Dataset Management
Dataset Management lets you review the object types a source collects and control how the source aggregates those objects into SailPoint. Use Dataset Management to view and manage resource attributes, datasets and their resources, enable dataset aggregation schedules, perform manual aggregation, and view aggregation history.
Note
Datasets are also available in SailPoint Agentic Fabric. Contact your Customer Success team and refer to SailPoint Agentic Fabric for more information.
For more information, refer to Managing Datasets and Resources for datasets, resources, owner correlation, and aggregation.
Datasets
A dataset is a named group of one or more related resources that the source aggregates together.
When aggregation runs for a dataset, the source collects all resources in that dataset from the managed system in one aggregation job. Activate or deactivate aggregation at the dataset level, not for individual resources.
Note
Each resource belongs to exactly one dataset for that source. The source defines which resources belong to each dataset. You can enable aggregation and review associated resources, but you cannot create or delete datasets or move resources between them.
Dataset Aggregation
Configure aggregation on the Dataset Aggregations tab for each dataset. Configure each dataset separately. During aggregation, your owner correlation rules are automatically applied to link machine identities to their human owners. For more information, refer to Configuring Dataset Aggregations.
Resources
A resource defines an object type from the managed system. It specifies the kind of object, the attributes the source collects, and how the source identifies and displays each object. Resources form the building blocks of the data model.
In the UI, each resource appears under Dataset Management > Resources with its schema. A resource does not run aggregation by itself. The dataset that owns the resource collects it during aggregation.
For more information, refer to Managing Resources.
Owner Correlation
Configure owner correlation on each resource to link aggregated objects to human owners. If you do not configure owner correlation, or if the mapping produces no match, an owner is not assigned. For more information, refer to Configuring Owner Correlation.
Supported Datasets
Go to Dataset Management > Datasets on your HashiCorp Vault Integration (Cloud) source to view the datasets the connector aggregates. Select a dataset to review its associated resources and configure aggregation.
Note
Configure aggregation for each dataset separately. For more information, refer to Dataset Aggregation.
| Dataset name | Associated resources | Description | Aggregation schedule |
|---|---|---|---|
| Vault Accounts | Vault Agent and Machine, Vault Service Account | AppRole and Kubernetes authentication roles resolved to Vault identity entities, including owners, policies, and groups. Emits agent-machine rows for AppRole roles and service-account rows for Kubernetes roles. | Disabled |
| Vault Secrets | Vault Secret | KV v2 secret metadata. The connector does not collect secret payloads. Ownership is resolved from the writing entity. | Disabled |
| Vault API Keys | Vault API Key | Dynamic cloud secret-engine roles (AWS, Azure, and GCP) that issue credentials. Ownership is resolved from the granting policy and entity. | Disabled |
| Vault Tokens / PATs | Vault Token / PAT | Token accessor metadata (never token strings): policies, TTL/lifecycle, owner tags. Sourced from LIST auth/token/accessors + POST auth/token/lookup-accessor. | Disabled |
The aggregation schedule is disabled until you enable it. Set the schedule in Dataset Management > Datasets.
For resource details, refer to Supported Resources.
Supported Resources
A resource represents a type of object the connector collects from HashiCorp Vault. Each resource defines the attributes collected for that object type and how each object appears in SailPoint.
For more information, refer to Managing Resources.
Note
When you enable dataset aggregation for a selected dataset, all resources in that dataset are collected at once. Activate or deactivate aggregation at the dataset level, not for individual resources.
Go to Dataset Management > Resources on your HashiCorp Vault Integration (Cloud) source to view each object type the connector aggregates. Select a resource to review its schema on the Schema tab.
| Resource name | Resource type | Resource ID |
|---|---|---|
| Vault Secret | Credential | hashicorp-vault:secret |
| Vault API Key | Credential | hashicorp-vault:api-key |
| Vault Agent and Machine | Account | hashicorp-vault:agent-machine |
| Vault Service Account | Account | hashicorp-vault:service-account |
| Vault Token / PAT | Credential | hashicorp-vault:token |
To review attribute names and descriptions after you create the source:
- Go to Admin > Connections > Sources.
- Open your HashiCorp Vault Integration (Cloud) source.
- Select Dataset Management > Resources.
- Select a resource.
- Open the Schema tab. Connector-specific attributes are read-only. You can add, edit, or delete custom attributes.
