### OTLP Header Configuration Example
Source: https://documentation.sailpoint.com/saas/help/va/observe_va.html
Example of an incorrectly formatted OTLP header containing extraneous authorization information.
```text
OTEL_EXPORTER_OTLP_HEADERS="Authorization=Basic nlJam9pY0hKdlpDMWhjQzF643434sbjE5".
```
--------------------------------
### Example hosts.yaml Configuration
Source: https://documentation.sailpoint.com/saas/help/va/config_va.html
Defines the structure for mapping IP addresses to fully qualified hostnames and short hostnames.
```yaml
hosts:
10.20.30.40:
- host1.domain.example
- host1
10.20.30.41:
- host2.domain.example
- host2
```
--------------------------------
### Nested Query Examples
Source: https://documentation.sailpoint.com/saas/help/search/building-query.html
Practical examples of using nested queries to filter by object attributes.
```text
@access(displayName:"Engineering_Access") AND manager.name:"amanda.ross"
```
```text
status:"UNREGISTERED" AND @access(displayName:"Base Access")
```
```text
@accounts(source.name:Acme) AND NOT @apps(name:Adobe)
```
```text
@accounts(disabled:true) && @access(name:Building_Access)
```
--------------------------------
### Sample Regional IP File Formats
Source: https://documentation.sailpoint.com/saas/help/workflows/workflow-manage.html
Examples of the TXT, JSON, and YAML file structures used for regional IP allow lists.
```text
TXT:
35.176.191.33/32
35.178.100.127/32
52.56.91.241/32
JSON:
{"region":"eu-west-2","source_ips":["35.176.191.33/32","35.178.100.127/32","52.56.91.241/32"]}
YAML:
"region": "eu-west-2"
"source_ips":
- "35.176.191.33/32"
- "35.178.100.127/32"
- "35.178.100.127/32"
- "52.56.91.241/32"
```
--------------------------------
### Configuration Hub Object Example
Source: https://documentation.sailpoint.com/saas/help/confighub/config_hub_mapping.html
A sample JSON structure representing a role object in the Configuration Hub, used to identify fields for mapping.
```json
{
"version": 1,
"self": {
"id": "5d09273380b2451e97d2d9c62b0992fb",
"type": "ROLE",
"name": "2 entitlement role"
},
"object": {
"id": "5d09273380b2451e97d2d9c62b0992fb",
"name": "2 entitlement role",
"created": "2024-05-13T19:45:31.367466Z",
"modified": "2024-07-11T19:20:19.676014Z",
"description": "test update",
"owner": {
"type": "IDENTITY",
"id": "ddabd13baa854bff97ced8f66499caee",
"name": "Imogene MĚŠendez"
}
}
```
--------------------------------
### Chrome Extension Configuration Plist
Source: https://documentation.sailpoint.com/saas/help/agentic_fabric/onboarding/sensors/browser_sensor/browser_deployment/jamfpro_chrome_mac.html
This property list file defines the extension installation and pinning settings for Google Chrome.
```xml
ExtensionInstallForcelist
ckdibgmbbhmafmjpjmknleccgcddanan;https://extension.savvy.security/update.xml
ExtensionSettings
ckdibgmbbhmafmjpjmknleccgcddanan
installation_mode
force_installed
force_pinned
update_url
https://extension.savvy.security/update.xml
```
--------------------------------
### JWT Claims Set Example
Source: https://documentation.sailpoint.com/saas/help/ai/activity_insights/connectors/salesforce.html
Example of the JSON structure for JWT claims used in the authentication process.
```json
{"iss": "3MVG99Ox8878y48hf98[omitted for brevity]_rSK781.BoSVPGZHQ
ukXnVjzRgSuQqGn75NL7yfkQcyy7",
"sub": "my@email.com",
"aud": "https://login.salesforce.com",
"exp": "1333685628"}
```
--------------------------------
### Get VA Pairing Code
Source: https://documentation.sailpoint.com/saas/help/va/config_va.html
Use the va-bootstrap command to generate a pairing code for the virtual appliance.
```bash
va-bootstrap pair --http-proxy --https-proxy
```
--------------------------------
### JWT Claims Set Example
Source: https://documentation.sailpoint.com/saas/help/ai/activity_insights/connectors/salesforce.html
A template for the JSON Claims Set required for JWT assertion generation.
```text
1
2
3
4
5
```
--------------------------------
### Handle Rate Limit Error Response
Source: https://documentation.sailpoint.com/saas/help/accounts/identities.html
Example of the error message returned when the request limit is exceeded.
```text
Slow down, you're making too many requests.
Please retry again in 7 seconds.
Error code: cloud_60_secs_limit.
