Created a CCF Connector for SailPoint IdentityNow Function App. - #14978
Open
Dhara Shah (dhara-shah-sp) wants to merge 1 commit into
Open
Created a CCF Connector for SailPoint IdentityNow Function App.#14978Dhara Shah (dhara-shah-sp) wants to merge 1 commit into
Dhara Shah (dhara-shah-sp) wants to merge 1 commit into
Conversation
v-atulyadav
added
Solution
Contributor
There was a problem hiding this comment.
Pull request overview
Note
Copilot was unable to run its full agentic suite in this review.
Adds/updates artifacts for a Codeless Connector Framework (CCF) connector to ingest SailPoint Identity Security Cloud (IdentityNow) Search API “events” into Microsoft Sentinel.
Changes:
- Added a new Log Analytics table schema for
SailPointISC_Events_CL. - Updated RestApiPoller config to use new connector identifiers, stream, and polling parameters.
- Updated connector definition UI strings and setup instructions for Identity Security Cloud.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 6 comments.
| File | Description |
|---|---|
| Solutions/SailPointIdentityNow/Data Connectors/SearchEvent_CCF/table_SailPointISC_Events.json | Introduces the custom table schema for ingested events. |
| Solutions/SailPointIdentityNow/Data Connectors/SearchEvent_CCF/SailPointIdentityNow_PollerConfig.json | Re-points the poller to the new connector/table identifiers and adjusts polling/limit settings. |
| Solutions/SailPointIdentityNow/Data Connectors/SearchEvent_CCF/SailPointIdentityNow_DCR.json | Replaces prior DCR content with a table resource definition (likely unintended). |
| Solutions/SailPointIdentityNow/Data Connectors/SearchEvent_CCF/SailPointIdentityNow_ConnectorDefinition.json | Updates connector name, table reference, UI text, and setup steps. |
Suppressed comments (2)
Solutions/SailPointIdentityNow/Data Connectors/SearchEvent_CCF/SailPointIdentityNow_DCR.json:1
- This file is named
*_DCR.jsonbut now defines a Log Analytics table resource (Microsoft.OperationalInsights/workspaces/tables) and no longer defines a Data Collection Rule (Microsoft.Insights/dataCollectionRules) withstreamDeclarations/dataFlows. SinceSailPointIdentityNow_PollerConfig.jsonstill referencesdcrConfig(DCE + DCR immutable ID), removing the DCR resource is likely to break deployment/ingestion. Restore this file to an actual DCR resource (including stream declarations and transform KQL), and keep the table schema intable_SailPointISC_Events.json(or rename this file if the intent is to replace the DCR entirely).
Solutions/SailPointIdentityNow/Data Connectors/SearchEvent_CCF/SailPointIdentityNow_DCR.json:1 - This file is named
*_DCR.jsonbut now defines a Log Analytics table resource (Microsoft.OperationalInsights/workspaces/tables) and no longer defines a Data Collection Rule (Microsoft.Insights/dataCollectionRules) withstreamDeclarations/dataFlows. SinceSailPointIdentityNow_PollerConfig.jsonstill referencesdcrConfig(DCE + DCR immutable ID), removing the DCR resource is likely to break deployment/ingestion. Restore this file to an actual DCR resource (including stream declarations and transform KQL), and keep the table schema intable_SailPointISC_Events.json(or rename this file if the intent is to replace the DCR entirely).
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| "type": "Microsoft.SecurityInsights/dataConnectors", | ||
| "apiVersion": "2024-09-01", | ||
| "name": "[[concat('parameters('workspace')', '/Microsoft.SecurityInsights/','SailPointIDN_EventsV2' , uniqueString(parameters('tenantId')) )]", | ||
| "name": "[[concat('parameters('workspace')', '/Microsoft.SecurityInsights/','SailPointISC_Events' , uniqueString(parameters('tenantId')) )]", |
| "descriptionMarkdown": "The [SailPoint](https://www.sailpoint.com/) IdentityNow data connector provides the capability to ingest [SailPoint IdentityNow] search events into Microsoft Sentinel through the REST API. The connector provides customers the ability to extract audit information from their IdentityNow tenant. It supports connecting multiple SailPoint IdentityNow tenants simultaneously - each identified by its unique Tenant ID and domain - making it easy to monitor multiple environments (production, demo, partner) from a single Microsoft Sentinel workspace. Refer to [SailPoint Developer Documentation](https://developer.sailpoint.com/docs/api/authentication/) for API authentication details.", | ||
| "graphQueriesTableName": "SailPointIDN_EventsV2", | ||
| "descriptionMarkdown": "The [SailPoint](https://www.sailpoint.com/) Identity Security Cloud data connector provides the capability to ingest search events into Microsoft Sentinel through the REST API. The connector provides customers the ability to extract audit information from their Identity Security Cloud tenant. Refer to [SailPoint Developer Documentation](https://developer.sailpoint.com/docs/api/authentication/) for API authentication details.", | ||
| "graphQueriesTableName": "SailPointISC_Events", |
| { | ||
| "metricName": "Total events received", | ||
| "legend": "SailPoint IdentityNow Events", | ||
| "legend": "SailPoint identity Security Cloud Events", |
| "name": "SailPoint IdentityNow OAuth2 Client Credentials", | ||
| "description": "An OAuth2 **Client ID** and **Client Secret** with the `sp:search:read` scope are required. Create an API client in your SailPoint admin console under **Admin > Global > Security Settings > API Management**. [See the documentation](https://developer.sailpoint.com/docs/api/authentication/) for step-by-step instructions." | ||
| "name": "SailPoint Identity Security Cloud OAuth2 Client Credentials", | ||
| "description": "An OAuth2 **Client ID** and **Client Secret** with the `sp:search:read` scope are required. Create a Personal Access Token(PAT) in your SailPoint Tenant. Kindly refer to documentation on our Compass Community for step-by-step instructions." |
Comment on lines
+20
to
+21
| "queryWindowInMin": 5, | ||
| "queryWindowDelayInMin": 60, |
| "Accept": "application/json" | ||
| }, | ||
| "queryParametersTemplate": "{\r\n \"indices\": [\"events\"],\r\n \"query\": {\r\n \"query\": \"created:[{_QueryWindowStartTime} TO {_QueryWindowEndTime}]\"\r\n },\r\n \"sort\": [\"created\"],\r\n \"limit\": 1000\r\n}" | ||
| "queryParametersTemplate": "{\r\n \"indices\": [\"events\"],\r\n \"query\": {\r\n \"query\": \"created:[{_QueryWindowStartTime} TO {_QueryWindowEndTime}]\"\r\n },\r\n \"sort\": [\"created\"],\r\n \"limit\": 10000\r\n}" |
Contributor
|
Hi Dhara Shah (@dhara-shah-sp) Kindly review the Copilot comments and mark them as resolved if they have been addressed. Please package the solution using V3 tool Kindly attach a screenshot showing the CCF connector in a connected state for testing validation and reference. |
Contributor
|
Hi Dhara Shah (@dhara-shah-sp) Kindly review above comments. Thanks! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Required items, please complete
Change(s):
Reason for Change(s):
Version Updated:
Testing Completed:
Checked that the validations are passing and have addressed any issues that are present: