# Dataset Management

Dataset Management lets you review the object types a source collects and control how the source aggregates those objects into SailPoint. Use Dataset Management to view and manage resource attributes, datasets and their resources, enable dataset aggregation schedules, perform manual aggregation, and view aggregation history.

> [!NOTE]
>
> Datasets are also available in SailPoint Agentic Fabric. Contact your Customer Success team and refer to [SailPoint Agentic Fabric](<https://documentation.sailpoint.com/saas/help/agentic_fabric/index.html>) for more information.

For more information, refer to [Managing Datasets and Resources](<https://documentation.sailpoint.com/saas/help/sources/datasets.html>) for datasets, resources, owner correlation, and aggregation.

## Datasets

A *dataset* is a named group of one or more related resources that the source aggregates together.

When aggregation runs for a dataset, the source collects all resources in that dataset from the managed system in one aggregation job. Activate or deactivate aggregation at the dataset level, not for individual resources.

> [!NOTE]
>
> Each resource belongs to exactly one dataset for that source. The source defines which resources belong to each dataset. You can enable aggregation and review associated resources, but you cannot create or delete datasets or move resources between them.

### Dataset Aggregation

Configure aggregation on the **Dataset Aggregations** tab for each dataset. Configure each dataset separately. During aggregation, your owner correlation rules are automatically applied to link machine identities to their human owners. For more information, refer to [Configuring Dataset Aggregations](<https://documentation.sailpoint.com/saas/help/sources/datasets.html#configuring-dataset-aggregations>).

## Resources

A resource defines an object type from the managed system. It specifies the kind of object, the attributes the source collects, and how the source identifies and displays each object. Resources form the building blocks of the data model.

In the UI, each resource appears under **Dataset Management** \> **Resources** with its schema. A resource does not run aggregation by itself. The dataset that owns the resource collects it during aggregation.

For more information, refer to [Managing Resources](<https://documentation.sailpoint.com/saas/help/sources/datasets.html#managing-resources>).

### Owner Correlation

Configure owner correlation on each resource to link aggregated objects to human owners. If you do not configure owner correlation, or if the mapping produces no match, an owner is not assigned. For more information, refer to [Configuring Owner Correlation](<https://documentation.sailpoint.com/saas/help/sources/datasets.html#configuring-owner-correlation>).

## Supported Datasets

Go to **Dataset Management \> Datasets** on your GitHub source to view the datasets the connector aggregates. Select a dataset to review its associated resources and configure aggregation.

> [!NOTE]
>
> Configure aggregation for each dataset separately. For more information, refer to [Dataset Aggregation](<https://documentation.sailpoint.com/saas/help/sources/datasets.html#configuring-dataset-aggregations>).

| Dataset Name | Associated Resources | Dataset ID |
| --- | --- | --- |
| GitHub App Installations | GitHub App Installations | `github:app-installations` |
| GitHub Classic Personal Access Tokens | GitHub Classic Personal Access Token | `github:classic-pat` |
| GitHub Copilot | GitHub Copilot | `github:copilot` |
| GitHub Fine-Grained Tokens | GitHub Fine-Grained Token | `github:fine-grained-tokens` |
| GitHub Environment Secrets | GitHub Environment Secret | `github:environment-secret` |
| GitHub Workflows | GitHub Workflow, GitHub Action Run | `github:workflow`, `github:action` |

## Supported Resources

A resource represents a type of object the connector collects from GitHub, such as fine-grained tokens, app installations, workflows, actions, or environment secrets. Each resource defines the attributes the connector collects for that object type and how SailPoint displays each object.

For more information, refer to [Managing Resources](<https://documentation.sailpoint.com/saas/help/sources/datasets.html#managing-resources>).

> [!NOTE]
>
> When you enable dataset aggregation for a selected dataset, all resources in that dataset are collected at once. Activate or deactivate aggregation at the dataset level, not for individual resources.