Vault Secret
Resource ID: hashicorp-vault:secret
Type: Credential
Associated dataset: Vault Secrets
Connector-specific attributes are read-only. Custom attributes can be added, edited, or deleted from this schema.
| Attribute | Type | Entitlement | Multi-Valued | Description |
|---|---|---|---|---|
casRequired |
boolean | No | No | Indicates whether the secret requires a Check-And-Set (CAS) parameter on writes. |
identity |
string | No | No | The stable non-human identity key for the Vault KV v2 secret. This attribute is the Resource ID. |
mountPath |
string | No | No | The KV v2 mount path with a trailing slash, such as secret/. |
name |
string | No | No | The final path segment, or leaf name, of the secret within its mount. |
namespace |
string | No | No | The Vault namespace ID where this secret lives. |
orphaned_nhi |
boolean | No | No | Indicates whether Vault entity metadata identifies a human owner for this secret. |
policies |
string | No | Yes | The Vault policies attached to the entity that last wrote this secret. |
secretPath |
string | No | No | The full path of the secret within its KV v2 mount, such as data/secret/my-app. This attribute is the Resource Name. |
Vault API Key
Resource ID: hashicorp-vault:api-key
Type: Credential
Associated dataset: Vault API Keys
Connector-specific attributes are read-only. Custom attributes can be added, edited, or deleted from this schema.
| Attribute | Type | Entitlement | Multi-Valued | Description |
|---|---|---|---|---|
engineType |
string | No | No | The secret-engine type, either aws, gcp, or azure. |
identity |
string | No | No | The stable non-human identity key for the dynamic secret-engine role. This attribute is the Resource ID. |
keyType |
string | No | No | The credential key type issued by the role, such as iam_user or service_account. |
mountPath |
string | No | No | The secret-engine mount path with a trailing slash, such as aws/. |
namespace |
string | No | No | The Vault namespace ID where this role lives. |
orphaned_nhi |
boolean | No | No | Indicates whether Vault entity metadata identifies a human owner for this role. |
roleName |
string | No | No | The name of the dynamic secret-engine role that issues cloud credentials. This attribute is the Resource Name. |
Vault Agent and Machine
Resource ID: hashicorp-vault:agent-machine
Type: Account
Associated dataset: Vault Accounts
Connector-specific attributes are read-only. Custom attributes can be added, edited, or deleted from this schema.
| Attribute | Type | Entitlement | Multi-Valued | Description |
|---|---|---|---|---|
classification |
string | No | No | Non-human classification, always 'machine'. |
createdAt |
string | No | No | The date and time the owning entity was created, in ISO 8601 format. |
directGroupIds |
string | No | Yes | The IDs of the groups that the owning entity directly belongs to. |
disabled |
boolean | No | No | Indicates whether the owning Vault entity is disabled. The value is false for active entities and unbound roles. |
entityId |
string | No | No | The ID of the owning Vault identity entity. This value is empty for unbound roles. |
entityName |
string | No | No | The display name of the owning Vault identity entity. This value is empty for unbound roles. |
groupIds |
string | No | Yes | The IDs of the direct and inherited groups that the owning entity belongs to. |
identity |
string | No | No | The stable non-human identity key in {mount accessor}:{roleName} format. The namespace is intentionally omitted. This attribute is the Resource ID. |
inheritedGroupIds |
string | No | Yes | The IDs of the groups that the owning entity inherits through other group memberships. |
lastModifiedDate |
string | No | No | The date and time the owning entity was last updated, in ISO 8601 format. |
mountAccessor |
string | No | No | The globally unique mount accessor issued by Vault for the AppRole authentication method, such as auth_approle_1bc68a20. |
mountPath |
string | No | No | The AppRole authentication method mount path with a trailing slash, such as approle/. |
mountType |
string | No | No | The mount type, approle. |
namespace |
string | No | No | The Vault namespace ID from the entity. If the entity has no namespace ID, the connector uses the source's configured namespace. |
orphaned_nhi |
boolean | No | No | Indicates whether Vault entity metadata identifies a human owner. |
ownerEmail |
string | No | No | The resolved human owner email from a metadata or custom metadata owner key lookup. |
policies |
string | No | Yes | The Vault policies attached to the owning entity. |
roleName |
string | No | No | The AppRole authentication method role name. This attribute is the Resource Name. |
Vault Service Account
Resource ID: hashicorp-vault:service-account
Type: Account
Associated dataset: Vault Accounts
Connector-specific attributes are read-only. Custom attributes can be added, edited, or deleted from this schema.
