SailPoint Identity Security Cloud

https://documentation.sailpoint.com/saas/help/
Admin
SailPoint Identity Security Cloud is a SaaS identity governance platform that enables organizations...
Tokens:214,044
Snippets:3,214
Trust Score:10
Update:1 month ago
Show doc for...
Tokens:
Raw
### OTLP Header Configuration Example

Source: https://documentation.sailpoint.com/saas/help/va/observe_va.html

Example of an incorrectly formatted OTLP header containing extraneous authorization information.

```text
    OTEL_EXPORTER_OTLP_HEADERS="Authorization=Basic nlJam9pY0hKdlpDMWhjQzF643434sbjE5".
```

--------------------------------

### Example hosts.yaml Configuration

Source: https://documentation.sailpoint.com/saas/help/va/config_va.html

Defines the structure for mapping IP addresses to fully qualified hostnames and short hostnames.

```yaml
hosts:
  10.20.30.40:
    - host1.domain.example
    - host1
  10.20.30.41:
    - host2.domain.example
    - host2
```

--------------------------------

### Nested Query Examples

Source: https://documentation.sailpoint.com/saas/help/search/building-query.html

Practical examples of using nested queries to filter by object attributes.

```text
@access(displayName:"Engineering_Access") AND manager.name:"amanda.ross"
```

```text
status:"UNREGISTERED" AND @access(displayName:"Base Access")
```

```text
@accounts(source.name:Acme) AND NOT @apps(name:Adobe)
```

```text
@accounts(disabled:true) && @access(name:Building_Access)
```

--------------------------------

### Sample Regional IP File Formats

Source: https://documentation.sailpoint.com/saas/help/workflows/workflow-manage.html

Examples of the TXT, JSON, and YAML file structures used for regional IP allow lists.

```text
    TXT:
    35.176.191.33/32
    35.178.100.127/32
    52.56.91.241/32
    JSON:
    {"region":"eu-west-2","source_ips":["35.176.191.33/32","35.178.100.127/32","52.56.91.241/32"]}
    YAML:
    "region": "eu-west-2"
    "source_ips":
    - "35.176.191.33/32"
    - "35.178.100.127/32"
    - "35.178.100.127/32"
    - "52.56.91.241/32"
```

--------------------------------

### Configuration Hub Object Example

Source: https://documentation.sailpoint.com/saas/help/confighub/config_hub_mapping.html

A sample JSON structure representing a role object in the Configuration Hub, used to identify fields for mapping.

```json
{
    "version": 1,
    "self": {
        "id": "5d09273380b2451e97d2d9c62b0992fb",
        "type": "ROLE",
        "name": "2 entitlement role"
    },
    "object": {
        "id": "5d09273380b2451e97d2d9c62b0992fb",
        "name": "2 entitlement role",
        "created": "2024-05-13T19:45:31.367466Z",
        "modified": "2024-07-11T19:20:19.676014Z",
        "description": "test update",
        "owner": {
            "type": "IDENTITY",
            "id": "ddabd13baa854bff97ced8f66499caee",
            "name": "Imogene M̩endez"
        }
    }
```

--------------------------------

### Chrome Extension Configuration Plist

Source: https://documentation.sailpoint.com/saas/help/agentic_fabric/onboarding/sensors/browser_sensor/browser_deployment/jamfpro_chrome_mac.html

This property list file defines the extension installation and pinning settings for Google Chrome.

```xml
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>ExtensionInstallForcelist</key>
    <array>
      <string>ckdibgmbbhmafmjpjmknleccgcddanan;https://extension.savvy.security/update.xml</string>
    </array>
    <key>ExtensionSettings</key>
    <dict>
      <key>ckdibgmbbhmafmjpjmknleccgcddanan</key>
      <dict>
        <key>installation_mode</key>
        <string>force_installed</string>
        <string>force_pinned</string>
        <key>update_url</key>
        <string>https://extension.savvy.security/update.xml</string>
      </dict>
    </dict>
  </dict>
</plist>
```