Go to **Dataset Management** \> **Resources** on your GitHub source to view each object type the connector aggregates. Select a resource to review its schema on the **Schema** tab.

> [!NOTE]
>
> You need a valid SailPoint Entro license to view these resources in SailPoint:
>
> - GitHub Fine-Grained Token (Entro)
> - GitHub Classic Personal Access Token
> - GitHub Copilot Seat

| Resource Name | Resource Type | Resource ID |
| --- | --- | --- |
| GitHub Fine-Grained Token | Credential | `github:fine-grained-token` |
| GitHub App Installation | Account | `github:app-installation` |
| GitHub Workflow | Application | `github:workflow` |
| GitHub Action Run | Application | `github:action` |
| GitHub Environment Secret | Credential | `github:environment-secret` |
| GitHub Fine-Grained Token (Entro) | Credential | `github:entro-fine-grained-token` |
| GitHub Classic Personal Access Token | Credential | `github:classic-pat` |
| GitHub Copilot | Agent | `github:copilot` |
| GitHub Copilot Seat | Agent | `github:copilot-seat` |

## GitHub Fine-Grained Token Attributes

Schema attributes for the GitHub Fine-Grained Token resource.

| Attribute | Type | Description |
| --- | --- | --- |
| id | string | Unique identifier of the fine-grained personal access token (PAT). |
| name | string | Display name of the token. |
| owner | string | GitHub login of the user who owns the fine-grained personal access token. |
| access\_granted\_at | string | Timestamp indicating when organization access was granted to the token. |
| expired | string | Indicates whether the token has expired. |
| expires\_at | string | Expiration timestamp of the token. |
| last\_used\_at | string | Timestamp indicating when the token was last used. |
| permissions\_organization | string list | List of organization-level permissions retrieved from permissions.organization, represented as scope:access string pairs. |
| permissions\_repository | string list | List of repository-level permissions retrieved from permissions.repository, represented as scope:access string pairs. |
| repository\_full\_name | string | Full repository name in owner/repo format associated with the workflow. |
| repository\_selection | string | Repository access scope of the token, such as none, all, or a subset of repositories. |

## GitHub App Installation Attributes

Schema attributes for the GitHub App Installation resource.

| Attribute | Type | Description |
| --- | --- | --- |
| id | string | Unique identifier of the GitHub App installation. |
| name | string | Application slug associated with the installation. |
| app\_id | string | GitHub App id. |
| owner | string list | Human GitHub logins associated with the installation. |
| permissions | string list | List of installation permissions retrieved from installation. permissions, represented as scope:access string pairs. |
| repository\_selection | string | Repository access scope for the installation, either all or selected. |
| target\_type | string | Type of installation target, such as Organization or User. |
| created\_at | string | Timestamp indicating when the GitHub App installation was created. |
| updated\_at | string | Timestamp indicating when the GitHub App installation was last updated. |
| suspended | string | Indicates whether the installation is suspended. |
| suspended\_at | string | Timestamp indicating when the installation was suspended, if applicable. |

## GitHub Workflow Attributes

Schema attributes for the GitHub Workflow resource.

| Attribute | Type | Description |
| --- | --- | --- |
| id | string | Unique workflow identifier. |
| node\_id | string | Global GitHub node identifier for the workflow definition. |
| name | string | Name of the workflow definition retrieved from the GitHub API. |
| owner | string list | Human GitHub logins accountable for the workflow file. |
| repository | string | Repository name only. |
| repository\_full\_name | string | Full repository name in owner/repo format associated with the workflow. |
| workflow\_id | string | Numeric GitHub workflow identifier. |
| path | string | File path of the workflow definition within the repository. |
| state | string | Current workflow state, such as active, deleted, disabled\_fork, or disabled\_inactivity. |
| html\_url | string | URL of the workflow definition on GitHub. |
| created\_at | string | Timestamp indicating when the workflow definition was created. |
| updated\_at | string | Timestamp indicating when the environment was last updated. |

## GitHub Action Run Attributes

Schema attributes for the GitHub Action Run resource.

