# Dataset Management

Dataset Management lets you review the object types a source collects and control how the source aggregates those objects into SailPoint. Use Dataset Management to view and manage resource attributes, datasets and their resources, enable dataset aggregation schedules, perform manual aggregation, and view aggregation history.

> [!NOTE]
>
> Datasets are also available in SailPoint Agentic Fabric. Contact your Customer Success team and refer to [SailPoint Agentic Fabric](<https://documentation.sailpoint.com/saas/help/agentic_fabric/index.html>) for more information.

For more information, refer to [Managing Datasets and Resources](<https://documentation.sailpoint.com/saas/help/sources/datasets.html>) for datasets, resources, owner correlation, and aggregation.

## Datasets

A *dataset* is a named group of one or more related resources that the source aggregates together.

When aggregation runs for a dataset, the source collects all resources in that dataset from the managed system in one aggregation job. Activate or deactivate aggregation at the dataset level, not for individual resources.

> [!NOTE]
>
> Each resource belongs to exactly one dataset for that source. The source defines which resources belong to each dataset. You can enable aggregation and review associated resources, but you cannot create or delete datasets or move resources between them.

### Dataset Aggregation

Configure aggregation on the **Dataset Aggregations** tab for each dataset. Configure each dataset separately. During aggregation, your owner correlation rules are automatically applied to link machine identities to their human owners. For more information, refer to [Configuring Dataset Aggregations](<https://documentation.sailpoint.com/saas/help/sources/datasets.html#configuring-dataset-aggregations>).

## Resources

A resource defines an object type from the managed system. It specifies the kind of object, the attributes the source collects, and how the source identifies and displays each object. Resources form the building blocks of the data model.

In the UI, each resource appears under **Dataset Management** \> **Resources** with its schema. A resource does not run aggregation by itself. The dataset that owns the resource collects it during aggregation.

For more information, refer to [Managing Resources](<https://documentation.sailpoint.com/saas/help/sources/datasets.html#managing-resources>).

### Owner Correlation

Configure owner correlation on each resource to link aggregated objects to human owners. If you do not configure owner correlation, or if the mapping produces no match, an owner is not assigned. For more information, refer to [Configuring Owner Correlation](<https://documentation.sailpoint.com/saas/help/sources/datasets.html#configuring-owner-correlation>).

## Supported Datasets

Go to **Dataset Management \> Datasets** on your Oracle Cloud Infrastructure SaaS source to view the datasets the connector aggregates. Select a dataset to review its associated resources and configure aggregation.

> [!NOTE]
>
> Configure aggregation for each dataset separately. For more information, refer to [Dataset Aggregation](<https://documentation.sailpoint.com/saas/help/sources/datasets.html#configuring-dataset-aggregations>).

The connector collects OCI Generative AI Agents, OCI Hosted Application Agents, OCI IAM credentials, and OCI Vault secrets in separate datasets.

| Dataset Name | Associated Resources | Dataset ID |
| --- | --- | --- |
| OCI Generative AI Agents | Agent, Agent Endpoint, Knowledge Base, Tool, Data Source, and relationship resources | `oci:generative-ai-agent` |
| OCI Hosted Application Agents | Hosted Application and Hosted Application IAM | `oci:hosted-application-agent` |
| OCI IAM Credentials | API Key, Auth Token, Customer Secret Key, and SMTP Credential | `oci:iam-credential` |
| OCI Vault Secrets | Vault Secret | `oci:vault-secrets` |

A scheduled aggregation runs automatically. The default schedule is every 12 hours. Your administrators can change the schedule in the tenant.

## Supported Resources

A resource represents a type of object the connector collects from Oracle Cloud Infrastructure (OCI). Each resource defines the attributes collected for that object type and how each object appears in SailPoint.

For more information, refer to [Managing Resources](<https://documentation.sailpoint.com/saas/help/sources/datasets.html#managing-resources>).

> [!NOTE]
>
> When you enable dataset aggregation for a selected dataset, all resources in that dataset are collected at once. Activate or deactivate aggregation at the dataset level, not for individual resources.

