How to audit manual Identities deletion

IdentityIQ (IIQ) IIQ Discussion and Questions
,
1

Which IIQ version are you inquiring about?

Version 8.3

Share all details related to your problem, including any error messages you may have received.

Hi community,

In the audit configuration I have activated values, I have carried out tests and I have validated in the spt_audit_event table of the database and/or in Advanced Analytics - Audit, how the different records are observed; However, I cannot find how to audit the identity deletion events that an administrator can perform in IIQ.

Is it possible in some way to audit such events when deleting an identity is performed on the Debug page or with a Prune Identities task?

Thanks in advance!

2

To check if identity was removed from debug you can search for the audit event using the following filter

image
image1318×585 17.7 KB

for prune - it would be a bit harded as standard pruning task is not logging any audit events while processing identity.

1 Like
3

In IIQ8,3 it is not yet possible to audit events performed in debug. This feature is introduced in 8.4 (Audit changes made through the Debug Object Browser), See 8.4 IdentityIQ Release Notes - Compass

To enable this feature an upgrade to IIQ8.4 is needed or use Debug Audit Plugin (which also allows objects to be restored after being changed or deleted :smiley: ).

Objects deleted using the Prune Identties task should be audited using the general Actions audit events (Gear-> Audit Configuration → General Actions → Delete)

– Remold

1 Like
4

Hi Remold,
Good point - missed we are talking about 8.3 - regarding delete operation by prune - I tested it - no entry in auditlog.

1 Like
5

You are right @kjakubiak . There is no audit event when identity-cubes are deleted via the ‘Prune Identities Cube’-task. I valiaded the same running the task and reviewing the IIQ 8.3 code.

Logging can be enabled (and I know this is not real auditing) to see which cubes are deleted. Adjust the log4j2.properties file and add:

logger.IdentityCleanser.name=sailpoint.task.IdentityCleanser
logger.IdentityCleanser.level=debug

It looks like this is a good idea to add to https://ideas.sailpoint.com/ and Developer Ideas Discussion category

– Remold

1 Like
6

Thanks for your help and clarification @Remold and @kjakubiak !

7

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.