| Attribute | Type | Description |
| --- | --- | --- |
| id | string | Unique workflow run identifier. |
| name | string | Title of the workflow run. |
| node\_id | string | Global GitHub node identifier for the workflow run. |
| status | string | Current status of the workflow run. |
| head\_branch | string | Branch associated with the workflow run. |
| actor | string | Login username of the user who created the workflow run. |
| triggering\_actor | string | Login username of the user who triggered the workflow run. |
| event | string | GitHub event that triggered the workflow run, such as push or pull\_request. |
| run\_number | string | Sequential counter for the workflow within the repository. |
| workflow\_id | string | Unique identifier of the parent workflow. |
| workflow | string | Parent workflow label used for correlation. |
| check\_suite\_id | string | Unique identifier of the check suite associated with the workflow run. |
| repository | string | Full repository name in owner/repo format associated with the workflow run. |
| owner | string list | Human GitHub logins accountable for the workflow run. |
| created\_at | string | Timestamp indicating when the workflow run was created. |
| updated\_at | string | Timestamp indicating when the workflow run was last updated. |

## GitHub Environment Secret Attributes

Schema attributes for the GitHub Environment Secret resource.

| Attribute | Type | Description |
| --- | --- | --- |
| id | string | Stable secret identifier in the format {owner}/{repo}/environment/{env}/secret/{name}. |
| name | string | Name of the secret. |
| scope | string | Scope of the secret. |
| organization | string | Source organization in which the secret is configured. |
| repository | string | Full repository name in owner/repo format associated with the secret. |
| environment | string | Environment name owning the secret |
| owner | string | Human GitHub logins accountable for this env-scoped secret - inherited from the parent environment's owner (env required reviewers; else repo admins; else organization owners). Bots filtered. |
| created\_at | string | Timestamp indicating when the secret was created. |
| updated\_at | string | Timestamp indicating when the environment was last updated. |

## GitHub Fine-Grained Token (Entro) Attributes

Schema attributes for the GitHub Fine-Grained Token (Entro) resource.

| Attribute | Type | Description |
| --- | --- | --- |
| id | string | Entro object id for the credential (e.g. TKN-44868). Optional in push attributes; identity is set from this field on the envelope. |
| name | string | Display name for aggregation (same as token.name when present). |
| source | object | Source account context from Entro. |
| identity | object | Linked identity metadata from Entro. |
| token | object | Core fine-grained PAT metadata from Entro. |
| owners | object | Human owners accountable for the token. |
| lifecycle | object | Token lifecycle timestamps from Entro. |
| permissions | object | Fine-grained permissions granted to the token. |
| tags | string list | Entro tags (e.g. organization slug). |
| riskSeverity | string | Entro risk severity (e.g. LOW, MEDIUM, HIGH). |
| complianceBreach | string list | Compliance rule identifiers triggered for this token. |
| exposed | boolean | Whether Entro detected credential exposure. |
| suspiciousActivity | boolean | Whether suspicious activity was flagged. |
| lastUsedService | string | Last service that used the token (e.g. Github). |
| extraData | object | Supplemental GitHub context from Entro. |
| ownerEmail | string | Primary human owner email for ownership correlation. |

## GitHub Classic Personal Access Token Attributes

Schema attributes for the GitHub Classic Personal Access Token resource.

| Attribute | Type | Description |
| --- | --- | --- |
| id | string | Entro object id for the credential (e.g. TKN-16812). Optional in push attributes; identity is set from this field on the envelope. |
| name | string | Display name for aggregation (same as token.name when present). |
| source | object | Source account context from Entro. |
| identity | object | Linked identity metadata from Entro. |
| token | object | Core classic PAT metadata from Entro. |
| owners | object list | Human owners accountable for the token. |
| lifecycle | object | Token lifecycle timestamps from Entro. |
| permissions | object list | OAuth scopes granted to the classic PAT. |
| tags | string list | Entro classification tags (e.g. OAuth access token, integration name). |
| riskSeverity | string | Entro risk severity (e.g. LOW, MEDIUM, HIGH). |
| complianceBreach | string list | Compliance rule identifiers triggered for this token. |
| exposed | boolean | Whether Entro detected credential exposure. |
| suspiciousActivity | boolean | Whether suspicious activity was flagged. |
| lastUsedService | string | Last service that used the token (e.g. Github). |
| extraData | object | Supplemental GitHub context from Entro. |
| ownerEmail | string | Primary human owner email for ownership correlation. |

