...
Table 1-1: Port requirements for LCP communication.
Source | Destination | Port | Description |
LCP | Database | TCP/1433 | Default port and protocol |
Configuring Sailpoint IdentityIQ
...
Following are the Object and Attribute list that we are currently supporting :
Objects | Table Name | Attributes |
|---|---|---|
AuditEvent | spt_audit_event | id|created|modified|assigned_scope_path|interface|source|action|target|application|account_name|instance|attribute_name|attribute_value|tracking_id|attributes|string1|string2|string3|string4|server_host|client_host|owner|assigned_scope| |
SyslogEvent | spt_syslog_event | id|created|quick_key|event_level|classname|line_number|message|thread|server|username|stacktrace| |
TaskResult | spt_task_result | id|created|modified|owner|assigned_scope|assigned_scope_path|stack|attributes|launcher|host|launched|progress|percent_complete|type|messages|completed|expiration|verified|name|definition|schedule|pending_signoffs|signoff|report|target_class|target_id|target_name|task_terminated|partitioned|live|completion_status|run_length|run_length_average|run_length_deviation| |
Alert | spt_alert | id|created|modified|extended1|attributes|alert_date|native_id|target_id|target_type|target_display_name|last_processed|display_name|name|type|source| |
Note : Above are the Objects that we are supporting with the same Table Names and Attribute Lists in same sequential order.
Using SYNONYM for querying Table with DBName included
Incase tables are stored in the form of “<dbname>.<tablename>“ , then we can use synonyms since sensor only queries the <tablename> and if tables are stored in format <dbname>.<tablename> - then log collection will break.
Apply below synonym syntax for above mentioned format and replace <dbname> with Database Name where tables are created.
| Code Block |
|---|
CREATE SYNONYM spt_audit_event FOR <dbname>.spt_audit_event
CREATE SYNONYM spt_syslog_event FOR <dbname>.spt_syslog_event
CREATE SYNONYM spt_task_result FOR <dbname>.spt_task_result
CREATE SYNONYM spt_alert FOR <dbname>.spt_alert |
LCP Configuration parameters
Table 1-2: The Sailpoint IdentityIQ Event Collector (3983 – DB) properties to be configured by MDR are shown in table.
Property | Default Value | Description |
|---|---|---|
JDBC Drivers Directory |
|
|
DatabaseURL | jdbc:jtds:sqlserver://<server>:1433/<databasename> |
|
DatabaseUserName | <username> | Read-only database user account name |
DatabasePassword | <password> | Password for the database user account name |
DB Query Parameters |
|
|