Go to **Dataset Management** \> **Resources** on your Oracle Cloud Infrastructure SaaS source to view each object type the connector aggregates. Select a resource to review its schema on the **Schema** tab.

| Resource Name | Resource Type | Resource ID |
| --- | --- | --- |
| OCI Generative AI Agent | Agent | `oci:generative-ai-agent` |
| OCI Generative AI Tool | Capability | `oci:generative-ai-tool` |
| OCI Hosted Application | Agent | `oci:hosted-application` |
| OCI Hosted Application IAM | Agent | `oci:hosted-application-iam` |
| OCI IAM API Key | Credential | `oci:iam-api-key` |
| OCI IAM Auth Token | Credential | `oci:iam-auth-token` |
| OCI IAM Customer Secret Key | Credential | `oci:iam-customer-secret-key` |
| OCI IAM SMTP Credential | Credential | `oci:iam-smtp-credential` |
| OCI Vault Secret | Credential | `oci:vault-secret` |
| Relationship resources | Access or Extends | `oci:agent-uses-tool` |

For attribute definitions, refer to:

- [OCI Generative AI Agent Attributes](<#oci-generative-ai-agent-attributes>)
- [OCI Hosted Application Attributes](<#oci-hosted-application-attributes>)
- [Relationship Attributes](<#relationship-attributes>)
- [OCI IAM API Key Attributes](<#oci-iam-api-key-attributes>)
- [OCI IAM Auth Token Attributes](<#oci-iam-auth-token-attributes>)
- [OCI IAM Customer Secret Key Attributes](<#oci-iam-customer-secret-key-attributes>)
- [OCI IAM SMTP Credential Attributes](<#oci-iam-smtp-credential-attributes>)
- [OCI Vault Secret Attributes](<#oci-vault-secret-attributes>)

## OCI Generative AI Agent Attributes

Schema attributes for the **OCI Generative AI Agent** resource in the **OCI Generative AI Agents** dataset.

| Attribute | Type | Description |
| --- | --- | --- |
| `compartmentId` | string | Compartment OCID that owns the agent. |
| `createdBy` | string | Email address of the user who created the agent. |
| `definedTags` | string | Defined tags for the agent, stored as JSON. |
| `description` | string | Agent description. |
| `displayName` | string | Agent display name. |
| `endpointCreatedBy` | string (multi-valued) | Email address of each endpoint owner, in `{endpoint display name}::{email}` format. |
| `endpointDescription` | string (multi-valued) | Description of each endpoint, in `{endpoint display name}::{value}` format. |
| `endpointDisplayName` | string (multi-valued) | Display name of each endpoint, in `{agent display name}::{endpoint display name}` format. |
| `endpointLifecycleDetails` | string (multi-valued) | Lifecycle details for each endpoint, in `{endpoint display name}::{value}` format. |
| `endpointLifecycleState` | string (multi-valued) | Lifecycle state of each endpoint, in `{endpoint display name}::{value}` format. |
| `endpointTimeCreated` | string (multi-valued) | Date and time each endpoint was created, in `{endpoint display name}::{value}` format. |
| `endpointTimeUpdated` | string (multi-valued) | Date and time each endpoint was last updated, in `{endpoint display name}::{value}` format. |
| `freeformTags` | string | Free-form tags for the agent, stored as JSON. |
| `generationLlmCustomization` | string | LLM customization settings for the agent, stored as JSON. |
| `id` | string | Agent OCID. |
| `identity` | string | Unique identifier for the agent. Same as the agent OCID. |
| `knowledgeBaseIds` | string | Knowledge base OCIDs associated with the agent, stored as JSON. |
| `lifecycleState` | string | Agent lifecycle state. |
| `llmConfig` | string | LLM configuration for the agent, stored as JSON. |
| `resourceType` | string | Resource type. |
| `spBusinessApplication` | string | Business application for this resource. |
| `systemTags` | string | System tags for the agent, stored as JSON. |
| `timeCreated` | string | Date and time the agent was created. |
| `timeUpdated` | string | Date and time the agent was last updated. |
| `type` | string | Resource subtype. |

## OCI Hosted Application Attributes

Schema attributes for hosted applications in the **OCI Hosted Application Agents** dataset. **OCI Hosted Application** is an application that uses identity domain authentication. **OCI Hosted Application IAM** is an application that uses OCI IAM authentication.