## GitHub Copilot Attributes

Schema attributes for the GitHub Copilot resource.

| Attribute | Type | Description |
| --- | --- | --- |
| id | string | Stable seat or assignment identifier (UUID). Optional in push attributes; identity is set from this field on the envelope. |
| name | string | Display name for the Copilot seat (e.g. github copilot). |
| rawName | string | Raw client or editor identifier from the source (e.g. unknown/GitHubCopilotChat/0.37.9). |
| agentType | string | Agent type label from discovery (e.g. GitHub Copilot Seat). |
| classification | string | Prettified classification (e.g. Third-party, Homegrown). |
| detectionMethod | string | How the agent was detected (e.g. GitHub Copilot Seat Assignment). |
| sourceAccount | string | GitHub organization or account context for the seat. |
| integrationType | string | Integration type (e.g. GITHUB). |
| sourceUrl | string | Deep link to the source when available; empty when null in export. |
| environment | string | Environment or organization slug from the source account. |
| tags | string | Tags from discovery. |
| insights | string | Human-readable insight strings from policy evaluation. |
| owner | object | Human owner associated with the Copilot seat. |
| lastSeen | string | ISO-8601 timestamp of last observed Copilot activity. |
| riskBand | string | Risk severity band (e.g. UNKNOWN, LOW, MEDIUM, HIGH, CRITICAL). |
| organizationName | string | GitHub organization name for the Copilot plan. |
| planType | string | Copilot plan type (e.g. BUSINESS, ENTERPRISE). |
| editor | string | Editor or client identifier last used with Copilot. |
| lastAuthenticatedAt | string | ISO-8601 timestamp of last authentication for the seat. |

## GitHub Copilot Seat Attributes

Schema attributes for the GitHub Copilot Seat resource.

| Attribute | Type | Description |
| --- | --- | --- |
| id | string | Stable seat or assignment identifier (UUID). Optional in push attributes; identity is set from this field on the envelope. |
| name | string | Display name for the Copilot seat (e.g. github copilot). |
| rawName | string | Raw client or editor identifier from the source (e.g. unknown/GitHubCopilotChat/0.37.9). |
| agentType | string | Agent type label from discovery (e.g. GitHub Copilot Seat). |
| classification | string | Prettified classification (e.g. Third-party, Homegrown). |
| detectionMethod | string | How the agent was detected (e.g. GitHub Copilot Seat Assignment). |
| sourceAccount | string | GitHub organization or account context for the seat. |
| integrationType | string | Integration type (e.g. GITHUB). |
| sourceUrl | string | Deep link to the source when available; empty when null in export. |
| environment | string | Environment or organization slug from the source account. |
| tags | string | Tags from discovery. |
| insights | string | Human-readable insight strings from policy evaluation. |
| owner | object | Human owner associated with the Copilot seat. |
| lastSeen | string | ISO-8601 timestamp of last observed Copilot activity. |
| riskBand | string | Risk severity band (e.g. UNKNOWN, LOW, MEDIUM, HIGH, CRITICAL). |
| organizationName | string | GitHub organization name for the Copilot plan. |
| planType | string | Copilot plan type (e.g. BUSINESS, ENTERPRISE). |
| editor | string | Editor or client identifier last used with Copilot. |
| lastAuthenticatedAt | string | ISO-8601 timestamp of last authentication for the seat. |
| ownerEmail | string | Primary human owner email for ownership correlation. |