + "event": { + "agent_id_status": "verified", + "category": [ + "iam" + ], + "created": "2024-01-15T10:30:00.000Z", + "dataset": "sailpoint_identity_sc.machine_identities", + "ingested": "2026-07-17T17:57:50Z", + "kind": "asset", + "module": "sailpoint_identity_sc", + "original": "{\"attributes\":{\"env\":\"production\",\"team\":\"Platform\"},\"created\":\"2024-01-15T10:30:00Z\",\"datasetId\":\"ds-id-aabbccdd-1111-2222-3333-000000000001\",\"description\":\"Example service account for integration tests.\",\"id\":\"mi-id-aabbccdd-1111-2222-3333-000000000001\",\"manuallyCreated\":false,\"manuallyEdited\":false,\"modified\":\"2025-01-10T08:45:00Z\",\"name\":\"svc-example-service\",\"nativeIdentity\":\"svc-example:prod:00001\",\"owners\":{\"primaryIdentity\":{\"id\":\"00000000000000000000000000000001\",\"name\":\"alice.example\",\"type\":\"IDENTITY\"},\"secondaryIdentities\":[]},\"source\":{\"id\":\"src-id-aabbccdd-1111-2222-3333-000000000001\",\"name\":\"Example Directory\",\"type\":\"SOURCE\"},\"sourceId\":\"src-id-aabbccdd-1111-2222-3333-000000000001\",\"subtype\":\"Application\",\"userEntitlements\":[],\"uuid\":\"uuid-aabbccdd-1111-2222-3333-000000000001\"}", + "type": [ + "info" + ] + }, + "input": { + "type": "cel" + }, + "related": { + "user": [ + "alice.example" + ] + }, + "sailpoint_identity_sc": { + "machine_identity": { + "attributes": { + "env": "production", + "team": "Platform" + }, + "created": "2024-01-15T10:30:00.000Z", + "dataset_id": "ds-id-aabbccdd-1111-2222-3333-000000000001", + "description": "Example service account for integration tests.", + "manually_created": false, + "manually_edited": false, + "modified": "2025-01-10T08:45:00.000Z", + "native_identity": "svc-example:prod:00001", + "owners": { + "primary": { + "id": "00000000000000000000000000000001", + "name": "alice.example" + } + }, + "source": { + "id": "src-id-aabbccdd-1111-2222-3333-000000000001", + "name": "Example Directory" + }, + "source_id": "src-id-aabbccdd-1111-2222-3333-000000000001", + "uuid": "uuid-aabbccdd-1111-2222-3333-000000000001" + } + }, + "service": { + "entity": { + "id": "mi-id-aabbccdd-1111-2222-3333-000000000001", + "name": "svc-example-service", + "type": [ + "service" + ] + }, + "id": "mi-id-aabbccdd-1111-2222-3333-000000000001", + "name": "svc-example-service", + "type": "Application" + }, + "tags": [ + "preserve_original_event", + "forwarded", + "sailpoint_identity_sc.machine_identities" + ] +} diff --git a/packages/sailpoint_identity_sc/docs/README.md b/packages/sailpoint_identity_sc/docs/README.md index 15a5f60ad49..340affd303e 100644 --- a/packages/sailpoint_identity_sc/docs/README.md +++ b/packages/sailpoint_identity_sc/docs/README.md @@ -9,24 +9,30 @@ Agentless deployments are only supported in Elastic Serverless and Elastic Cloud ## Data Streams -- **`events`**: Provides audit data that includes actions such as `USER_MANAGEMENT`, `PASSWORD_ACTIVITY`, `PROVISIONING`, `ACCESS_ITEM`, `SOURCE_MANAGEMENT`, `CERTIFICATION`, `AUTH`, `SYSTEM_CONFIG`, `ACCESS_REQUEST`, `SSO`, `WORKFLOW`, `SEGMENT` and more. -- [Audit Events](https://community.sailpoint.com/t5/IdentityNow-Wiki/Audit-Events-in-Cloud-Audit/ta-p/218727) are records that a user took action in an [IdentityNow](https://www.sailpoint.com/products/identitynow) tenant, or other service like [IdentityAI](https://www.sailpoint.com/products/ai-driven-identity-security). Audit Events are structurally and conceptually very similar to [IdentityIQ's](https://www.sailpoint.com/products/identity-security-software/identity-iq)Audit Events, but have evolved in several ways. -- This data stream leverages the Sailpoint identity security cloud API's [/v2025/search](https://developer.sailpoint.com/docs/api/v2025/search-post) endpoint to retrieve event logs. +- **`events`**: Provides audit data that includes actions such as `USER_MANAGEMENT`, `PASSWORD_ACTIVITY`, `PROVISIONING`, `ACCESS_ITEM`, `SOURCE_MANAGEMENT`, `CERTIFICATION`, `AUTH`, `SYSTEM_CONFIG`, `ACCESS_REQUEST`, `SSO`, `WORKFLOW`, `SEGMENT` and more. [Audit Events](https://community.sailpoint.com/t5/IdentityNow-Wiki/Audit-Events-in-Cloud-Audit/ta-p/218727) are records that a user took action in an [IdentityNow](https://www.sailpoint.com/products/identitynow) tenant, or other service like [IdentityAI](https://www.sailpoint.com/products/ai-driven-identity-security). This data stream leverages the [/v2026/search](https://developer.sailpoint.com/docs/api/v2026/search-post) endpoint. + +- **`machine_identities`**: Collects machine/non-human identity records (service accounts, application accounts, bots, and AI agents) governed by SailPoint ISC. Each document represents a machine identity with its owner relationships and held entitlements. Uses the experimental [Machine Identities API](https://developer.sailpoint.com/docs/api/v2026/list-machine-identities/) with a full offset-based scan each collection cycle. **Note:** This data stream depends on an experimental SailPoint API (`X-SailPoint-Experimental: true`). The API may change without notice in future SailPoint releases. HTTP 404 and 501 responses are treated as "feature not enabled" rather than errors. ## Requirements -### Generate a Personal Access Token (PAT) +### Create an OAuth2 API Client + +This integration uses OAuth2 `client_credentials` to authenticate against the SailPoint ISC API. -Log in to the application with an administrator account and generate a **Personal Access Token (PAT)**. Personal access tokens are associated with a user in **Sailpoint identity security cloud** and inherit the user's permission level (e.g., Admin, Helpdesk, etc.) to determine access. +1. Log in to the SailPoint ISC admin console. +2. Navigate to **Admin → Security Settings → API Management**. +3. Click **Create API Client**, select **Client Credentials** as grant type, and grant the following scopes: + - `sp:search:read` — required for the `events` and `identities` data streams + - `idn:mis-identity:read` and `idn:mis-identity:manage` — required for the `machine_identities` data stream (experimental API) +4. Note the generated **Client ID** and **Client Secret** for use in the integration configuration. -To create a **Personal Access Token (PAT)** using an **admin account**, follow the instructions provided in the official documentation: -[Generate a Personal Access Token](https://developer.sailpoint.com/docs/api/v2024/authentication#generate-a-personal-access-token). +For further details see the official [Authentication documentation](https://developer.sailpoint.com/docs/api/authentication). ## Logs ### Events -Event documents can be found by setting the following filter: +Event documents can be found by setting the following filter: `event.dataset : "sailpoint_identity_sc.events"` An example event for `events` looks as following: @@ -216,3 +222,161 @@ The following non-ECS fields are used in events documents: | sailpoint_identity_sc.events.type | Type of event. Refer to the Event Types list for more details. Example: "IDENTITY_PROCESSING". | keyword | +### Machine Identities + +Machine identity documents can be found by setting the following filter: +`event.dataset : "sailpoint_identity_sc.machine_identities"` + +Machine identity documents carry ECS entity fields (`service.entity.