```
--------------------------------
### CloudFormation Template for CloudTrail and S3 Setup
Source: https://documentation.sailpoint.com/saas/help/ciem/aws/config/assets/commercial/commercial-activity-collection-new-cloudtrail-and-bucket.json
Use this template to provision an S3 bucket, configure bucket policies for CloudTrail, enable a multi-region CloudTrail, and create the IAM audit role.
```json
{
"AWSTemplateFormatVersion": "2010-09-09",
"Parameters": {
"RoleName": {
"Default": "SailPointCIEMAuditRole",
"Description": "Role with this name will be created.",
"Type": "String"
},
"ExternalId": {
"Description": "Unique external ID needed for assuming role.",
"Type": "String"
},
"RolePolicyName": {
"Default": "SailPointCIEMAuditPolicy",
"Description": "Policy to allow SailPoint CIEM Audit Role to read objects under the specified Cloud Trail Bucket.",
"Type": "String"
},
"TrailName": {
"Default": "sailpoint-ciem-cloud-trail",
"Description": "Trail with this name will be created.",
"Type": "String"
},
"BucketName": {
"Description": "Bucket for collecting CloudTrail logs.",
"Type": "String"
}
},
"Resources": {
"S3Bucket": {
"Type": "AWS::S3::Bucket",
"DeletionPolicy": "Retain",
"Properties": {
"BucketName": {
"Ref": "BucketName"
}
}
},
"BucketPolicy": {
"Type": "AWS::S3::BucketPolicy",
"Properties": {
"Bucket": {
"Ref": "S3Bucket"
},
"PolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AWSCloudTrailAclCheck",
"Effect": "Allow",
"Principal": {
"Service": "cloudtrail.amazonaws.com"
},
"Action": "s3:GetBucketAcl",
"Resource": {
"Fn::Join": [
"",
[
"arn:aws:s3:::",
{
"Ref": "S3Bucket"
}
]
]
}
},
{
"Sid": "AWSCloudTrailWrite",
"Effect": "Allow",
"Principal": {
"Service": "cloudtrail.amazonaws.com"
},
"Action": "s3:PutObject",
"Resource": {
"Fn::Join": [
"",
[
"arn:aws:s3:::",
{
"Ref": "S3Bucket"
},
"/AWSLogs/",
{
"Ref": "AWS::AccountId"
},
"/*"
]
]
},
"Condition": {
"StringEquals": {
"s3:x-amz-acl": "bucket-owner-full-control"
}
}
}
]
}
}
},
"SailPointCIEMCloudTrail": {
"DependsOn": [
"BucketPolicy"
],
"Type": "AWS::CloudTrail::Trail",
"Properties": {
"TrailName": {
"Ref": "TrailName"
},
"S3BucketName": {
"Ref": "S3Bucket"
},
"IsLogging": true,
"IsMultiRegionTrail": true,
"IncludeGlobalServiceEvents": true
}
},
"SailPointCIEMAuditPolicy": {
"Type": "AWS::IAM::ManagedPolicy",
"Properties": {
"Description": "Policy Created for aws SailPoint CIEM",
"Path": "/",
"Roles": [
{
"Ref": "SailPointCIEMAuditRole"
}
],
"PolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"s3:GetBucketLocation",
"s3:ListBucket"
],
"Effect": "Allow",
"Resource": {
"Fn::Join": [
":",
[
"arn:aws:s3::",
{
"Ref": "BucketName"
}
]
]
}
},
{
"Action": [
"s3:GetObject"
],
"Effect": "Allow",
"Resource": {
"Fn::Join": [
"/",
[
{
"Fn::Join": [
":",
[
"arn:aws:s3::",
{
"Ref": "BucketName"
}
]
]
},
"*"
]
]
}
}
]
}
}
},
"SailPointCIEMAuditRole": {
"Type": "AWS::IAM::Role",
"Properties": {
"RoleName": {
"Ref": "RoleName"
},
"AssumeRolePolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::874540850173:role/ciem_universal"
},
```
--------------------------------
### CloudFormation Template for CIEM Audit Setup
Source: https://documentation.sailpoint.com/saas/help/ciem/aws/config/assets/commercial/commercial-activity-collection-new-cloudtrail-and-existing-bucket.json
Use this template to create an IAM role and CloudTrail configuration that grants SailPoint CIEM access to existing S3 bucket logs.
