Any way to track all events in an access requests made by a workflow?

Identity Security Cloud (ISC) ISC Discussion and Questions
, , , ,
1

I have a requirement to provide a report/search on the access requests created by a workflow and their status and approvals.

I can call the appropriate APIs to get the information (at least I need to use 2 different endpoints and do some matching to determine it is from the same access request), but I’m looking for a way to do it in a single search call (UI or API).

Considering that I can trigger the access request (from the workflow) with an special comment (I added a workflow code = WFID: BRA1001),
I’m able to search for the access requests containing this code or also by the workflow service account (owner).

So I have these 2 options for searching the access requests:
Option 1 (by workflow “code” in comments)
created:[now-1d TO now] AND "WFID: BRA1001" AND type:access_request
Option 2 (by service account workflow owner)
created:[now-1d TO now] AND actor.name:serviceaccountname AND type:access_request

To accomplish my goal (report), I expect to retrieve the information (created date, target, actor, access item requested , approved by,…) on the following events by using the searches mentioned above:

  • Request Access Started
  • Create Access Approval Started
  • (missing) Request Access Approved/Rejected/Forwarded/Cancelled
    These missing events are a consequence of not having the comment (workflow “code”) and/or that the service account is not part of the approval event.
  • Request Access Processed

So, any tips ideas of a way to get all the lifecycle of an access request that was generated by a workflow? And is there a way to get the pending approver by using the search engine?

Thanks,
JM

2

Hi @jmartinez
This page might help you to create needed search queries Audit Events in Cloud Audit - Compass

1 Like
3

Hi Juan,

I ran a quick test and it would seem that the “Approved/Rejected/Forwarded/Cancelled” all have the same tracking ID as the “Request Started”. With a script or a scheduled workflow, you could grab the tracking ID of each “Started” with the workflow comment, then check for the subsequent steps with a search for that ID. You would also get the benefit of seeing the actual provisioning events too (e.g. “Add Entitlement Passed”)

1 Like
4

Thanks for the tips, so it is confirmed there is no direct/easy way to get all the lifecycle of an access request, and as suggested using the tracking id from the “Request Started” is the solution.