*`) that enable entity analytics for non-human identities such as service accounts, application accounts, bots, and AI agents. + +An example event for `machine_identities` looks as following: + +```json +{ + "@timestamp": "2025-01-10T08:45:00.000Z", + "agent": { + "ephemeral_id": "91246a6a-985b-4132-a247-04499d1761e4", + "id": "0c85dfcd-a83d-47a1-9426-84c2c4b0a534", + "name": "elastic-agent-56306", + "type": "filebeat", + "version": "9.4.1" + }, + "data_stream": { + "dataset": "sailpoint_identity_sc.machine_identities", + "namespace": "18203", + "type": "logs" + }, + "ecs": { + "version": "9.4.0" + }, + "elastic_agent": { + "id": "0c85dfcd-a83d-47a1-9426-84c2c4b0a534", + "snapshot": false, + "version": "9.4.1" + }, + "event": { + "agent_id_status": "verified", + "category": [ + "iam" + ], + "created": "2024-01-15T10:30:00.000Z", + "dataset": "sailpoint_identity_sc.machine_identities", + "ingested": "2026-07-17T17:57:50Z", + "kind": "asset", + "module": "sailpoint_identity_sc", + "original": "{\"attributes\":{\"env\":\"production\",\"team\":\"Platform\"},\"created\":\"2024-01-15T10:30:00Z\",\"datasetId\":\"ds-id-aabbccdd-1111-2222-3333-000000000001\",\"description\":\"Example service account for integration tests.\",\"id\":\"mi-id-aabbccdd-1111-2222-3333-000000000001\",\"manuallyCreated\":false,\"manuallyEdited\":false,\"modified\":\"2025-01-10T08:45:00Z\",\"name\":\"svc-example-service\",\"nativeIdentity\":\"svc-example:prod:00001\",\"owners\":{\"primaryIdentity\":{\"id\":\"00000000000000000000000000000001\",\"name\":\"alice.example\",\"type\":\"IDENTITY\"},\"secondaryIdentities\":[]},\"source\":{\"id\":\"src-id-aabbccdd-1111-2222-3333-000000000001\",\"name\":\"Example Directory\",\"type\":\"SOURCE\"},\"sourceId\":\"src-id-aabbccdd-1111-2222-3333-000000000001\",\"subtype\":\"Application\",\"userEntitlements\":[],\"uuid\":\"uuid-aabbccdd-1111-2222-3333-000000000001\"}", + "type": [ + "info" + ] + }, + "input": { + "type": "cel" + }, + "related": { + "user": [ + "alice.example" + ] + }, + "sailpoint_identity_sc": { + "machine_identity": { + "attributes": { + "env": "production", + "team": "Platform" + }, + "created": "2024-01-15T10:30:00.000Z", + "dataset_id": "ds-id-aabbccdd-1111-2222-3333-000000000001", + "description": "Example service account for integration tests.", + "manually_created": false, + "manually_edited": false, + "modified": "2025-01-10T08:45:00.000Z", + "native_identity": "svc-example:prod:00001", + "owners": { + "primary": { + "id": "00000000000000000000000000000001", + "name": "alice.example" + } + }, + "source": { + "id": "src-id-aabbccdd-1111-2222-3333-000000000001", + "name": "Example Directory" + }, + "source_id": "src-id-aabbccdd-1111-2222-3333-000000000001", + "uuid": "uuid-aabbccdd-1111-2222-3333-000000000001" + } + }, + "service": { + "entity": { + "id": "mi-id-aabbccdd-1111-2222-3333-000000000001", + "name": "svc-example-service", + "type": [ + "service" + ] + }, + "id": "mi-id-aabbccdd-1111-2222-3333-000000000001", + "name": "svc-example-service", + "type": "Application" + }, + "tags": [ + "preserve_original_event", + "forwarded", + "sailpoint_identity_sc.machine_identities" + ] +} +``` + +**ECS Field Reference** + +Please refer to the following [document](https://www.elastic.co/guide/en/ecs/current/ecs-field-reference.html) for detailed information on ECS fields. + +The following non-ECS fields are used in machine_identities documents: + +**Exported fields** + +| Field | Description | Type | +|---|---|---| +| @timestamp | Date/time when the event originated. This is the date/time extracted from the event, typically representing when the event was generated by the source. If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline. Required field for all events. | date | +| data_stream.dataset | The field can contain anything that makes sense to signify the source of the data. Examples include `nginx.access`, `prometheus`, `endpoint` etc. For data streams that otherwise fit, but that do not have dataset set we use the value "generic" for the dataset value. `event.dataset` should have the same value as `data_stream.dataset`. Beyond the Elasticsearch data stream naming criteria noted above, the `dataset` value has additional restrictions: \* Must not contain `-` \* No longer than 100 characters | constant_keyword | +| data_stream.namespace | A user defined namespace. Namespaces are useful to allow grouping of data. Many users already organize their indices this way, and the data stream naming scheme now provides this best practice as a default. Many users will populate this field with `default`. If no value is used, it falls back to `default`. Beyond the Elasticsearch index naming criteria noted above, `namespace` value has the additional restrictions: \* Must not contain `-` \* No longer than 100 characters | constant_keyword | +| data_stream.type | An overarching type for the data stream. Currently allowed values are "logs" and "metrics". We expect to also add "traces" and "synthetics" in the near future. | constant_keyword | +| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | +| event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword | +| event.created | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline. This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event. In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source. In case the two timestamps are identical, `@timestamp` should be used. | date | +| event.dataset | Name of the