Native Change Detection in Active Directory Source

[yunus_merck (Yunus Ali)]

Hi,

We are planning to enable the Native Change Detection for Active Directory. Do we have any best practices around it?
Our AD is integrated with IDN from past 2 years with JML and other configurations. So wanted to understand the Do’s and Dont’s to avoid any unexpected issue.
Also, is there a possibility to configure native change for specific groups rather than all the entitlements to avoid any kind of overload on the system.

Thanks

[kwhipple (Kelvin Whipple)]

I also had the question of how to target specific groups. We don’t have workflow so don’t have that part of the offering.

[yunus_merck (Yunus Ali)]

@chirag_patel @MVKR7T

Did you implement any such scenario?

[chirag_patel]

You can implement filtering at trigger level and also using workflows.

In our environment we trigger events and use workato to process those events. Workato is workflow automation tool which is no-code low-code tool.

[kwhipple (Kelvin Whipple)]

We have implemented native change on a test domain in our sandbox but we don’t have workflow available in production and don’t have triggers set up yet. I was hoping that search would be able to filter down to specific group but wasn’t able to get it working.

[kwhipple (Kelvin Whipple)]

Enabling Native Change Detection is fairly easy but it’s is basically everything for the attribute selected which is changed natively, no filtering. The problem I’m having is filtering it to just what is needed to be audited without Workflow. I’m looking at event triggers to see what we can do with it. I took a look at Workato mentioned by @chirag_patel and like the no-code low-code.

Here are the various links I’ve found if you don’t already have them:

Managing Native Change Detection - SailPoint Identity Services

Enhancement: Native Change Detection

This is available in all sandbox and production tenants. Native Change Detection enables Admins to remediate out-of-band access changes. Select the source, account operations, and attributes to monitor. Consume Native Change Detected events in external systems. Initiate workflows with Native Change Detected triggers. This is available in your tenant if you see Native Change Detection triggers in the Event Triggers or Workflows UIs. What are native changes / out-of-band changes? Native chang…

put-native-change-detection-config | SailPoint Developer Community

@chirag_patel has reported an issue

Native Change detection basic problem

I have implemented native change detection in Gsuite in our tenant and I have found idn is triggering native change detection events even in those cases where change was made by identitynow itself. One common example is “suspended” attribute. We disable/enable Gsuite accounts from idn and it is very rare to do this on end source so we are detecting native change on suspended attribute. The problem we have observed is when identitynow disables account , connector is not setting suspended to tru…

I hope it helps, Kelvin

[yunus_merck (Yunus Ali)]

Thanks @kwhipple and @chirag_patel for the responses.

I have one more requirement where we need to generate a report of the exact native changes that has happened on the account. This is for other types of sources.

Now from search we can query for different operations, specific source etc.
name:“Native Change Detected” AND attributes.sourceName.exact:“”
What I am looking at the exact details of the change that has happened. Like the exact entitlement change or non-entitlement attribute change. Clicking on the event give this information but is there any other way from the search query to get that. I have also tried with the api(from developer tools) that pulls the data but that api is internal to sailpoint so can’t use. Also, as of now, Event Trigger/Workflow is also not an option.

So any other way to pull this data?

Thanks
Yunus

[chirag_patel]

Your search query is perfect and there is no internal api being called here for extra information which is visible in sidebar on clicking events record. It’s just front end code.

you can get all information in search api under events , make search call through postman and check response in postman. The information you are looking for is available under attributes section. I can see that in my network tab api call response, cannot share screenshot as it would reveal PII data.

[yunus_merck (Yunus Ali)]

Thanks Chirag. Just got this working through the API. Was about to reply on the thread.

[timahm (tima ami)]

Hello @yunus_merck,
Have you tested the feature ?
Indeed, I enabled it in the Sandbox env and it doesn’t seem to work. I even selected all the attributes from the source configuration. I tested the attribute update and adding an entitlement from AD. After the aggregation, the account is changed but the worklfow is not triggered (I have no filter in the trigger).

[yunus_merck (Yunus Ali)]

Hi @timahm ,

Yes, I have tested this feature and it worked as expected. Just to be clear, we do not have workflows and we only enabled this feature to get the notifications of native change detection.
So as soon as the account changes happened at the target end, post aggregation, native change detection triggers. From Search, we can capture those events. That’s the only requirement we had. Not sure if you have the same requirement.
Note- Always run the Full aggregation, Native Change detection does not work on Single Account Aggregation.