The identity attribute is `identity`. The display attribute is `displayName`. The two resources use the same attributes. `inboundAuthConfig` is collected only for **OCI Hosted Application**.

| Attribute | Type | Description |
| --- | --- | --- |
| `compartmentId` | string | Compartment OCID that owns the application. |
| `createdBy` | string | Email address of the user who created the application. |
| `definedTags` | string | Defined tags, stored as JSON. |
| `deploymentDetails` | string | Deployments of this application, stored as JSON. Empty when the application has no deployments. |
| `description` | string | Application description. |
| `displayName` | string | Application display name. |
| `environmentVariables` | string | Environment variables, stored as JSON. |
| `freeformTags` | string | Free-form tags, stored as JSON. |
| `id` | string | Application OCID. |
| `identity` | string | Unique identifier for the application. Same as the application OCID. |
| `inboundAuthConfig` | string | Identity domain authentication settings, stored as JSON. Collected only for **OCI Hosted Application**. |
| `lifecycleDetails` | string | Additional details about the lifecycle state. |
| `lifecycleState` | string | Application lifecycle state. |
| `networkingConfig` | string | Networking settings, stored as JSON. |
| `owner` | string | Email address of the application owner. Same value as `createdBy`. |
| `region` | string | OCI region where the application was aggregated. |
| `resourceType` | string | Resource type. The value is Agent. |
| `scalingConfig` | string | Scaling settings, stored as JSON. |
| `spBusinessApplication` | string | Business application for this resource. |
| `storageConfigs` | string | Storage settings for the application, stored as JSON. |
| `systemTags` | string | System tags, stored as JSON. |
| `timeCreated` | string | Date and time the application was created. |
| `timeUpdated` | string | Date and time the application was last updated. |
| `type` | string | `HostedApplication` or `HostedApplicationIam`. |

## Relationship Attributes

Schema attributes for relationship resources in the **OCI Generative AI Agents** dataset, such as agent-to-tool links.

| Attribute | Type | Description |
| --- | --- | --- |
| `displayName` | string | Display name of the relationship. |
| `id` | string | Unique identifier for the relationship. |
| `identity` | string | Unique identifier for the relationship. |
| `resourceId` | string | Identifier of the linked resource. |

## OCI IAM API Key Attributes

Schema attributes for the **OCI IAM API Key** resource in the **OCI IAM Credentials** dataset. The identity attribute is `identity`. The display attribute is `displayName`.

| Attribute | Type | Description |
| --- | --- | --- |
| `createdBy` | string | Email address of the user who owns the API key. |
| `displayName` | string | Display name of the API key, in `{user name}/{fingerprint}` format. |
| `fingerprint` | string | API key fingerprint. |
| `id` | string | Unique identifier for the API key, in `{tenancy OCID}/{user OCID}/{fingerprint}` format. |
| `identity` | string | Unique identifier for the API key, in `{tenancy OCID}/{user OCID}/{fingerprint}` format. |
| `inactiveStatus` | string | Indicates whether the API key is inactive. |
| `keyId` | string | Identifier of the API key, in `{tenancy OCID}/{user OCID}/{fingerprint}` format. |
| `keyValue` | string | Public key for the API key. |
| `lifecycleState` | string | Current lifecycle state of the API key. |
| `region` | string | Region where the API key was aggregated. |
| `resourceType` | string | Resource type. |
| `spBusinessApplication` | string | Business application for this resource. |
| `spType` | string | Credential subtype. The value is `API_KEY`. |
| `timeCreated` | string | Date and time the API key was created. |
| `userId` | string | OCID of the IAM user who owns the API key. |
| `userName` | string | Name of the IAM user who owns the API key. |

> [!NOTE]
>
> The **OCI IAM Credentials** dataset also aggregates auth tokens, customer secret keys, and SMTP credentials. For more information, refer to [Supported Datasets](<#supported-datasets>).

