Correlation rule does not uncorrelate

Identity Security Cloud (ISC) ISC Discussion and Questions
1

Hi.

The following is our sample code for correlation rule where we want to uncorrelate the account during offboarding LCS.

Map returnMap = new HashMap();

  String sAMAccountName = account.getStringAttribute( "sAMAccountName" );

  sailpoint.rule.Identity foundIdentity = idn.getIdentityById("uid");
  String lcs = foundIdentity.getAttribute("cloudLifecycleState");

  if (!"offboarding".equals(lcs)) {
      returnMap.put( "identityAttributeName", "adid");
      returnMap.put( "identityAttributeValue", sAMAccountName );
  }

  return returnMap;

However, when we offboard the user, the account is not removed / detached from the identity. Appreciate any input on this, thank you!

2

Did you try running full aggregation through API call.

POST
/cc/api/source/loadAccounts/123456?disableOptimization=true

3

Hi Krishna, we have not done that, as we wanted to check is the correlation rule working for a few accounts to not affect the other existing ones.

Can I know will it not be immediately uncorrelated once the user is offboarded - reach end date / aggregation from authoritative source with instruction to offboard ?

4

Hi Krishna,

I have run the API call as suggested, however, it seems that the account is still not removed/uncorrelated from the identity.

Any input on the possibility of errors in the current rule? Thank you

5

Is, by any chance, manuallyCorrelated is set to true for this account?

6

Can you try passing the param in body.

image
image1774×579 33.4 KB

7

Hi, the reason that the correlation rule was not running even after invoking the API:

POST
/cc/api/source/loadAccounts/123456?disableOptimization=true

is because the condition set in the rule is incorrect. After updating it to a correct condition, and aggregating from the target source with disableOptimization set as true, the account is uncorrelated as expected. Thanks all for the help!

8

Following up this topic as attached:
Correlation Rule Issue - IdentityNow (IDN) / IDN Discussion and Questions - SailPoint Developer Community Forum

9

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.