SailPoint Audit Queries

Identity Security Cloud (ISC) ISC Discussion and Questions
, , , ,
1

Please help me with below questions which need to be presented for audit:

  1. If any users log in locally to SailPoint:
    -Evidence of local password parameters
    -Observe a user log in locally

2)List of everyone who can log in locally and C&A evidence:
-Query used to generate the listing
-One full record in the system
-Row count in the system
-Exported report in excel

3)Exception waiver if password standards not compliant with Client password standards

4)Observe the list of all privileged roles within SailPoint and description of those roles.

5)Observe the list of users and accounts with privileged roles assigned, with C&A evidence :-
-Query used to generate the listing
-One full record in the system
-Row count in the system
-Exported report in excel

6)Observe the list of users who have had privileged access provisioned to the system, with C&A evidence :-
-Query used to generate the listing
-One full record in the system
-Row count in the system
-Exported report in excel

7)Exported report of the list of users with privileged access provisioned to SailPoint

Please help us with search queries or on SailPoint UI.

2

Hi @AnnamicaP,

You can use the search documentation for information about how to build different search queries based on what you are looking for. It sounds like you may want to focus on building searches for Event Data and possibly Account Activity Data.

Additionally, you can use this list of Audit Events to help you figure out the types of Events you are looking for to fit your requirements.

Please let me know if this is helpful!

  • Zach
2 Likes
3

Hi Zach,

Thankyou for your reply. It is really helpful.
But I am not sure which query to check exactly for list user who can login locally.

4

In reading the documentation the Bypassing the Identity Provider, if this box is checked under your security settings in ISC, " users with an access level beyond “user” can bypass the identity provider", so you would want to search for any users with elevated ISC access as they would have the ability to login locally.