dataset. If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from. It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | constant_keyword | +| event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | keyword | +| event.module | Name of the module this data is coming from. If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | constant_keyword | +| event.original | Raw text message of entire event. Used to demonstrate log integrity or where the full log message (before splitting it up in multiple parts) may be required, e.g. for reindex. This field is not indexed and doc_values are disabled. It cannot be searched, but it can be retrieved from `_source`. If users wish to override this and index this field, please see `Field data types` in the `Elasticsearch Reference`. | keyword | +| event.type | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy. `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization. This field is an array. This will allow proper categorization of some events that fall in multiple event types. | keyword | +| input.type | Input type. | keyword | +| related.user | All the user names or other user identifiers seen on the event. | keyword | +| sailpoint_identity_sc.machine_identity.attributes | Dynamic attribute map from the machine identity record (tenant-specific keys). | flattened | +| sailpoint_identity_sc.machine_identity.created | Timestamp when the machine identity was created. | date | +| sailpoint_identity_sc.machine_identity.dataset_id | Dataset ID associated with this machine identity record. | keyword | +| sailpoint_identity_sc.machine_identity.description | Free-text description of the machine identity. | text | +| sailpoint_identity_sc.machine_identity.manually_created | Indicates whether the machine identity was manually created. | boolean | +| sailpoint_identity_sc.machine_identity.manually_edited | Indicates whether the machine identity was manually edited. | boolean | +| sailpoint_identity_sc.machine_identity.modified | Timestamp when the machine identity was last modified. | date | +| sailpoint_identity_sc.machine_identity.native_identity | Account name assigned to the machine identity on the source system. | keyword | +| sailpoint_identity_sc.machine_identity.owners.primary.id | ID of the primary owner identity. | keyword | +| sailpoint_identity_sc.machine_identity.owners.primary.name | Account name of the primary owner identity. | keyword | +| sailpoint_identity_sc.machine_identity.owners.secondary.id | ID of the secondary owner identity. | keyword | +| sailpoint_identity_sc.machine_identity.owners.secondary.name | Account name of the secondary owner identity. | keyword | +| sailpoint_identity_sc.machine_identity.owners.secondary.type | Type of the secondary owner reference. | keyword | +| sailpoint_identity_sc.machine_identity.source.id | ID of the source system associated with this machine identity. | keyword | +| sailpoint_identity_sc.machine_identity.source.name | Name of the source system associated with this machine identity. | keyword | +| sailpoint_identity_sc.machine_identity.source_id | Plain source ID string from the machine identity record. | keyword | +| sailpoint_identity_sc.machine_identity.user_entitlements.displayName | Display name of the entitlement. | keyword | +| sailpoint_identity_sc.machine_identity.user_entitlements.entitlementId | ID of the entitlement held by this machine identity. | keyword | +| sailpoint_identity_sc.machine_identity.user_entitlements.source.id | ID of the entitlement source. | keyword | +| sailpoint_identity_sc.machine_identity.user_entitlements.source.name | Name of the entitlement source. | keyword | +| sailpoint_identity_sc.machine_identity.user_entitlements.source.type | Type of the entitlement source. | keyword | +| sailpoint_identity_sc.machine_identity.user_entitlements.sourceId | ID of the source system providing this entitlement. | keyword | +| sailpoint_identity_sc.machine_identity.uuid | UUID of the machine identity on the source system. | keyword | +| service.entity.id | A unique identifier for the entity. When multiple identifiers exist, this should be the most stable and commonly used identifier that: 1) persists across the entity's lifecycle, 2) ensures uniqueness within its scope, 3) is commonly used for queries and correlation, and 4) is readily available in most observations (logs/events). For entities with dedicated field sets (for example, host, user), this value should match the corresponding \*.id field. Alternative identifiers (for example, ARNs values in AWS, URLs) can be preserved in the raw field. | keyword | +| service.entity.name | The name of the entity. The keyword field enables exact matches for filtering and aggregations, while the text field enables full-text search. For entities with dedicated field sets (for example, `host`), this field should mirrors the corresponding \*.name value. | keyword | +| service.entity.name.text | Multi-field of `service.entity.name`. | match_only_text | +| service.entity.type | A standardized high-level classification of the entity. This provides a normalized way to group similar entities across different providers or systems. Example values: `bucket`, `database`, `container`, `function`, `queue`, `host`, `user`, `application`, `session`, `cloud`, `orchestrator`, etc. If an entity is nested under a top-level namespace like `host` or `cloud`, or similar, its type array should include the matching value — for example, `host` or `cloud`. | keyword | +| service.id | Unique identifier of the running service. If the service is comprised of many nodes, the `service.id` should be the same for all nodes. This id should uniquely identify the service. This makes it possible to correlate logs and metrics for one specific service, no matter which particular node emitted the event. Note that if you need to see the events from one specific host of the service, you should filter on that `host.name` or `host.id` instead. | keyword | +| service.name | Name of the service data is collected from. The name of the service is normally user given. This allows for distributed services that run on multiple hosts to correlate the related instances based on the name. In the case of Elasticsearch the `service.name` could contain the cluster name. For Beats the `service.name` is by default a copy of the `service.type` field if no name is specified. | keyword | +| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | +| tags | List of keywords used to tag each event. | keyword | + diff --git a/packages/sailpoint_identity_sc/img/machine-identity-dashboard.png b/packages/sailpoint_identity_sc/img/machine-identity-dashboard.png new file mode 100644 index 00000000000..60684442e3d Binary files /dev/null and b/packages/sailpoint_identity_sc/img/machine-identity-dashboard.png differ diff --git a/packages/sailpoint_identity_sc/kibana/dashboard/sailpoint_identity_sc-b5781bd4-d183-4f6d-ba00-50912b902de8.json b/packages/sailpoint_identity_sc/kibana/dashboard/sailpoint_identity_sc-b5781bd4-d183-4f6d-ba00-50912b902de8.json new file mode 100644 index 00000000000..bb00067610f --- /dev/null +++ b/packages/sailpoint_identity_sc/kibana/dashboard/sailpoint_identity_sc-b5781bd4-d183-4f6d-ba00-50912b902de8.json @@ -0,0 +1,1722 @@ +{ + "attributes": { + "controlGroupInput": { + "chainingSystem": "HIERARCHICAL", + "controlStyle": "oneLine", + "ignoreParentSettingsJSON": { + "ignoreFilters": false, + "ignoreQuery": false, + "ignoreTimerange": false, + "ignoreValidations": false + }, + "panelsJSON": { + "2c1509be-e024-4986-8b68-a58bb82fd1f8": { + "explicitInput": { + "enhancements": {}, + "fieldName": "service.type", + "grow": true, + "id": "2c1509be-e024-4986-8b68-a58bb82fd1f8", + "searchTechnique": "prefix", + "selectedOptions": [], + "title": "Type", + "width": "medium" + }, + "grow": true, + "order": 0, + "type": "optionsListControl", + "width": "medium" + }, + "04086f29-1f2b-4498-b36f-d1b2e623a50a": { + "explicitInput": { + "enhancements": {}, + "fieldName": "sailpoint_identity_sc.machine_identity.source.name", + "grow": true, + "id": "04086f29-1f2b-4498-b36f-d1b2e623a50a", + "searchTechnique": "prefix", + "selectedOptions": [], + "title": "Source", + "width": "medium" + }, + "grow": true, + "order": 1, + "type": "optionsListControl", + "width": "medium" + }, + "156c156e-5084-4598-8715-dd4259a3d0e0": { + "explicitInput": { + "enhancements": {}, + "fieldName": "sailpoint_identity_sc.machine_identity.manually_created", + "grow": true, + "id": "156c156e-5084-4598-8715-dd4259a3d0e0", + "searchTechnique": "prefix", + "selectedOptions": [], + "title": "Manually created", + "width": "medium" + }, + "grow": true, + "order": 2, + "type": "optionsListControl", + "width": "medium" + }, + "c9d08948-b43a-402a-b7c9-e66b4a6e0464": { + "explicitInput": { + "enhancements": {}, + "fieldName": "sailpoint_identity_sc.machine_identity.manually_edited", + "grow": true, + "id": "c9d08948-b43a-402a-b7c9-e66b4a6e0464", + "searchTechnique": "prefix", + "selectedOptions": [], + "title": "Manually edited", + "width": "medium" + }, + "grow": true, + "order": 3, + "type": "optionsListControl", + "width": "medium" + } + }, + "showApplySelections": false + }, + "description": "", + "kibanaSavedObjectMeta": { + "searchSourceJSON": { + "filter": [], + "query": { + "language": "kuery", + "query": "" + } + } + }, + "optionsJSON": { + "hidePanelTitles": false, + "syncColors": false, + "syncCursor": true, + "syncTooltips": false, + "useMargins": true + }, + "panelsJSON": [ + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-1a5c4b85-8bf5-4e67-9802-296ca0396167", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "logs-*", + "layers": { + "1a5c4b85-8bf5-4e67-9802-296ca0396167": { + "columnOrder": [ + "03d6af49-a6cf-41b0-9118-99aa1571d6b2" + ], + "columns": { + "03d6af49-a6cf-41b0-9118-99aa1571d6b2": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Total machine identities", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "service.id" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "indexPatternId": "logs-*", + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "event.dataset", + "index": "88ed166c-93b0-4134-b917-93855a7405d7", + "key": "event.dataset", + "negate": false, + "params": { + "query": "sailpoint_identity_sc.machine_identities" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.dataset": "sailpoint_identity_sc.machine_identities" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "color": "#FFFFFf", + "layerId": "1a5c4b85-8bf5-4e67-9802-296ca0396167", + "layerType": "data", + "metricAccessor": "03d6af49-a6cf-41b0-9118-99aa1571d6b2", + "showBar": false + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": true + }, + "gridData": { + "h": 4, + "i": "57fc908c-dfdd-4b97-863e-07ec2a9b813f", + "w": 12, + "x": 0, + "y": 0 + }, + "panelIndex": "57fc908c-dfdd-4b97-863e-07ec2a9b813f", + "title": "Total machine identities", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-fb8de01f-d938-453c-8222-c33a71be52d8", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "logs-*", + "layers": { + "fb8de01f-d938-453c-8222-c33a71be52d8": { + "columnOrder": [ + "7363261a-0deb-4146-bb8c-f7856749fe1b" + ], + "columns": { + "7363261a-0deb-4146-bb8c-f7856749fe1b": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Manually created", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "service.id", + "filter": { + "language": "kuery", + "query": "sailpoint_identity_sc.machine_identity.manually_created: true" + } + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "indexPatternId": "logs-*", + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "event.dataset", + "index": "4851008d-464c-4f39-9261-f84c82c15f28", + "key": "event.dataset", + "negate": false, + "params": { + "query": "sailpoint_identity_sc.machine_identities" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.dataset": "sailpoint_identity_sc.machine_identities" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "color": "#FFFFFf", + "layerId": "fb8de01f-d938-453c-8222-c33a71be52d8", + "layerType": "data", + "metricAccessor": "7363261a-0deb-4146-bb8c-f7856749fe1b", + "showBar": false + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": true + }, + "gridData": { + "h": 4, + "i": "548c8dcb-a1a1-431b-a35a-820d5e0e14f1", + "w": 12, + "x": 12, + "y": 0 + }, + "panelIndex": "548c8dcb-a1a1-431b-a35a-820d5e0e14f1", + "title": "Manually created", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-7d490df1-4e7c-4686-ac84-0ecf958f0ac2", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "logs-*", + "layers": { + "7d490df1-4e7c-4686-ac84-0ecf958f0ac2": { + "columnOrder": [ + "68b185b3-f91d-4883-9646-bff40c669326" + ], + "columns": { + "68b185b3-f91d-4883-9646-bff40c669326": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Manually