```json
{
"AWSTemplateFormatVersion": "2010-09-09",
"Parameters": {
"RoleName": {
"Default": "SailPointCIEMAuditRole",
"Description": "Role with this name will be created.",
"Type": "String"
},
"ExternalId": {
"Description": "Unique external ID needed for assuming role.",
"Type": "String"
},
"RolePolicyName": {
"Default": "SailPointCIEMAuditPolicy",
"Description": "Policy to allow SailPoint CIEM Audit Role to read objects under the specified CloudTrail Bucket.",
"Type": "String"
},
"TrailName": {
"Default": "sailpoint-ciem-cloud-trail",
"Description": "Name of the new CloudTrail.",
"Type": "String"
},
"BucketName": {
"Description": "Name of existing Bucket with cloudtrail logs.",
"Type": "String"
}
},
"Resources": {
"SailPointCIEMCloudTrail": {
"Type": "AWS::CloudTrail::Trail",
"Properties": {
"TrailName": {
"Ref": "TrailName"
},
"S3BucketName": {
"Ref": "BucketName"
},
"IsLogging": true,
"IsMultiRegionTrail": true,
"IncludeGlobalServiceEvents": true
}
},
"SailPointCIEMAuditPolicy": {
"Type": "AWS::IAM::ManagedPolicy",
"Properties": {
"Description": "Policy Created for aws SailPoint CIEM",
"Path": "/",
"Roles": [
{
"Ref": "SailPointCIEMAuditRole"
}
],
"PolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"s3:GetBucketLocation",
"s3:ListBucket"
],
"Effect": "Allow",
"Resource": {
"Fn::Join": [
":",
[
"arn:aws:s3::",
{
"Ref": "BucketName"
}
]
]
}
},
{
"Action": [
"s3:GetObject"
],
"Effect": "Allow",
"Resource": {
"Fn::Join": [
"/",
[
{
"Fn::Join": [
":",
[
"arn:aws:s3::",
{
"Ref": "BucketName"
}
]
]
},
"*"
]
]
}
}
]
}
}
},
"SailPointCIEMAuditRole": {
"Type": "AWS::IAM::Role",
"Properties": {
"RoleName": {
"Ref": "RoleName"
},
"AssumeRolePolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::874540850173:role/ciem_universal"
},
"Action": "sts:AssumeRole",
"Condition": {
"StringEquals": {
"sts:ExternalId": {
"Ref": "ExternalId"
}
}
}
}
]
},
"Policies": [
{
"PolicyName": "policy01",
"PolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Resource": "*",
"Action": [
"bedrock-agentcore:GetAgentRuntime",
"bedrock-agentcore:GetGateway",
"bedrock-agentcore:GetGatewayTarget",
"bedrock-agentcore:ListAgentRuntimeEndpoints",
"bedrock-agentcore:ListAgentRuntimes",
"bedrock-agentcore:ListAgentRuntimeVersions",
"bedrock-agentcore:ListGateways",
"bedrock-agentcore:ListGatewayTargets",
"bedrock:GetAgent",
"bedrock:GetAgentAlias",
"bedrock:GetKnowledgeBase",
"bedrock:ListAgentActionGroups",
"bedrock:ListAgentAliases",
"bedrock:ListAgentKnowledgeBases",
"bedrock:ListAgents",
"bedrock:ListAgentVersions",
"cloudtrail:DescribeTrails",
"cloudtrail:GetEventSelectors",
"cloudtrail:GetTrailStatus",
"cloudtrail:ListTags",
"cloudtrail:LookupEvents",
"cloudwatch:Describe*",
"cloudwatch:ListTagsForResource",
"dynamodb:DescribeGlobalTable",
"dynamodb:DescribeTable"
```
--------------------------------
### Logic for Next Processing Date Transform
Source: https://documentation.sailpoint.com/saas/help/setup/identity_processing.html
Example logic for a transform that evaluates start and end dates to determine the earliest future processing date.
```text
if (startDate > now) return startDate + "T06:00:00" else if (endDate > now) return endDate + "T15:00:00" else return null
```
--------------------------------
### Configure static.network File
Source: https://documentation.sailpoint.com/saas/help/va/deploy_va.html
Create or edit the static.network file to define network settings for local VA deployments.
```bash
sudoedit /etc/systemd/network/static.network
```
```text
[Match]
Name=
[Network]
DNS=
Address=
Gateway=
```
--------------------------------
### Provision VM from Managed Disk
Source: https://documentation.sailpoint.com/saas/help/va/deploy_va.html
Creates the virtual machine using the managed disk and specifies the network security group and instance size.
```bash
az vm create --resource-group "$resource_group" --location "$region" --name "$name" --os-type linux --attach-os-disk "sailpoint-va" --nsg "$network_security_group" --size "Standard_B4ms"
```
--------------------------------
### Configure HTTP Proxy in proxy.yaml
Source: https://documentation.sailpoint.com/saas/help/va/config_va.html
Define proxy server settings in the proxy.yaml file. A space is required after the proxy key and before the URL.
```yaml
https_proxy: http://:/
```
```yaml
http_proxy: http://:/
```