--------------------------------

### JWT Claims Set Example

Source: https://documentation.sailpoint.com/saas/help/ai/activity_insights/connectors/salesforce.html

Example of the JSON structure for JWT claims used in the authentication process.

```json
{"iss": "3MVG99Ox8878y48hf98[omitted for brevity]_rSK781.BoSVPGZHQ
ukXnVjzRgSuQqGn75NL7yfkQcyy7",
"sub": "my@email.com",
"aud": "https://login.salesforce.com",
"exp": "1333685628"}
```

--------------------------------

### Get VA Pairing Code

Source: https://documentation.sailpoint.com/saas/help/va/config_va.html

Use the va-bootstrap command to generate a pairing code for the virtual appliance.

```bash
va-bootstrap pair --http-proxy <http://host:port> --https-proxy <http://host:port>
```

--------------------------------

### JWT Claims Set Example

Source: https://documentation.sailpoint.com/saas/help/ai/activity_insights/connectors/salesforce.html

A template for the JSON Claims Set required for JWT assertion generation.

```text
1
2
3
4
5
```

--------------------------------

### Handle Rate Limit Error Response

Source: https://documentation.sailpoint.com/saas/help/accounts/identities.html

Example of the error message returned when the request limit is exceeded.

```text
Slow down, you're making too many requests.
Please retry again in 7 seconds.
Error code: cloud_60_secs_limit.
```

--------------------------------

### CloudFormation Template for CloudTrail and S3 Setup

Source: https://documentation.sailpoint.com/saas/help/ciem/aws/config/assets/commercial/commercial-activity-collection-new-cloudtrail-and-bucket.json

Use this template to provision an S3 bucket, configure bucket policies for CloudTrail, enable a multi-region CloudTrail, and create the IAM audit role.

```json
{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Parameters": {
    "RoleName": {
      "Default": "SailPointCIEMAuditRole",
      "Description": "Role with this name will be created.",
      "Type": "String"
    },
    "ExternalId": {
      "Description": "Unique external ID needed for assuming role.",
      "Type": "String"
    },
    "RolePolicyName": {
      "Default": "SailPointCIEMAuditPolicy",
      "Description": "Policy to allow SailPoint CIEM Audit Role to read objects under the specified Cloud Trail Bucket.",
      "Type": "String"
    },
    "TrailName": {
      "Default": "sailpoint-ciem-cloud-trail",
      "Description": "Trail with this name will be created.",
      "Type": "String"
    },
    "BucketName": {
      "Description": "Bucket for collecting CloudTrail logs.",
      "Type": "String"
    }
  },
  "Resources": {
    "S3Bucket": {
      "Type": "AWS::S3::Bucket",
      "DeletionPolicy": "Retain",
      "Properties": {
        "BucketName": {
          "Ref": "BucketName"
        }
      }
    },
    "BucketPolicy": {
      "Type": "AWS::S3::BucketPolicy",
      "Properties": {
        "Bucket": {
          "Ref": "S3Bucket"
        },
        "PolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Sid": "AWSCloudTrailAclCheck",
              "Effect": "Allow",
              "Principal": {
                "Service": "cloudtrail.amazonaws.com"
              },
              "Action": "s3:GetBucketAcl",
              "Resource": {
                "Fn::Join": [
                  "",
                  [
                    "arn:aws:s3:::",
                    {
                      "Ref": "S3Bucket"
                    }
                  ]
                ]
              }
            },
            {
              "Sid": "AWSCloudTrailWrite",
              "Effect": "Allow",
              "Principal": {
                "Service": "cloudtrail.amazonaws.com"
              },
              "Action": "s3:PutObject",
              "Resource": {
                "Fn::Join": [
                  "",
                  [
                    "arn:aws:s3:::",
                    {
                      "Ref": "S3Bucket"
                    },
                    "/AWSLogs/",
                    {
                      "Ref": "AWS::AccountId"
                    },
                    "/*"
                  ]
                ]
              },
              "Condition": {
                "StringEquals": {
                  "s3:x-amz-acl": "bucket-owner-full-control"
                }
              }
            }
          ]
        }
      }
    },
    "SailPointCIEMCloudTrail": {
      "DependsOn": [
        "BucketPolicy"
      ],
      "Type": "AWS::CloudTrail::Trail",
      "Properties": {
        "TrailName": {
          "Ref": "TrailName"
        },
        "S3BucketName": {
          "Ref": "S3Bucket"
        },
        "IsLogging": true,
        "IsMultiRegionTrail": true,
        "IncludeGlobalServiceEvents": true
      }
    },
    "SailPointCIEMAuditPolicy": {
      "Type": "AWS::IAM::ManagedPolicy",
      "Properties": {
        "Description": "Policy Created for aws SailPoint CIEM",
        "Path": "/",
        "Roles": [
          {
            "Ref": "SailPointCIEMAuditRole"
          }
        ],
        "PolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Action": [
                "s3:GetBucketLocation",
                "s3:ListBucket"
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::Join": [
                  ":",
                  [
                    "arn:aws:s3::",
                    {
                      "Ref": "BucketName"
                    }
                  ]
                ]
              }
            },
            {
              "Action": [
                "s3:GetObject"
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::Join": [
                  "/",
                  [
                    {
                      "Fn::Join": [
                        ":",
                        [
                          "arn:aws:s3::",
                          {
                            "Ref": "BucketName"
                          }
                        ]
                      ]
                    },
                    "*"
                  ]
                ]
              }
            }
          ]
        }
      }
    },
    "SailPointCIEMAuditRole": {
      "Type": "AWS::IAM::Role",
      "Properties": {
        "RoleName": {
          "Ref": "RoleName"
        },
        "AssumeRolePolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Principal": {
                "AWS": "arn:aws:iam::874540850173:role/ciem_universal"
              },
```

