...
Table 1-1: Port requirements for LCP communication.
Source | Destination | Port | Description |
LCP | Database | TCP/1433 | Default port and protocol |
Configuring Sailpoint IdentityIQ
...
Sailpoint IIQ deployment and installation requires an Application Server in which you can create a Web Application Appllication and a new database and modify its schema in a database server instance. Ensure that you have the required authorization credentials before you begin the installation and deployment process.
Pre-Requisites :
IdentityIQ : We support are supporting IIQ web Application on any Application server under Sailpoint Application server Supported list. [refer Installation Guide for supported list - attached]
...
Database : We are currently only supporting Azure SQL Database Logs as this platform was tested and and MS-SQL Database since logs are validated from Azure SQL these DB environments.
When using Azure SQL, you must first create a login for the identityiq databases before creating new users.
Create User for Accessing Database :
| Code Block |
|---|
CREATE USER [identityiq] FOR LOGIN [identityiq] WITH DEFAULT_SCHEMA=[identityiq]
GO
EXEC sp_addrolemember '<read_only_user>', 'identityiq';
GO
GRANT SELECT TO identityiq
GO
CREATE SCHEMA identityiq AUTHORIZATION identityiq
GO
|
Following are the Object and Attribute list that we are currently supporting :
Objects | Table Name | Attributes |
|---|---|---|
AuditEvent | spt_audit_event | id|created|modified|assigned_scope_path|interface|source|action|target|application|account_name|instance|attribute_name|attribute_value|tracking_id|attributes|string1|string2|string3|string4|server_host|client_host|owner|assigned_scope| |
SyslogEvent | spt_syslog_event | id|created|quick_key|event_level|classname|line_number|message|thread|server|username|stacktrace| |
TaskResult | spt_task_result | id|created|modified|owner|assigned_scope|assigned_scope_path|stack|attributes|launcher|host|launched|progress|percent_complete|type|messages|completed|expiration|verified|name|definition|schedule|pending_signoffs|signoff|report|target_class|target_id|target_name|task_terminated|partitioned|live|completion_status|run_length|run_length_average|run_length_deviation| |
Alert | spt_alert | id|created|modified|extended1|attributes|alert_date|native_id|target_id|target_type|target_display_name|last_processed|display_name|name|type|source| |
...
Note : Above are the Objects that we are supporting with the same Table Names and Attribute Lists in same sequential order.
Using SYNONYM for querying Table with DBName included
Incase tables are stored in the form of “<dbname>.<tablename>“ , then we can use synonyms since sensor only queries the <tablename> and if tables are stored in format <dbname>.<tablename> - then log collection will break.
Apply below synonym syntax for above mentioned format and replace <dbname> with Database Name where tables are created.
| Code Block |
|---|
CREATE SYNONYM spt_audit_event FOR <dbname>.spt_audit_event
CREATE SYNONYM spt_syslog_event FOR <dbname>.spt_syslog_event
CREATE SYNONYM spt_task_result FOR <dbname>.spt_task_result
CREATE SYNONYM spt_alert FOR <dbname>.spt_alert |
LCP Configuration parameters
Table 1-2: The Sailpoint IdentityIQ Event Collector (3983 – DB) properties to be configured by MDR are shown in table.
Property | Default Value | Description |
|---|---|---|
JDBC Drivers Directory |
|
|
DatabaseURL | jdbc:jtds:sqlserver://<server>:1433/<databasename> |
|
DatabaseUserName | <username> | Read-only database user account name |
DatabasePassword | <password> | Password for the database user account name |
DB Query Parameters |
|
|