Dataset Management
Dataset Management lets you review the object types a source collects and control how the source aggregates those objects into SailPoint. Use Dataset Management to view and manage resource attributes, datasets and their resources, enable dataset aggregation schedules, perform manual aggregation, and view aggregation history.
Note
Datasets are also available in SailPoint Agentic Fabric. Contact your Customer Success team and refer to SailPoint Agentic Fabric for more information.
For more information, refer to Managing Datasets and Resources for datasets, resources, owner correlation, and aggregation.
Datasets
A dataset is a named group of one or more related resources that the source aggregates together.
When aggregation runs for a dataset, the source collects all resources in that dataset from the managed system in one aggregation job. Activate or deactivate aggregation at the dataset level, not for individual resources.
Note
Each resource belongs to exactly one dataset for that source. The source defines which resources belong to each dataset. You can enable aggregation and review associated resources, but you cannot create or delete datasets or move resources between them.
Dataset Aggregation
Configure aggregation on the Dataset Aggregations tab for each dataset. Configure each dataset separately. During aggregation, your owner correlation rules are automatically applied to link machine identities to their human owners. For more information, refer to Configuring Dataset Aggregations.
Resources
A resource defines an object type from the managed system. It specifies the kind of object, the attributes the source collects, and how the source identifies and displays each object. Resources form the building blocks of the data model.
In the UI, each resource appears under Dataset Management > Resources with its schema. A resource does not run aggregation by itself. The dataset that owns the resource collects it during aggregation.
For more information, refer to Managing Resources.
Owner Correlation
Configure owner correlation on each resource to link aggregated objects to human owners. If you do not configure owner correlation, or if the mapping produces no match, an owner is not assigned. For more information, refer to Configuring Owner Correlation.
Supported Datasets
Go to Dataset Management > Datasets on your HashiCorp Vault Integration (On-Premise) source to view the datasets the connector aggregates. Select a dataset to review its associated resources and configure aggregation.
Note
Configure aggregation for each dataset separately. For more information, refer to Dataset Aggregation.
Note
The datasets require the idn:agentic-identity-governance license.
| Dataset name | Dataset ID | Associated resources | Description |
|---|---|---|---|
| Vault UserPass | hashicorp-vault:userpass-account |
Vault UserPass | Vault non-token identities (userpass today; AppRole later). Emitted when identity.is_token is false. |
| Vault Token | hashicorp-vault:tokens |
Vault Token | Vault token accessor metadata. The connector never retrieves the token string. Emitted when identity.is_token is true. |
For resource details, refer to Supported Resources.
Dataset Aggregations
Dataset aggregation collects resource objects from the managed system and loads them into SailPoint. Repeat the configuration for each dataset on the source.
Configuring Dataset Aggregation
To configure dataset aggregation for a dataset:
- Go to Admin > Connections > Sources, and open your source.
- Go to Dataset Management > Datasets.
- Select the dataset you want to configure.
-
Select the Dataset Aggregations tab.
On the Dataset Aggregations tab, configure how resource objects from the selected dataset are aggregated into SailPoint. The tab contains Scheduled Aggregations, Manual Aggregation, and Latest Aggregation.
Scheduled Aggregations
Scheduled aggregations run on a schedule to keep the dataset synchronized with the managed system.
- On the Dataset Aggregations tab, select Enable Schedule to turn on scheduled aggregations.
When scheduled aggregations are enabled, SailPoint aggregates all resource objects in the dataset on the configured schedule.
Manual Aggregation
Manual aggregation runs once and collects all resource objects in the dataset.
- On the Dataset Aggregations tab, select Start Aggregation.
SailPoint starts the aggregation immediately. When the run completes, results appear in the Latest Aggregation section.
Viewing Aggregation Results
After an aggregation completes, review its status in the Latest Aggregation section on the Dataset Aggregations tab.
The Latest Aggregation section shows:
- Start Time - when the aggregation started
- Resource Objects Scanned - the number of resource objects the aggregation processed
- Status - whether the aggregation succeeded or failed
Select Details to view additional information about the most recent run. To view prior runs, select Aggregation History.
Supported Resources
For more information, refer to Managing Resources.
Note
When you enable dataset aggregation for a selected dataset, all resources in that dataset are collected at once. Activate or deactivate aggregation at the dataset level, not for individual resources.
Resource schemas appear under Dataset Management > Resources. Each resource is read-only.
| Resource name | Type | Associated dataset | Resource ID |
|---|---|---|---|
| Vault Token | Credential | Vault Token | hashicorp-vault:token |
| Vault UserPass | Account | Vault UserPass | Requires source clarification |
Important
The connector does not retrieve secret payloads or token values.
