Accenture MDR Quick Start Guide for Sailpoint IdentityIQ

This quick start guide will help Accenture MDR customers configure Sailpoint IdentityIQ to allow log collection from the Log Collection Platform (LCP).

The document includes the following topics:

1 Supported Versions
2 Port Requirements
3 Configuring Sailpoint IdentityIQ
4 LCP Configuration parameters

Supported Versions

A list of supported versions is available in the Accenture MDR Supported Products List document (Accenture_MDR_Supported_Products_List.xlsx) which can be found in Accenture MDR Portal.

Port Requirements

Table 1-1: Port requirements for LCP communication.

Source	Destination	Port	Description
LCP	Database	TCP/1433	Default port and protocol

Configuring Sailpoint IdentityIQ

Device Configuration Steps :

Sailpoint IIQ deployment and installation requires an Application Server in which you can create a Web Appllication and a new database and modify its schema in a database server instance. Ensure that you have the required authorization credentials before you begin the installation and deployment process.

Pre-Requisites :

IdentityIQ : We are supporting IIQ web Application on any Application server under Sailpoint Application server Supported list. [refer Installation Guide for supported list - attached]

Database : We are currently supporting Azure SQL Database and MS-SQL Database since logs are validated from these DB environments.

Create User for Accessing Database :

CREATE USER [identityiq] FOR LOGIN [identityiq] WITH DEFAULT_SCHEMA=[identityiq]
GO
EXEC sp_addrolemember '<read_only_user>', 'identityiq';
GO
GRANT SELECT TO identityiq
GO
CREATE SCHEMA identityiq AUTHORIZATION identityiq
GO

Following are the Object and Attribute list that we are currently supporting :

Objects	Table Name	Attributes

Objects	Table Name	Attributes
AuditEvent	spt_audit_event	id\|created\|modified\|assigned_scope_path\|interface\|source\|action\|target\|application\|account_name\|instance\|attribute_name\|attribute_value\|tracking_id\|attributes\|string1\|string2\|string3\|string4\|server_host\|client_host\|owner\|assigned_scope\|
SyslogEvent	spt_syslog_event	id\|created\|quick_key\|event_level\|classname\|line_number\|message\|thread\|server\|username\|stacktrace\|
TaskResult	spt_task_result	id\|created\|modified\|owner\|assigned_scope\|assigned_scope_path\|stack\|attributes\|launcher\|host\|launched\|progress\|percent_complete\|type\|messages\|completed\|expiration\|verified\|name\|definition\|schedule\|pending_signoffs\|signoff\|report\|target_class\|target_id\|target_name\|task_terminated\|partitioned\|live\|completion_status\|run_length\|run_length_average\|run_length_deviation\|
Alert	spt_alert	id\|created\|modified\|extended1\|attributes\|alert_date\|native_id\|target_id\|target_type\|target_display_name\|last_processed\|display_name\|name\|type\|source\|

Note : Above are the Objects that we are supporting with the same Table Names and Attribute Lists in same sequential order.

Using SYNONYM for querying Table with DBName included

Incase tables are stored in the form of “<dbname>.<tablename>“ , then we can use synonyms since sensor only queries the <tablename> and if tables are stored in format <dbname>.<tablename> - then log collection will break.

Apply below synonym syntax for above mentioned format and replace <dbname> with Database Name where tables are created.

CREATE SYNONYM spt_audit_event FOR <dbname>.spt_audit_event
CREATE SYNONYM spt_syslog_event FOR <dbname>.spt_syslog_event
CREATE SYNONYM spt_task_result FOR <dbname>.spt_task_result
CREATE SYNONYM spt_alert FOR <dbname>.spt_alert

LCP Configuration parameters

Table 1-2: The Sailpoint IdentityIQ Event Collector (3983 – DB) properties to be configured by MDR are shown in table.

Property	Default Value	Description

Property	Default Value	Description
JDBC Drivers Directory
DatabaseURL	jdbc:jtds:sqlserver://<server>:1433/<databasename>
DatabaseUserName	<username>	Read-only database user account name
DatabasePassword	<password>	Password for the database user account name
DB Query Parameters