New Entitlement Detection

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

Hi,

Is there a option in ISC to detect new entitlements that came as part of entitlement aggregation?

2

What would you like the outcome of the detection to be? Notification? Email? What action?

3

@nbhansali I need to create an access profile for the new entitlements detected.

4

Is this for a specific source?

5

@nbhansali Yes, Thats correct

6

I don’t think there is any OOTB feature for this. But this can be achieved via PowerShell script. You can call below API to get list of enlistments (filter with source ID) and do the comparison for each day. If there is any new entitlement added, just notify yourself by sending email.

1 Like
7

Hi Chandra,

There is no native functionality for detecting new entitlements in ISC. I have setup a python script in the past that did what Theja mentioned above. The script did the following things:

  • Script must run after a recent entitlement aggregation to pull in the latest entitlement set
  • Looped through the new entitlement list and did a compare to find the new entitlements
  • For each new entitlement, it created a new access profile as requestable and with the appropriate approval path
  • Then attached the access profile to an application for the request center (there was a /cc api endpoint that used to let you do this not sure if it is still available … I can help you find out if you want to go down this route)

If the source owner could call your script with the new entitlements ids that were created that day you could skip the second step above as well.

Thanks,

Liam

1 Like
8

You could create a workflow that triggers the entitlement aggregation then use IDN Search query to see which ones are new. Query below finds entitlements created in the last 10 minutes.

created:[now-10m TO now] AND sourceSchemaObjectType:*

Then use the workflow downstream from that to do whatever you need with that info. The HTTP Request node in the workflows can be called against IdentityNow against any of their API’s

We have some of our aggregations being ran from the workflow just so we can control the optimized/non-optimized aspect of it.

1 Like
9

Extending this question further, what would be the best way to mark any new entitlement’s requestable flag as false. This should happen only on new entitlements. Any existing entitlement’s flag should persist. This would be for all sources and not specific to certain source.

10

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.