Skip to content

Commit 3290480

Browse files
[Collection] Saviynt Enterprise Identity Cloud (#41306)
* feat: Init Saviynt EIC event collector integration * refactor: improve token management and error handling in Saviynt EIC integration * refactor: simplify event collection and add multi-analytics support for Saviynt EIC * refactor: implement get-events command and streamline event collection logic * feat: add event deduplication based on SHA-256 hash comparison with previous run * feat: add debug logging to event hash generation and deduplication * docs: remove release notes for SaviyntEIC pack * feat: add configurable time frame for event fetching and improve error handling in SaviyntEIC integration * fix: pre-commit fixes * feat: add debug logging in Saviynt EIC event collector * feat: add timestamp tracking for event fetching to prevent time gaps * refactor: standardize event collection constants and improve debug logging clarity * fix: set auth headers when using cached token in Saviynt EIC integration * docs: add Saviynt EIC Event Collector integration description and setup guide * docs: Saviynt EIC integration documentation * fix: improve error handling and debug logging in Saviynt EIC event collector * fix: update UTs * fix: handle timestamp parsing edge cases in SaviyntEIC event collector * add: add logo image file * docs: update README and configuration with clearer descriptions * chore: remove platform from SaviyntEIC pack marketplaces list * feat: update docs * docs: update Saviynt EIC description and command usage notes * feat: implement concurrent page fetching for Saviynt EIC event collector * refactor: improve code documentation and thread naming in Saviynt EIC integration * docs: fix link placement for Saviynt API documentation reference * docs: update Saviynt EIC pack name and description with more details * docs: update Saviynt EIC product description for clarity and brevity * docs: update Saviynt EIC product name and description in README * fix: restore default fetch time and remove timeout from token request * refactor: simplify Saviynt integration to only fetch SIEMAuditLogs event type; Naming updates; Lower default max events to 30000 * Apply suggestion from @JasBeilin Co-authored-by: Jasmine Beilin <[email protected]> * fix: correct indentation for limit parameter in SaviyntEIC integration YAML * Doc review --------- Co-authored-by: Jasmine Beilin <[email protected]>
1 parent 68b4695 commit 3290480

10 files changed

+1319
-0
lines changed

Packs/SaviyntEIC/.pack-ignore

Whitespace-only changes.

Packs/SaviyntEIC/.secrets-ignore

Whitespace-only changes.
Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
Collector for Saviynt Enterprise Identity Cloud (EIC) audit logs using Analytics Runtime Control V2.
2+
This integration was tested with Saviynt EIC [API Reference for Amsterdam GA Release](https://documenter.getpostman.com/view/40843358/2sAYdctCto) (API v5).
3+
4+
## Configure Saviynt EIC Event Collector in Cortex
5+
6+
| **Parameter** | **Required** |
7+
| --- | --- |
8+
| Server URL | True |
9+
| Username | True |
10+
| Password | True |
11+
| Analytics Name | True |
12+
| Maximum number of events per fetch | False |
13+
| Trust any certificate (not secure) | False |
14+
| Events Fetch Interval | False |
15+
| Use system proxy settings | False |
16+
17+
## Commands
18+
19+
You can execute these commands from the CLI, as part of an automation, or in a playbook.
20+
After you successfully execute a command, a DBot message appears in the War Room with the command details.
21+
22+
### saviynt-eic-get-events
23+
24+
***
25+
Gets events from Saviynt EIC.
26+
27+
#### Base Command
28+
29+
`saviynt-eic-get-events`
30+
31+
#### Input
32+
33+
| **Argument Name** | **Description** | **Required** |
34+
| --- | --- | --- |
35+
| should_push_events | If true, the command creates events, otherwise, it only displays them. Possible values are: true, false. Default is false. | Required |
36+
| limit | Maximum number of results to return (max 10000). | Required |
37+
| time_frame | Time frame in minutes back from now to query. | Optional |
38+
| offset | Offset for paging. | Optional |
39+
40+
#### Context Output
41+
42+
There is no context output for this command.

0 commit comments

Comments
 (0)