Audit Event for Significant XML Changes

IdentityIQ (IIQ) IIQ Discussion and Questions
1

Our external auditors are looking for significant changes or updates to XML files like Application/Rules/Workflows.

I’m currently providing the audit event update in Advanced Analytics which does a decent job as it matches up to changes. The only issue is we’re getting false positives because Sailpoint will update objects by users that aren’t admins. This creates questions and more work. Is there a way to weed this out? or create a better audit event for when we deploy artifacts?

2

The import audit action tracks updates made through the Import From File feature through the UI or the iiq console

3

You can enable Import File audit configurations under Global Settings >> Audit Configurations >> General Actions tab.
To detect any changes made to XML file, you can enable Class Action audit.

image
image1144×416 20.5 KB

image
image1176×554 45 KB

4

Hi @thasheider1 ,

We enabled the following audit configuration, and it audits the following audit events.

image
image721×848 44.5 KB

image
image1843×117 5.04 KB

I hope this should help.

Thanks,

PVR.

5

@thasheider1 Using Import Audit depends on how you are doing import during deployment. If you are using delta import, then it makes sense to enable Delta. or if you import all artefacts, then it will reset the modify date of all these artefacts and will also come in audit, causing more noise.

In case you want to use, you also need to fine tune your deployment process.