## OCI IAM Auth Token Attributes

Schema attributes for the **OCI IAM Auth Token** resource in the **OCI IAM Credentials** dataset. The identity attribute is `identity`. The display attribute is `displayName`.

| Attribute | Type | Description |
| --- | --- | --- |
| `authTokenUrl` | string | Oracle Cloud Console URL for the owning user's auth tokens. |
| `capabilities` | string | Capability flags enabled on the owning IAM user. |
| `createdBy` | string | Email address of the user who owns the auth token. |
| `description` | string | Description of the auth token. |
| `displayName` | string | Display name of the auth token, typically in `{user name}/{auth token ID}` format, or the token description when present. |
| `id` | string | Unique identifier for the auth token, in `{tenancy OCID}/{user OCID}/{auth token ID}` format. |
| `identity` | string | Unique identifier for the auth token, in `{tenancy OCID}/{user OCID}/{auth token ID}` format. |
| `inactiveStatus` | string | Indicates whether the auth token is inactive. |
| `lifecycleState` | string | Current lifecycle state of the auth token. |
| `owner` | string | Owning identity used for owner correlation. |
| `region` | string | Region where the auth token was aggregated. |
| `resourceType` | string | Resource type. |
| `spBusinessApplication` | string | Business application for this resource. |
| `spType` | string | Credential subtype. The value is `AUTH_TOKEN`. |
| `timeCreated` | string | Date and time the auth token was created. |
| `timeExpires` | string | Date and time the auth token expires. |
| `userId` | string | OCID of the IAM user who owns the auth token. |
| `userName` | string | Name of the IAM user who owns the auth token. |
| `userUrl` | string | Oracle Cloud Console URL for the owning IAM user. |

> [!NOTE]
>
> The connector does not aggregate the auth token secret.

## OCI IAM Customer Secret Key Attributes

Schema attributes for the **OCI IAM Customer Secret Key** resource in the **OCI IAM Credentials** dataset. The identity attribute is `identity`. The display attribute is `displayName`.

| Attribute | Type | Description |
| --- | --- | --- |
| `capabilities` | string | Capability flags enabled on the owning IAM user. |
| `createdBy` | string | Email address of the user who owns the customer secret key. |
| `customerSecretKeyUrl` | string | Oracle Cloud Console URL for the owning user's customer secret keys. |
| `displayName` | string | Display name of the customer secret key. Uses the OCI display name, or `{user name}/{id}`. |
| `id` | string | Unique identifier for the customer secret key, in `{tenancy OCID}/{user OCID}/{customer secret key ID}` format. |
| `identity` | string | Unique identifier for the customer secret key, in `{tenancy OCID}/{user OCID}/{customer secret key ID}` format. |
| `inactiveStatus` | string | Indicates whether the customer secret key is inactive. |
| `lifecycleState` | string | Current lifecycle state of the customer secret key. |
| `owner` | string | Owning identity used for owner correlation. |
| `region` | string | Region where the customer secret key was aggregated. |
| `resourceType` | string | Resource type. |
| `spBusinessApplication` | string | Business application for this resource. |
| `spType` | string | Credential subtype. The value is `CUSTOMER_SECRET_KEY`. |
| `timeCreated` | string | Date and time the customer secret key was created. |
| `timeExpires` | string | Date and time the customer secret key expires. |
| `userId` | string | OCID of the IAM user who owns the customer secret key. |
| `userName` | string | Name of the IAM user who owns the customer secret key. |
| `userUrl` | string | Oracle Cloud Console URL for the owning IAM user. |

> [!NOTE]
>
> The connector does not aggregate the secret key value.

## OCI IAM SMTP Credential Attributes

Schema attributes for the **OCI IAM SMTP Credential** resource in the **OCI IAM Credentials** dataset. The identity attribute is `identity`. The display attribute is `displayName`.

