Aggregation Activity In identityNow

Identity Security Cloud (ISC) ISC Discussion and Questions
, ,
1

Hi team,

Do we have any search query for aggregation activity to schedule it daily once from search ?

Thanks.

1 Like
2

Welcome to the SailPoint Developer Community, @saikumar_sanaka
You can use created:[now-24h TO now] && operation:AGGREGATE in search query to view all the events related to aggregation for last 24h.
You can modify the query as required to get desired results.
Thanks,
Antony!

3

Thank you for quick reply Antony !

Can i get the report in search like we have it in Aggregation activity Quicklink ?

With attributes like Source name, Start time, End time ,Aggregation type ,Status ,Accounts scanned ,Entitlements scanned.

4

You can select desired columns from the column chooser, save and schedule the search to send reports for required recipients.

5

Those attributes are not available in column (Start time,End time,Accounts scanned ,Entitlements scanned) , Do we have any other option to automate this report with above attributes ?

6

Hi there, would getting the task status and filtering by the source id work for you?

7

We wanted to automate a report for all sources aggregation activity with above Attributes ?

Seems like above one is for particular source.

8

In that case, could you filter on type cloud_account_aggregation instead?

9

If you’re using any SIEM tool like Splunk, we can easily generate reports based on the logs received through webhook from SailPoint.

10

Hy Jade , Where exactly we have to filter cloud_account_aggregation, Can you elaborate it ?

11

Hey! It may be a private API but I checked out the browser developer tools when I was looking at the aggregation history tab. Worth a go :slight_smile:

This API came back with a response, it would need formatting to csv

https://sailpoint.api.identitynow.com/v2024/task-status?filters=type%20in%20("CLOUD_ACCOUNT_AGGREGATION"%2C%20"CLOUD_GROUP_AGGREGATION"%2C%20"CLOUD_PROCESS_UNCORRELATED_ACCOUNTS")