Is there a way in a correlation rule to skip correlation if the target identity has a specific value, even if the correlation key is a match? Since there is no access to the Identity Objects, I am looking to see if that is possible.
Example:
Account attribute “key” matches Identity attribute “key” for a correlation match.
The Target Identity has a name starting with “Admin-”
So skip correlation if that is true and create a new identity.
Hi @ryan_toornburg - That should be doable.
In the correlation rule when this scenario is encountered, try something like this:
I will reference the above example in documentation:
returnMap.put( "identityAttributeName", "email");
returnMap.put( "identityAttributeValue", "[email protected]"); //feel free to edit this as you see fit
By deliberately providing a value that cannot be matched with any identity, the account should stay uncorrelated. Just ensure your condition for deliberate uncorrelation is coded properly.
Hope this helps!
The goal is to not correlate if the matched Identity’s name starts with Admin-.