| Attribute | Type | Entitlement | Multi-Valued | Description |
|---|---|---|---|---|
classification |
string | No | No | Non-human classification, always 'machine'. |
createdAt |
string | No | No | The date and time the owning entity was created, in ISO 8601 format. |
directGroupIds |
string | No | Yes | The IDs of the groups that the owning entity directly belongs to. |
disabled |
boolean | No | No | Indicates whether the owning Vault entity is disabled. The value is false for active entities and unbound roles. |
entityId |
string | No | No | The ID of the owning Vault identity entity. This value is empty for unbound roles. |
entityName |
string | No | No | The display name of the owning Vault identity entity. This value is empty for unbound roles. |
groupIds |
string | No | Yes | The IDs of the direct and inherited groups that the owning entity belongs to. |
identity |
string | No | No | The stable non-human identity key in {mount accessor}:{roleName} format. The namespace is intentionally omitted. This attribute is the Resource ID. |
inheritedGroupIds |
string | No | Yes | The IDs of the groups that the owning entity inherits through other group memberships. |
lastModifiedDate |
string | No | No | The date and time the owning entity was last updated, in ISO 8601 format. |
mountAccessor |
string | No | No | The globally unique mount accessor issued by Vault for the Kubernetes authentication method. |
mountPath |
string | No | No | The Kubernetes authentication method mount path with a trailing slash, such as kubernetes/. |
mountType |
string | No | No | The mount type, kubernetes. |
namespace |
string | No | No | The Vault namespace ID from the entity. If the entity has no namespace ID, the connector uses the source's configured namespace. |
orphaned_nhi |
boolean | No | No | Indicates whether Vault entity metadata identifies a human owner. |
ownerEmail |
string | No | No | The resolved human owner email from a metadata or custom metadata owner key lookup. |
policies |
string | No | Yes | The Vault policies attached to the owning entity. |
roleName |
string | No | No | The Kubernetes authentication method role name. This attribute is the Resource Name. |
Vault Token / PAT
Resource ID: hashicorp-vault:token
Type: Credential
Associated dataset: Vault Tokens / PATs
Connector-specific attributes are read-only. Custom attributes can be added, edited, or deleted from this schema.
| Attribute | Type | Entitlement | Multi-Valued | Description |
|---|---|---|---|---|
accessor |
string | No | No | The globally unique token accessor issued by Vault. The raw token value is never surfaced. |
createdAt |
string | No | No | The date and time the token was created, in ISO 8601 format. |
creationTtl |
int | No | No | The initial time-to-live assigned when the token was created, in seconds. |
deleted |
boolean | No | No | Indicates whether this row represents a tombstone. Always false for active tokens. |
entityId |
string | No | No | The ID of the Vault identity entity that owns this token. |
expireTime |
string | No | No | The date and time the token expires, in ISO 8601 format. |
explicitMaxTtl |
int | No | No | The explicit maximum time-to-live for the token, in seconds. A value of zero means no explicit cap. |
identity |
string | No | No | The stable non-human identity key for the Vault token. This attribute is the Resource ID. |
issueTime |
string | No | No | The date and time the token was issued, in ISO 8601 format. |
namespace |
string | No | No | The Vault namespace ID where this token lives. |
numUses |
int | No | No | The remaining number of uses for the token. A value of zero means unlimited uses. |
orphan |
boolean | No | No | Indicates whether the token has no parent and is therefore not revoked when its parent is revoked. |
orphaned_nhi |
boolean | No | No | Indicates whether the token metadata identifies a human owner. |
ownerEmail |
string | No | No | The resolved human owner email from the token's meta.owner_email field. |
path |
string | No | No | The Vault authentication path where the token was issued, such as auth/token/create. |
policies |
string | No | Yes | The Vault policies attached to the token. |
renewable |
boolean | No | No | Indicates whether the token can be renewed. |
tokenDisplayName |
string | No | No | The display name assigned to the token, such as token-my-app. This attribute is the Resource Name. |
tokenType |
string | No | No | The token type, either service or batch. |
Configuring Owner Metadata
The connector reads the owner_email metadata key to resolve the human owner of each NHI.
Add the owner_email key to the NHI metadata when you create the NHI in Vault. Set its value to the owner's email address.
If the connector cannot find the owner_email key, the NHI is orphaned.
Documentation Feedback
Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.