Modified date for source connectorAttributes

Identity Security Cloud (ISC) ISC Discussion and Questions
, ,
1

We had a question from our auditors yesterday that I didn’t have an answer for, but I was curious if there is a modified date available for connectorAttributes (e.g. the config)?

This would help answer the question “How can we be sure the connection to this source has not been modified since our last audit period?”

2

There should be audit events for it. You can use this search to see any modifications (and some info on what the change was.

name:"Update Source Passed" AND attributes.sourceName:"ServiceNow"

And you can add dates as well such as: AND created:[now-90d TO now]

The /v3/sources API endpoint also has a “modified” attribute.

3

The /v3/sources API endpoint also has a “modified” attribute.

While true, it doesn’t necessarily reflect that the source connector configuration was modified. It seems to me that it could reflect lots of other events like a new accounts/entitlements being added, new entitlement assignments, etc.

It seems the “modified” date on lots of my sources are all today despite not changing the configuration.

4

I would recommend the audit events then - from what I see in my tenants, they’re tracked much more specifically to the configuration being edited.

5

Yeah, these could be interesting… have you found any way to peel back the “details” portion of these events to track down what exactly changed?

{
        "org": "chk",
        "pod": "prd04-useast1",
        "created": "2023-05-09T21:48:21.742Z",
        "id": "79fb4b2af840714e5f153f3c35a9c54c9e22b3c5d19c1be6513e424567cabd3a",
        "action": "SOURCE_UPDATE",
        "type": "SOURCE_MANAGEMENT",
        "actor": {
            "name": "452570"
        },
        "target": {
            "name": "SAP ECC ABAP [source]"
        },
        "stack": "diana",
        "details": "fdaf099efffa4d3baf19dd32abb13d3a",
        "attributes": {
            "sourceId": "source",
            "sourceName": "SAP ECC ABAP"
        },
        "objects": [
            "SOURCE"
        ],
        "operation": "UPDATE",
        "status": "PASSED",
        "technicalName": "SOURCE_UPDATE_PASSED",
        "name": "Update Source Passed",
        "synced": "2023-05-09T21:48:21.856Z",
        "_type": "event",
        "_version": "v7"
    }
6

There should be audit events for it. You can use this search to see any modifications (and some info on what the change was.

name:“Update Source Passed” AND attributes.sourceName:“ServiceNow”

This looks like the best solution, but it would be nice to know what types of changes trigger this audit event.