--------------------------------

### CloudFormation Template for CIEM Audit Setup

Source: https://documentation.sailpoint.com/saas/help/ciem/aws/config/assets/commercial/commercial-activity-collection-new-cloudtrail-and-existing-bucket.json

Use this template to create an IAM role and CloudTrail configuration that grants SailPoint CIEM access to existing S3 bucket logs.

```json
{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Parameters": {
    "RoleName": {
      "Default": "SailPointCIEMAuditRole",
      "Description": "Role with this name will be created.",
      "Type": "String"
    },
    "ExternalId": {
      "Description": "Unique external ID needed for assuming role.",
      "Type": "String"
    },
    "RolePolicyName": {
      "Default": "SailPointCIEMAuditPolicy",
      "Description": "Policy to allow SailPoint CIEM Audit Role to read objects under the specified CloudTrail Bucket.",
      "Type": "String"
    },
    "TrailName": {
      "Default": "sailpoint-ciem-cloud-trail",
      "Description": "Name of the new CloudTrail.",
      "Type": "String"
    },
    "BucketName": {
      "Description": "Name of existing Bucket with cloudtrail logs.",
      "Type": "String"
    }
  },
  "Resources": {
    "SailPointCIEMCloudTrail": {
      "Type": "AWS::CloudTrail::Trail",
      "Properties": {
        "TrailName": {
          "Ref": "TrailName"
        },
        "S3BucketName": {
          "Ref": "BucketName"
        },
        "IsLogging": true,
        "IsMultiRegionTrail": true,
        "IncludeGlobalServiceEvents": true
      }
    },
    "SailPointCIEMAuditPolicy": {
      "Type": "AWS::IAM::ManagedPolicy",
      "Properties": {
        "Description": "Policy Created for aws SailPoint CIEM",
        "Path": "/",
        "Roles": [
          {
            "Ref": "SailPointCIEMAuditRole"
          }
        ],
        "PolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Action": [
                "s3:GetBucketLocation",
                "s3:ListBucket"
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::Join": [
                  ":",
                  [
                    "arn:aws:s3::",
                    {
                      "Ref": "BucketName"
                    }
                  ]
                ]
              }
            },
            {
              "Action": [
                "s3:GetObject"
              ],
              "Effect": "Allow",
              "Resource": {
                "Fn::Join": [
                  "/",
                  [
                    {
                      "Fn::Join": [
                        ":",
                        [
                          "arn:aws:s3::",
                          {
                            "Ref": "BucketName"
                          }
                        ]
                      ]
                    },
                    "*"
                  ]
                ]
              }
            }
          ]
        }
      }
    },
    "SailPointCIEMAuditRole": {
      "Type": "AWS::IAM::Role",
      "Properties": {
        "RoleName": {
          "Ref": "RoleName"
        },
        "AssumeRolePolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Principal": {
                "AWS": "arn:aws:iam::874540850173:role/ciem_universal"
              },
              "Action": "sts:AssumeRole",
              "Condition": {
                "StringEquals": {
