SailPoint IdentityNow AuditEvent Add-on
Splunk AppInspect Passed
Admins: Please read about Splunk Enterprise 8.0 and the Python 2.7 end-of-life changes and impact on apps and upgradeshere.
Overview
Details
Provides an easy way to extract audit event data from SailPoint's IdentityNow product. Documentation is available to SailPoint community members here: https://community.sailpoint.com/docs/DOC-11294
Introduction
SailPoint's IdentityNow AuditEvent Add-on has been certified by Splunk and is designed to provide customers the ability to extract audit information from one or more of their IdentityNow tenants using Splunk Enterprise or Splunk Cloud.
Using IdentityNow's AuditEvents API, we can solve a number of problems with this add-on. Some examples include:
- Surface and gain insights into the brute force password attempts IdentityNow has blocked
- Correlate IdentityNow user activity with other system events to identify coordinated attacks
- Evaluate the timing of login attempts from different geographies to identify problems
Solution Brief
Example Search
Searching for sourcetype="sailpoint_identitynow" will list all the events consumed by the add-on
Release Notes
Version 2.0.2
Jan. 16, 2020
Version 2.0.2
Updated auth. mechanism to support personal access tokens