Splunk IdentityNow Add-on compatibility

Identity Security Cloud (ISC) ISC Discussion and Questions
1

Hi All,

Currently we have the Sailpoint IdentityNow AuditEvent Add-on in our Splunk Cloud Classic Experience.

We are in the process to upgrading Splunk Cloud Classic Experience to Splunk Cloud Victoria Experience. As part of the migration the Sailpoint IdentityNow AuditEvent Add-on need to be added to the upgraded Splunk Cloud Victoria Experience. However when looking at the upgrade readiness, it’s not clear if it is compatible with Splunk Cloud Victoria Experience version.

Looking for confirmation on compatibility? And if anyone has successfully used the Sailpoint IdentityNow AuditEvent Add-on in the classic experience and migrated to the victoria experience successfully?

We have reached out to Sailpoint support, which they were not able to give an answer and asked to post it here in the developer portal.

2

@Louise22 you can you the search API to get the audit events by creating a client id and secret and call the search api from splunk.

use this payload in the seach api query

type or paste code here
3

Hi Shantanu,

Is that recommended over using the Sailpoint IdentityNow AuditEvent Add-on?
Can everything the Add-on offers be done in another way in the same about of time?

It might be an option if the Add-on is not compatible.

4

Hi Louise - my team owns the SailPoint Splunk add-ons. We have not received any instructions from Splunk about necessary/required updates to support ‘Victoria’ style deployments. The app is cloud vetted, and we do make updates when Splunk informs us of required upgrades.

That being said, I’ll have one of our engineering folks take a look and see if we can get a more definitive answer. @dhara_shah

1 Like
5

Just confirmed, we have passed appinspect for Victoria with addon version 2.0.12

1 Like
6

Thanks Adam for the confirmation! :slight_smile:

7

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.