                  "sts:ExternalId": {
                    "Ref": "ExternalId"
                  }
                }
              }
            }
          ]
        },
        "Policies": [
          {
            "PolicyName": "policy01",
            "PolicyDocument": {
              "Version": "2012-10-17",
              "Statement": [
                {
                  "Effect": "Allow",
                  "Resource": "*",
                  "Action": [
                    "bedrock-agentcore:GetAgentRuntime",
                    "bedrock-agentcore:GetGateway",
                    "bedrock-agentcore:GetGatewayTarget",
                    "bedrock-agentcore:ListAgentRuntimeEndpoints",
                    "bedrock-agentcore:ListAgentRuntimes",
                    "bedrock-agentcore:ListAgentRuntimeVersions",
                    "bedrock-agentcore:ListGateways",
                    "bedrock-agentcore:ListGatewayTargets",
                    "bedrock:GetAgent",
                    "bedrock:GetAgentAlias",
                    "bedrock:GetKnowledgeBase",
                    "bedrock:ListAgentActionGroups",
                    "bedrock:ListAgentAliases",
                    "bedrock:ListAgentKnowledgeBases",
                    "bedrock:ListAgents",
                    "bedrock:ListAgentVersions",
                    "cloudtrail:DescribeTrails",
                    "cloudtrail:GetEventSelectors",
                    "cloudtrail:GetTrailStatus",
                    "cloudtrail:ListTags",
                    "cloudtrail:LookupEvents",
                    "cloudwatch:Describe*",
                    "cloudwatch:ListTagsForResource",
                    "dynamodb:DescribeGlobalTable",
                    "dynamodb:DescribeTable"
```

--------------------------------

### Logic for Next Processing Date Transform

Source: https://documentation.sailpoint.com/saas/help/setup/identity_processing.html

Example logic for a transform that evaluates start and end dates to determine the earliest future processing date.

```text
if (startDate > now) return startDate + "T06:00:00" else if (endDate > now) return endDate + "T15:00:00" else return null
```

--------------------------------

### Configure static.network File

Source: https://documentation.sailpoint.com/saas/help/va/deploy_va.html

Create or edit the static.network file to define network settings for local VA deployments.

```bash
sudoedit /etc/systemd/network/static.network
```

```text
[Match]
Name=<NICname>
[Network]
DNS=<DNS>
Address=<IPaddress and CIDR>
Gateway=<Gateway>
```

--------------------------------

### Provision VM from Managed Disk

Source: https://documentation.sailpoint.com/saas/help/va/deploy_va.html

Creates the virtual machine using the managed disk and specifies the network security group and instance size.

```bash
az vm create --resource-group "$resource_group" --location "$region" --name "$name" --os-type linux --attach-os-disk "sailpoint-va" --nsg "$network_security_group" --size "Standard_B4ms"
```

--------------------------------

### Configure HTTP Proxy in proxy.yaml

Source: https://documentation.sailpoint.com/saas/help/va/config_va.html

Define proxy server settings in the proxy.yaml file. A space is required after the proxy key and before the URL.

```yaml
https_proxy: http://<proxyserver>:<port>/
```

```yaml
http_proxy: http://<proxyserver>:<port>/
```
Tokens:
Raw