| Attribute | Type | Description |
| --- | --- | --- |
| `capabilities` | string | Capability flags enabled on the owning IAM user. |
| `createdBy` | string | Email address of the user who owns the SMTP credential. |
| `description` | string | Description of the SMTP credential. |
| `displayName` | string | Display name of the SMTP credential. Uses the SMTP username, or `{user name}/{id}`. |
| `id` | string | Unique identifier for the SMTP credential, in `{tenancy OCID}/{user OCID}/{SMTP credential ID}` format. |
| `identity` | string | Unique identifier for the SMTP credential, in `{tenancy OCID}/{user OCID}/{SMTP credential ID}` format. |
| `inactiveStatus` | string | Indicates whether the SMTP credential is inactive. |
| `lifecycleState` | string | Current lifecycle state of the SMTP credential. |
| `owner` | string | Owning identity used for owner correlation. |
| `region` | string | Region where the SMTP credential was aggregated. |
| `resourceType` | string | Resource type. |
| `smtpCredentialUrl` | string | Oracle Cloud Console URL for the owning user's SMTP credentials. |
| `spBusinessApplication` | string | Business application for this resource. |
| `spType` | string | Credential subtype. The value is `SMTP_CREDENTIAL`. |
| `timeCreated` | string | Date and time the SMTP credential was created. |
| `timeExpires` | string | Date and time the SMTP credential expires. |
| `userId` | string | OCID of the IAM user who owns the SMTP credential. |
| `userName` | string | Name of the IAM user who owns the SMTP credential. |
| `username` | string | SMTP username. |
| `userUrl` | string | Oracle Cloud Console URL for the owning IAM user. |

> [!NOTE]
>
> The connector does not aggregate the SMTP password.

## OCI Vault Secret Attributes

Schema attributes for the **OCI Vault Secret** resource in the **OCI Vault Secrets** dataset. The identity attribute is `identity`. The display attribute is `displayName`. Owner correlation uses `createdBy`. The connector matches `createdBy` to the identity email address first, then to the identity name.

| Attribute | Type | Description |
| --- | --- | --- |
| `identity` | string | Vault secret OCID. Same value as `id`. |
| `id` | string | Vault secret OCID, for example `ocid1.vaultsecret.oc1...`. |
| `displayName` | string | Vault secret name, or the secret OCID when the name is blank. |
| `resourceType` | string | SailPoint resource type (`std:credential`). |
| `spBusinessApplication` | string | SailPoint business application (`oracle_oci_generative_ai_agents`). |
| `secretName` | string | Vault secret name. |
| `compartmentId` | string | OCID of the compartment that contains the secret. |
| `vaultId` | string | OCID of the Vault that contains the secret. |
| `keyId` | string | OCID of the encryption key used by the secret. |
| `lifecycleState` | string | Current lifecycle state of the secret, for example `ACTIVE`. |
| `lifecycleDetails` | string | Additional details about the secret lifecycle state. |
| `description` | string | Vault secret description. |
| `timeCreated` | string | Date and time the secret was created. |
| `timeOfCurrentVersionExpiry` | string | Date and time the current secret version expires. |
| `timeOfDeletion` | string | Date and time the secret is scheduled for deletion. |
| `rotationStatus` | string | Current rotation status, for example `NOT_ENABLED`. |
| `lastRotationTime` | string | Date and time of the most recent rotation. |
| `nextRotationTime` | string | Date and time of the next scheduled rotation. |
| `isAutoGenerationEnabled` | boolean | Indicates whether automatic secret generation is enabled. |
| `currentVersionNumber` | number | Current secret version number. Present when extra metadata is fetched. |
| `definedTags` | string | Defined tags, stored as JSON. |
| `freeformTags` | string | Free-form tags, stored as JSON. |
| `systemTags` | string | System tags, stored as JSON. |
| `metadata` | string | Secret metadata, stored as JSON. Present when extra metadata is fetched. |
| `rotationConfig` | string | Secret rotation configuration, stored as JSON. |
| `secretGenerationContext` | string | Secret generation configuration, stored as JSON. |
| `secretRules` | string | Secret rules, stored as JSON. Present when extra metadata is fetched. |
| `createdBy` | string | Creator email parsed from `definedTags` / `Oracle-Tags.CreatedBy`. Used for owner correlation. |
| `region` | string | Region where the secret was aggregated. |

> [!NOTE]
>
> The connector does not aggregate secret contents. Map-valued OCI fields are stored as JSON strings. Extra metadata attributes (`secretRules`, `currentVersionNumber`, and `metadata`) are populated unless `skipVaultSecretMetadata` is true on the source object. That attribute is not shown on the source form.