How do we monitor sensitivity changes to entitlement

IdentityIQ (IIQ) IIQ Discussion and Questions
,
1

Which IIQ version are you inquiring about?

Version 8.2

Share all details related to your problem, including any error messages you may have received.

Hi,
We have a requirement to monitor whenever sensitivity is changed to an entilement.
For example, consider entitlement A is set as “itsensitive” initally , Later classification has been set to “bssensitive”. Whenever there is a change in classification , we have to capture those entitlement display name and send an mail to Specific workgroup.

Can someone let us know how do we capture old classification value and new classification value. Any suggestions is greatly appreciated.

2

Hi @Preethi,
Whenever there is change in entitlement update with classifications if you have any audit event created then you can write up a rule to check these audit events for the change that you are looking for and if its satisfied then you can send email to the specific workgroup. We did a similar kind of approach for the roles whenever there is a change in some of attributes at the role level.

Please hear in other community members comments as well.

3

Workflow “Entitlement Update” executed to update the entitlements when enlistments are updated from Entitlement Catalog. This workflow have the variable with name “changes” and this variable stores the ChangeSummary with the Difference which stores oldValue, newValue and attribute name (attribute) . you can update the step “Check Provisioning Errors” and see if there’s any error or update is successful based on that read the ChangeSummary and then do the Audit for the changes and notification also based on the requirement .
see the below how the changees variable looks like

<ChangeSummary>
  <Differences>
    <Difference attribute="name of attribue1" displayName="displayname of attribue1" newValue="newValue" oldValue="oldValue"/>
    <Difference attribute="name of attribue1" displayName="displayname of attribue1" newValue="newValue" oldValue="oldValue"/>
  </Differences>
</ChangeSummary>
4

Hi Vinod,

Is there any sample rule where do we refer the entitlement old value and new value?

5

Hi Hemant,

We have enabled Monitoring in entitlement update business process. But not sure where exactly we will get the changes. Also ANy sample rule to get entitlement old and new value

6

see the sample code below which can be added in Entitlement Update workflow in step Check Provisioning Errors to get the the oldValue, newValue and addedValues, removedValues(in case attribute is multi valued)

import sailpoint.object.ChangeSummary;
		import sailpoint.object.Difference;		
		if(changes !=null){
			List differences = changes.getDifferences();
			for(Difference difference : differences){  
				String attrName = difference.getAttribute();
				if(difference.isMulti()){
					String removedValues = difference.getRemovedValuesCsv();
					String addedValues = difference.getAddedValues();
				}else{
					String newValue = difference.getNewValue();
					String oldValue = difference.getOldValue();					
				}
			}
		}
7

@HemantSingh

I have updated the code in Entitlement update workflow. Which attribute we should use in custom rule to get the entitlement sensitivity change.
Any sample custom rule to fetch the differences.

Thanks!

8

You can modify entitlement update workflow and add a step to create a custom Audit .
below is the sample

        import sailpoint.object.AuditEvent;
        import sailpoint.object.Difference;
        import sailpoint.server.Auditor;
        import java.util.HashMap;
        import java.util.Map;
        import sailpoint.object.Attributes;

        AuditEvent event = new AuditEvent();
        Attributes attributesMap = new Attributes();
        event.setAction("VishalEntitlementChanges");
        event.setTarget(summaryName);
        String appName = plan.getObjectRequests().get(0).getApplication();
        event.setApplication(appName);
        for(Difference diff : changes.getDifferences()) {
          String changeAuditMsg = diff.getOldValue() + " -> " + diff.getNewValue();
          attributesMap.put(diff.getAttribute(), changeAuditMsg);
        }
        event.setAttributes(attributesMap);

        if(plan.getRequesters() != null &amp;&amp; !plan.getRequesters().isEmpty()) {
            String requester = plan.getRequesters().get(0).getDisplayableName();
            event.setString4("Requester: " + requester);
        }
        if (attributesMap.size() > 0) {
        Auditor.log(event);        
        context.commitTransaction();
        }
9

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.