To review the resource schemas after you create the source:
- Go to Admin > Connections > Sources.
- Open your HashiCorp Vault Integration (On-Premise) source.
- Select Dataset Management > Resources.
- Select a resource.
- Open the Schema tab.
Vault Token
| Property | Value |
|---|---|
| Resource ID | hashicorp-vault:token |
| Associated dataset | Vault Token |
| Type | Credential |
| Identity attribute | accessor |
| Display attribute | tokenDisplayName |
Attributes
| Attribute | Description | Type | Required |
|---|---|---|---|
accessor |
Unique token accessor identifier. | string | Yes |
displayName |
Token display name reported by Vault. The value might not be unique. | string | No |
tokenDisplayName |
Unique composite display name. | string | No |
path |
Authentication path used to create the token. | string | No |
tokenType |
Token type - service or batch. |
string | No |
entityId |
Associated Vault entity ID. | string | No |
identityPolicies |
Top-level identity policies assigned to the token. | array of strings | No |
dataPolicies |
Policies returned by the token accessor lookup. | array of strings | No |
meta |
Token metadata serialized as a JSON string. | string | No |
creationTime |
Creation time in Unix epoch seconds. | integer | No |
issueTime |
Token issue timestamp. | string | No |
expireTime |
Token expiration timestamp. | string | No |
creationTtl |
Initial time to live in seconds. A value of 0 means no time limit. |
integer | No |
explicitMaxTtl |
Explicit maximum time to live in seconds. A value of 0 means no time limit. |
integer | No |
ttl |
Remaining time to live in seconds. A value of 0 identifies a root token or no time limit. |
integer | No |
numUses |
Remaining uses. A value of 0 means unlimited uses. |
integer | No |
orphan |
Indicates whether the token outlives its parent. | boolean | No |
renewable |
Indicates whether the token can be renewed. | boolean | No |
mountAccessor |
Unique authentication mount accessor. | string | No |
resolvedPolicies |
Flattened ACL rules. | string | No |
isServicePrincipal |
Indicates whether the identity qualifies as a service principal. | boolean | No |
Vault UserPass
| Property | Value |
|---|---|
| Resource ID | Requires source clarification |
| Associated dataset | Vault UserPass |
| Type | Account |
| Classification | Machine |
| Identity attribute | identity |
| Display attribute | username |
Attributes
The schema includes 26 attributes. None of the attributes are entitlements.
| Attribute | Description | Type |
|---|---|---|
identity |
Composite resource identity, unique across mounts. Composed as the mount accessor, a hyphen, and the identity name at emit time. | string |
username |
Userpass username. | string |
authMethod |
Auth method. The current value is userpass. AppRole is planned later. |
string |
mountName |
Auth mount name. For example, userpass/. |
string |
mountType |
Auth mount type. | string |
mountAccessor |
Auth mount accessor. | string |
identityPolicies |
Top-level identity policies. | string |
tokenPolicies |
Policy template applied to issued tokens. | string |
tokenBoundCidrs |
CIDR restrictions applied to issued tokens. | string |
tokenTtl |
Token time to live, in seconds. | int |
tokenMaxTtl |
Maximum token time to live, in seconds. | int |
tokenExplicitMaxTtl |
Explicit maximum token time to live, in seconds. | int |
tokenPeriod |
Token period, in seconds. | int |
tokenNumUses |
Maximum token uses. A value of 0 means unlimited uses. |
int |
tokenNoDefaultPolicy |
Indicates whether issued tokens omit the default policy. | boolean |
tokenType |
Token type. Values are default, service, or batch. |
string |
resolvedPolicies |
Flattened ACL rules as a JSON string. | string |
signalMountType |
Derived signal for the authentication mount type. | string |
signalIsToken |
Derived signal that indicates whether the identity is a token. This value is false for userpass accounts. | boolean |
signalEntityId |
Derived signal for the associated Vault entity ID. | string |
signalPolicyCount |
Derived signal for the number of identity policies. | int |
signalHasRootPolicy |
Derived signal that indicates whether the account has the root policy. | boolean |
signalHasSudoCapability |
Derived signal that indicates whether the account has the sudo capability. | boolean |
signalWritablePathCount |
Derived signal for the count of paths that grant create, update, or delete. | int |
signalDisplayNameLooksServiceAccount |
Heuristic signal that indicates whether the display name appears to identify a service account. | boolean |
isServicePrincipal |
Indicates whether the account qualifies as a service principal. | boolean |
Documentation Feedback
Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.