edited", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "service.id", + "filter": { + "language": "kuery", + "query": "sailpoint_identity_sc.machine_identity.manually_edited: true" + } + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "indexPatternId": "logs-*", + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "event.dataset", + "index": "c439a0cb-2843-4401-9557-ce534f99eeb2", + "key": "event.dataset", + "negate": false, + "params": { + "query": "sailpoint_identity_sc.machine_identities" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.dataset": "sailpoint_identity_sc.machine_identities" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "color": "#FFFFFf", + "layerId": "7d490df1-4e7c-4686-ac84-0ecf958f0ac2", + "layerType": "data", + "metricAccessor": "68b185b3-f91d-4883-9646-bff40c669326", + "showBar": false + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": true + }, + "gridData": { + "h": 4, + "i": "1dca5cd9-8005-4fac-8e76-e26aa6b77b1f", + "w": 12, + "x": 24, + "y": 0 + }, + "panelIndex": "1dca5cd9-8005-4fac-8e76-e26aa6b77b1f", + "title": "Manually edited", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-f354e949-b403-4e21-805c-1a75fda64cf4", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "logs-*", + "layers": { + "f354e949-b403-4e21-805c-1a75fda64cf4": { + "columnOrder": [ + "ed4fbf9c-a6e1-4e06-98e3-dd1fe0e7d30b" + ], + "columns": { + "ed4fbf9c-a6e1-4e06-98e3-dd1fe0e7d30b": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Distinct sources", + "operationType": "unique_count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "sailpoint_identity_sc.machine_identity.source.name" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "indexPatternId": "logs-*", + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "event.dataset", + "index": "3c3c77af-2432-4ae5-b016-e2862b7e1998", + "key": "event.dataset", + "negate": false, + "params": { + "query": "sailpoint_identity_sc.machine_identities" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.dataset": "sailpoint_identity_sc.machine_identities" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "color": "#FFFFFf", + "layerId": "f354e949-b403-4e21-805c-1a75fda64cf4", + "layerType": "data", + "metricAccessor": "ed4fbf9c-a6e1-4e06-98e3-dd1fe0e7d30b", + "showBar": false + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsMetric" + }, + "enhancements": {}, + "hidePanelTitles": true + }, + "gridData": { + "h": 4, + "i": "0c679b2b-bad7-43e0-946f-9a3688610c53", + "w": 12, + "x": 36, + "y": 0 + }, + "panelIndex": "0c679b2b-bad7-43e0-946f-9a3688610c53", + "title": "Distinct sources", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-ea787ab4-0b39-430b-8e10-ad1c8833628a", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "logs-*", + "layers": { + "ea787ab4-0b39-430b-8e10-ad1c8833628a": { + "columnOrder": [ + "ea70f912-842f-4ff7-a7ba-a63846ad2216", + "75fe388c-2c75-4769-a9b8-c8f5bc8d8720" + ], + "columns": { + "ea70f912-842f-4ff7-a7ba-a63846ad2216": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Type", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "75fe388c-2c75-4769-a9b8-c8f5bc8d8720", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 20 + }, + "scale": "ordinal", + "sourceField": "service.type" + }, + "75fe388c-2c75-4769-a9b8-c8f5bc8d8720": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "indexPatternId": "logs-*", + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "event.dataset", + "index": "35edff2e-d11d-4479-af25-0d79b47bef07", + "key": "event.dataset", + "negate": false, + "params": { + "query": "sailpoint_identity_sc.machine_identities" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.dataset": "sailpoint_identity_sc.machine_identities" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "colorMapping": { + "assignments": [], + "colorMode": { + "type": "categorical" + }, + "paletteId": "eui_amsterdam_color_blind", + "specialAssignments": [ + { + "color": { + "type": "loop" + }, + "rule": { + "type": "other" + }, + "touched": false + } + ] + }, + "layerId": "ea787ab4-0b39-430b-8e10-ad1c8833628a", + "layerType": "data", + "legendDisplay": "default", + "metrics": [ + "75fe388c-2c75-4769-a9b8-c8f5bc8d8720" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "ea70f912-842f-4ff7-a7ba-a63846ad2216" + ] + } + ], + "shape": "pie" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {} + }, + "gridData": { + "h": 12, + "i": "9f2e747d-2359-45c0-9a9c-3c80b5a9ed34", + "w": 16, + "x": 0, + "y": 4 + }, + "panelIndex": "9f2e747d-2359-45c0-9a9c-3c80b5a9ed34", + "title": "Machine identities by type", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-b5800066-c671-49c3-8f9a-4cd9cb97afd1", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "logs-*", + "layers": { + "b5800066-c671-49c3-8f9a-4cd9cb97afd1": { + "columnOrder": [ + "7926e75b-faed-442b-b5ee-e2cece726470", + "596f48cb-d496-46ab-859a-9dab7c69315d" + ], + "columns": { + "7926e75b-faed-442b-b5ee-e2cece726470": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Source", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "596f48cb-d496-46ab-859a-9dab7c69315d", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 20 + }, + "scale": "ordinal", + "sourceField": "sailpoint_identity_sc.machine_identity.source.name" + }, + "596f48cb-d496-46ab-859a-9dab7c69315d": { + "dataType": "number", + "isBucketed": false, + "label": "Count of records", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "indexPatternId": "logs-*", + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "event.dataset", + "index": "0f40ac08-fcff-4946-8381-e978da4d5000", + "key": "event.dataset", + "negate": false, + "params": { + "query": "sailpoint_identity_sc.machine_identities" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.dataset": "sailpoint_identity_sc.machine_identities" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "categoryDisplay": "default", + "colorMapping": { + "assignments": [], + "colorMode": { + "type": "categorical" + }, + "paletteId": "eui_amsterdam_color_blind", + "specialAssignments": [ + { + "color": { + "type": "loop" + }, + "rule": { + "type": "other" + }, + "touched": false + } + ] + }, + "layerId": "b5800066-c671-49c3-8f9a-4cd9cb97afd1", + "layerType": "data", + "legendDisplay": "default", + "metrics": [ + "596f48cb-d496-46ab-859a-9dab7c69315d" + ], + "nestedLegend": false, + "numberDisplay": "percent", + "primaryGroups": [ + "7926e75b-faed-442b-b5ee-e2cece726470" + ] + } + ], + "shape": "pie" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsPie" + }, + "enhancements": {} + }, + "gridData": { + "h": 12, + "i": "70d10bb4-14f4-4be7-9996-3f32b78d2186", + "w": 16, + "x": 16, + "y": 4 + }, + "panelIndex": "70d10bb4-14f4-4be7-9996-3f32b78d2186", + "title": "Machine identities by source", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-aff7abd1-e142-4e03-bc70-527ab4b684f8", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "logs-*", + "layers": { + "aff7abd1-e142-4e03-bc70-527ab4b684f8": { + "columnOrder": [ + "f9d01425-c0fd-4bc5-9009-77186866eebc", + "e83d2b22-de02-41f0-89eb-baacb79dd2a0" + ], + "columns": { + "f9d01425-c0fd-4bc5-9009-77186866eebc": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Owner", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "e83d2b22-de02-41f0-89eb-baacb79dd2a0", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "sailpoint_identity_sc.machine_identity.owners.primary.name" + }, + "e83d2b22-de02-41f0-89eb-baacb79dd2a0": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "indexPatternId": "logs-*", + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "event.dataset", + "index": "3d5c06a4-6845-47e6-a20a-62bbe8568843", + "key": "event.dataset", + "negate": false, + "params": { + "query": "sailpoint_identity_sc.machine_identities" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.dataset": "sailpoint_identity_sc.machine_identities" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "accessors": [ + "e83d2b22-de02-41f0-89eb-baacb79dd2a0" + ], + "colorMapping": { + "assignments": [], + "colorMode": { + "type": "categorical" + }, + "paletteId": "eui_amsterdam_color_blind", + "specialAssignments": [ + { + "color": { + "type": "loop" + }, + "rule": { + "type": "other" + }, + "touched": false + } + ] + }, + "layerId": "aff7abd1-e142-4e03-bc70-527ab4b684f8", + "layerType": "data", + "position": "top", + "seriesType": "bar_horizontal", + "showGridlines": false, + "xAccessor": "f9d01425-c0fd-4bc5-9009-77186866eebc" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "bar_horizontal", + "title": "Empty XY chart", + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {} + }, + "gridData": { + "h": 12, + "i": "800c3109-45cf-4e43-99c1-e1cf7ea93bf6", + "w": 16, + "x": 32, + "y": 4 + }, + "panelIndex": "800c3109-45cf-4e43-99c1-e1cf7ea93bf6", + "title": "Top owners", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-2c01ba30-2e73-46a1-b8fa-99f2da4b8657", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "logs-*", + "layers": { + "2c01ba30-2e73-46a1-b8fa-99f2da4b8657": { + "columnOrder": [ + "64a5d8d1-a818-4c0f-ad9e-02e3b061f05d", + "0b37b39c-5348-414a-a525-97ed261aaa82" + ], + "columns": { + "64a5d8d1-a818-4c0f-ad9e-02e3b061f05d": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Entitlement", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "0b37b39c-5348-414a-a525-97ed261aaa82", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "sailpoint_identity_sc.machine_identity.user_entitlements.displayName" + }, + "0b37b39c-5348-414a-a525-97ed261aaa82": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "indexPatternId": "logs-*", + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "event.dataset", + "index": "c92f0c25-4ede-46db-adfa-7b7c45b5b61e", + "key": "event.dataset", + "negate": false, + "params": { + "query": "sailpoint_identity_sc.machine_identities" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.dataset": "sailpoint_identity_sc.machine_identities" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "accessors": [ + "0b37b39c-5348-414a-a525-97ed261aaa82" + ], + "colorMapping": { + "assignments": [], + "colorMode": { + "type": "categorical" + }, + "paletteId": "eui_amsterdam_color_blind", + "specialAssignments": [ + { + "color": { + "type": "loop" + }, + "rule": { + "type": "other" + }, + "touched": false + } + ] + }, + "layerId": "2c01ba30-2e73-46a1-b8fa-99f2da4b8657", + "layerType": "data", + "position": "top", + "seriesType": "bar_horizontal", + "showGridlines": false, + "xAccessor": "64a5d8d1-a818-4c0f-ad9e-02e3b061f05d" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "bar_horizontal", + "title": "Empty XY chart", + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {} + }, + "gridData": { + "h": 12, + "i": "e8a9ba1f-3102-43c0-a821-3c7e79d1e8b3", + "w": 24, + "x": 0, + "y": 16 + }, + "panelIndex": "e8a9ba1f-3102-43c0-a821-3c7e79d1e8b3", + "title": "Top entitlements", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-03a118cb-bef0-45c3-a2df-8b0367bfa9f0", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "logs-*", + "layers": { + "03a118cb-bef0-45c3-a2df-8b0367bfa9f0": { + "columnOrder": [ + "fd451191-d284-43c6-beaf-71c27c0a7365", + "d42b6e8b-5359-4ff4-88ce-00e275c73fb1" + ], + "columns": { + "fd451191-d284-43c6-beaf-71c27c0a7365": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "Entitlement source", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "d42b6e8b-5359-4ff4-88ce-00e275c73fb1", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 10 + }, + "scale": "ordinal", + "sourceField": "sailpoint_identity_sc.machine_identity.user_entitlements.source.name" + }, + "d42b6e8b-5359-4ff4-88ce-00e275c73fb1": { + "customLabel": true, + "dataType": "number", + "isBucketed": false, + "label": "Count", + "operationType": "count", + "params": { + "emptyAsNull": true + }, + "scale": "ratio", + "sourceField": "___records___" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "indexPatternId": "logs-*", + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "event.dataset", + "index": "97acdfa6-1cc6-422f-8ffe-a982bae46dd8", + "key": "event.dataset", + "negate": false, + "params": { + "query": "sailpoint_identity_sc.machine_identities" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.dataset": "sailpoint_identity_sc.machine_identities" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "layers": [ + { + "accessors": [ + "d42b6e8b-5359-4ff4-88ce-00e275c73fb1" + ], + "colorMapping": { + "assignments": [], + "colorMode": { + "type": "categorical" + }, + "paletteId": "eui_amsterdam_color_blind", + "specialAssignments": [ + { + "color": { + "type": "loop" + }, + "rule": { + "type": "other" + }, + "touched": false + } + ] + }, + "layerId": "03a118cb-bef0-45c3-a2df-8b0367bfa9f0", + "layerType": "data", + "position": "top", + "seriesType": "bar_horizontal", + "showGridlines": false, + "xAccessor": "fd451191-d284-43c6-beaf-71c27c0a7365" + } + ], + "legend": { + "isVisible": true, + "position": "right" + }, + "preferredSeriesType": "bar_horizontal", + "title": "Empty XY chart", + "valueLabels": "hide" + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsXY" + }, + "enhancements": {} + }, + "gridData": { + "h": 12, + "i": "464c766b-6401-4d21-9c5b-2bd7aac9dbcd", + "w": 24, + "x": 24, + "y": 16 + }, + "panelIndex": "464c766b-6401-4d21-9c5b-2bd7aac9dbcd", + "title": "Top entitlement sources", + "type": "lens" + }, + { + "embeddableConfig": { + "attributes": { + "references": [ + { + "id": "logs-*", + "name": "indexpattern-datasource-layer-1df53837-d6f0-4797-b284-2c9370cf7f56", + "type": "index-pattern" + } + ], + "state": { + "adHocDataViews": {}, + "datasourceStates": { + "formBased": { + "currentIndexPatternId": "logs-*", + "layers": { + "1df53837-d6f0-4797-b284-2c9370cf7f56": { + "columnOrder": [ + "565501bc-699d-4015-a298-26dac0c6469a", + "ab14693b-51c2-4b71-9cfd-cb7eae1b3ff5", + "c737cdfb-f4b3-4847-9643-6aa022e4371d", + "15589cab-dbba-4dac-a950-a98306a3a265", + "8402cd7b-5a19-4e16-a9d3-c612b5a6e900", + "ab9317d3-b9f0-4b71-8cd0-2cf09bf06281", + "77cd7abf-cbc0-4477-babe-7a470abedb44", + "05a49d38-31d4-4f3e-94c2-76540538ddc9", + "aa000001-0000-4000-b000-000000000001", + "aa000001-0000-4000-b000-000000000002", + "aa000001-0000-4000-b000-000000000003" + ], + "columns": { + "565501bc-699d-4015-a298-26dac0c6469a": { + "customLabel": true, + "dataType": "string", + "isBucketed": true, + "label": "ID", + "operationType": "terms", + "params": { + "exclude": [], + "excludeIsRegex": false, + "include": [], + "includeIsRegex": false, + "missingBucket": false, + "orderBy": { + "columnId": "ab14693b-51c2-4b71-9cfd-cb7eae1b3ff5", + "type": "column" + }, + "orderDirection": "desc", + "otherBucket": false, + "parentFormat": { + "id": "terms" + }, + "secondaryFields": [], + "size": 1000 + }, + "scale": "ordinal", + "sourceField": "service.id" + }, + "ab14693b-51c2-4b71-9cfd-cb7eae1b3ff5": { + "customLabel": true, + "dataType": "date", + "isBucketed": false, + "label": "Timestamp", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "@timestamp" + }, + "c737cdfb-f4b3-4847-9643-6aa022e4371d": { + "customLabel": true, + "dataType": "string", + "isBucketed": false, + "label": "Name", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ordinal", + "sourceField": "service.name" + }, + "15589cab-dbba-4dac-a950-a98306a3a265": { + "customLabel": true, + "dataType": "string", + "isBucketed": false, + "label": "Type", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ordinal", + "sourceField": "service.type" + }, + "8402cd7b-5a19-4e16-a9d3-c612b5a6e900": { + "customLabel": true, + "dataType": "string", + "isBucketed": false, + "label": "Source", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ordinal", + "sourceField": "sailpoint_identity_sc.machine_identity.source.name" + }, + "ab9317d3-b9f0-4b71-8cd0-2cf09bf06281": { + "customLabel": true, + "dataType": "string", + "isBucketed": false, + "label": "Native identity", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ordinal", + "sourceField": "sailpoint_identity_sc.machine_identity.native_identity" + }, + "77cd7abf-cbc0-4477-babe-7a470abedb44": { + "customLabel": true, + "dataType": "string", + "isBucketed": false, + "label": "Primary owner", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ordinal", + "sourceField": "sailpoint_identity_sc.machine_identity.owners.primary.name" + }, + "05a49d38-31d4-4f3e-94c2-76540538ddc9": { + "customLabel": true, + "dataType": "string", + "isBucketed": false, + "label": "Manually created", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ordinal", + "sourceField": "sailpoint_identity_sc.machine_identity.manually_created" + }, + "aa000001-0000-4000-b000-000000000001": { + "customLabel": true, + "dataType": "string", + "isBucketed": false, + "label": "Manually edited", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ordinal", + "sourceField": "sailpoint_identity_sc.machine_identity.manually_edited" + }, + "aa000001-0000-4000-b000-000000000002": { + "customLabel": true, + "dataType": "date", + "isBucketed": false, + "label": "Created", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "sailpoint_identity_sc.machine_identity.created" + }, + "aa000001-0000-4000-b000-000000000003": { + "customLabel": true, + "dataType": "date", + "isBucketed": false, + "label": "Modified", + "operationType": "last_value", + "params": { + "sortField": "@timestamp" + }, + "scale": "ratio", + "sourceField": "sailpoint_identity_sc.machine_identity.modified" + } + }, + "ignoreGlobalFilters": false, + "incompleteColumns": {}, + "indexPatternId": "logs-*", + "sampling": 1 + } + } + }, + "indexpattern": { + "layers": {} + }, + "textBased": { + "layers": {} + } + }, + "filters": [ + { + "$state": { + "store": "appState" + }, + "meta": { + "alias": null, + "disabled": false, + "field": "event.dataset", + "index": "d243c810-6aa3-4c49-93be-681b499234ed", + "key": "event.dataset", + "negate": false, + "params": { + "query": "sailpoint_identity_sc.machine_identities" + }, + "type": "phrase" + }, + "query": { + "match_phrase": { + "event.dataset": "sailpoint_identity_sc.machine_identities" + } + } + } + ], + "internalReferences": [], + "query": { + "language": "kuery", + "query": "" + }, + "visualization": { + "columns": [ + { + "columnId": "565501bc-699d-4015-a298-26dac0c6469a", + "hidden": true, + "isMetric": false, + "isTransposed": false + }, + { + "columnId": "ab14693b-51c2-4b71-9cfd-cb7eae1b3ff5", + "hidden": true, + "isMetric": true, + "isTransposed": false + }, + { + "columnId": "c737cdfb-f4b3-4847-9643-6aa022e4371d", + "isMetric": true, + "isTransposed": false + }, + { + "columnId": "15589cab-dbba-4dac-a950-a98306a3a265", + "isMetric": true, + "isTransposed": false + }, + { + "columnId": "8402cd7b-5a19-4e16-a9d3-c612b5a6e900", + "isMetric": true, + "isTransposed": false + }, + { + "columnId": "ab9317d3-b9f0-4b71-8cd0-2cf09bf06281", + "isMetric": true, + "isTransposed": false + }, + { + "columnId": "77cd7abf-cbc0-4477-babe-7a470abedb44", + "isMetric": true, + "isTransposed": false + }, + { + "columnId": "05a49d38-31d4-4f3e-94c2-76540538ddc9", + "isMetric": true, + "isTransposed": false + }, + { + "columnId": "aa000001-0000-4000-b000-000000000001", + "isMetric": true, + "isTransposed": false + }, + { + "columnId": "aa000001-0000-4000-b000-000000000002", + "isMetric": true, + "isTransposed": false + }, + { + "columnId": "aa000001-0000-4000-b000-000000000003", + "isMetric": true, + "isTransposed": false + } + ], + "headerRowHeight": "single", + "headerRowHeightLines": 1, + "layerId": "1df53837-d6f0-4797-b284-2c9370cf7f56", + "layerType": "data", + "paging": { + "enabled": true, + "size": 20 + }, + "rowHeight": "single", + "rowHeightLines": 1, + "sorting": { + "columnId": "ab14693b-51c2-4b71-9cfd-cb7eae1b3ff5", + "direction": "desc" + } + } + }, + "title": "", + "type": "lens", + "visualizationType": "lnsDatatable" + }, + "enhancements": {} + }, + "gridData": { + "h": 18, + "i": "49822789-f1cb-44ed-a32b-08f7a9c4a0c6", + "w": 48, + "x": 0, + "y": 28 + }, + "panelIndex": "49822789-f1cb-44ed-a32b-08f7a9c4a0c6", + "title": "[Machine Identities] Records", + "type": "lens" + } + ], + "timeRestore": false, + "title": "[Machine Identities Sailpoint identity security cloud] Overview", + "version": 2 + }, + "coreMigrationVersion": "8.8.0", + "id": "sailpoint_identity_sc-b5781bd4-d183-4f6d-ba00-50912b902de8", + "managed": false, + "references": [ + { + "id": "logs-*", + "name": "57fc908c-dfdd-4b97-863e-07ec2a9b813f:indexpattern-datasource-layer-1a5c4b85-8bf5-4e67-9802-296ca0396167", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "548c8dcb-a1a1-431b-a35a-820d5e0e14f1:indexpattern-datasource-layer-fb8de01f-d938-453c-8222-c33a71be52d8", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "1dca5cd9-8005-4fac-8e76-e26aa6b77b1f:indexpattern-datasource-layer-7d490df1-4e7c-4686-ac84-0ecf958f0ac2", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "0c679b2b-bad7-43e0-946f-9a3688610c53:indexpattern-datasource-layer-f354e949-b403-4e21-805c-1a75fda64cf4", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "9f2e747d-2359-45c0-9a9c-3c80b5a9ed34:indexpattern-datasource-layer-ea787ab4-0b39-430b-8e10-ad1c8833628a", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "70d10bb4-14f4-4be7-9996-3f32b78d2186:indexpattern-datasource-layer-b5800066-c671-49c3-8f9a-4cd9cb97afd1", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "800c3109-45cf-4e43-99c1-e1cf7ea93bf6:indexpattern-datasource-layer-aff7abd1-e142-4e03-bc70-527ab4b684f8", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "e8a9ba1f-3102-43c0-a821-3c7e79d1e8b3:indexpattern-datasource-layer-2c01ba30-2e73-46a1-b8fa-99f2da4b8657", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "464c766b-6401-4d21-9c5b-2bd7aac9dbcd:indexpattern-datasource-layer-03a118cb-bef0-45c3-a2df-8b0367bfa9f0", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "49822789-f1cb-44ed-a32b-08f7a9c4a0c6:indexpattern-datasource-layer-1df53837-d6f0-4797-b284-2c9370cf7f56", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_2c1509be-e024-4986-8b68-a58bb82fd1f8:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_04086f29-1f2b-4498-b36f-d1b2e623a50a:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_156c156e-5084-4598-8715-dd4259a3d0e0:optionsListDataView", + "type": "index-pattern" + }, + { + "id": "logs-*", + "name": "controlGroup_c9d08948-b43a-402a-b7c9-e66b4a6e0464:optionsListDataView", + "type": "index-pattern" + } + ], + "type": "dashboard", + "typeMigrationVersion": "10.2.0" +} \ No newline at end of file diff --git a/packages/sailpoint_identity_sc/manifest.yml b/packages/sailpoint_identity_sc/manifest.yml index 4a376e58d07..270ea6ea172 100644 --- a/packages/sailpoint_identity_sc/manifest.yml +++ b/packages/sailpoint_identity_sc/manifest.yml @@ -1,7 +1,7 @@ -format_version: 3.3.2 +format_version: 3.4.2 name: sailpoint_identity_sc title: Sailpoint Identity Security Cloud -version: "1.3.0" +version: "2.0.0-next" source: license: "Elastic-2.0" description: "Sailpoint identity security cloud provides enterprise identity governance and security capabilities. The integration allows users to extract audit information from their identity security cloud tenant using the ISC's AuditEvent API." @@ -17,7 +17,11 @@ conditions: subscription: "basic" screenshots: - src: /img/dashboard.png - title: Dashboard + title: Events Dashboard + size: 600x600 + type: image/png + - src: /img/machine-identity-dashboard.png + title: Machine Identity Dashboard size: 600x600 type: image/png icons: @@ -27,8 +31,8 @@ icons: type: image/svg+xml policy_templates: - name: sailpoint_identity_sc - title: Sailpoint identity security cloud events - description: "Collect events from Sailpoint identity security cloud event reporting." + title: Sailpoint identity security Cloud + description: "Collect audit events, and machine identities from SailPoint Identity Security Cloud via the API." deployment_modes: default: enabled: true @@ -52,12 +56,12 @@ policy_templates: type: text title: API Version description: | - Enter the API version to use, e.g., v2025. - Sailpoint Identity Security Cloud API follows a annual release cycle. - More information about it can be found [here](https://developer.sailpoint.com/docs/api/v2025/api-versioning-strategy). + Enter the API version to use, e.g., v2026. + Sailpoint Identity Security Cloud API follows an annual release cycle. + More information about it can be found [here](https://developer.sailpoint.com/docs/api/v2026/api-versioning-strategy). show_user: true required: true - default: v2025 + default: v2026 - name: client_id type: text title: Client ID for Sailpoint identity security cloud @@ -80,16 +84,16 @@ policy_templates: required: true show_user: false secret: false + default: + - "sp:search:read" + - "idn:mis-identity:read" + - "idn:mis-identity:manage" - name: enable_request_tracer type: bool title: Enable Request Tracing description: >- - The request tracer logs requests and responses to the agent's local file-system for debugging configurations. - Enabling this request tracing compromises security and should only be used for debugging. Disabling the request - tracer will delete any stored traces. - See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_enable) - for details. - default: true + The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. Disabling the request tracer will delete any stored traces. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_enable) for details. + default: false multi: false required: false show_user: false