# Dataset Management

Dataset Management lets you review the object types a source collects and control how the source aggregates those objects into SailPoint. Use Dataset Management to view and manage resource attributes, datasets and their resources, enable dataset aggregation schedules, perform manual aggregation, and view aggregation history.

> [!NOTE]
>
> Datasets are also available in SailPoint Agentic Fabric. Contact your Customer Success team and refer to [SailPoint Agentic Fabric](<https://documentation.sailpoint.com/saas/help/agentic_fabric/index.html>) for more information.

For more information, refer to [Managing Datasets and Resources](<https://documentation.sailpoint.com/saas/help/sources/datasets.html>) for datasets, resources, owner correlation, and aggregation.

## Datasets

A *dataset* is a named group of one or more related resources that the source aggregates together.

When aggregation runs for a dataset, the source collects all resources in that dataset from the managed system in one aggregation job. Activate or deactivate aggregation at the dataset level, not for individual resources.

> [!NOTE]
>
> Each resource belongs to exactly one dataset for that source. The source defines which resources belong to each dataset. You can enable aggregation and review associated resources, but you cannot create or delete datasets or move resources between them.

### Dataset Aggregation

Configure aggregation on the **Dataset Aggregations** tab for each dataset. Configure each dataset separately. During aggregation, your owner correlation rules are automatically applied to link machine identities to their human owners. For more information, refer to [Configuring Dataset Aggregations](<https://documentation.sailpoint.com/saas/help/sources/datasets.html#configuring-dataset-aggregations>).

## Resources

A resource defines an object type from the managed system. It specifies the kind of object, the attributes the source collects, and how the source identifies and displays each object. Resources form the building blocks of the data model.

In the UI, each resource appears under **Dataset Management** \> **Resources** with its schema. A resource does not run aggregation by itself. The dataset that owns the resource collects it during aggregation.

For more information, refer to [Managing Resources](<https://documentation.sailpoint.com/saas/help/sources/datasets.html#managing-resources>).

### Owner Correlation

Configure owner correlation on each resource to link aggregated objects to human owners. If you do not configure owner correlation, or if the mapping produces no match, an owner is not assigned. For more information, refer to [Configuring Owner Correlation](<https://documentation.sailpoint.com/saas/help/sources/datasets.html#configuring-owner-correlation>).

## Supported Datasets

Go to **Dataset Management \> Datasets** on your Wiz source to view the datasets the connector aggregates. Select a dataset to review its associated resources and configure aggregation.

> [!NOTE]
>
> Configure aggregation for each dataset separately. For more information, refer to [Dataset Aggregation](<https://documentation.sailpoint.com/saas/help/sources/datasets.html#configuring-dataset-aggregations>).

The connector collects Wiz Service Accounts in the Wiz Service Accounts dataset. For Cloud Resource Inventory, it collects 13 distinct entity types across 12 datasets, with some entity types grouped into a shared dataset.

| Dataset Name | Associated Resources | Entity Type |
| --- | --- | --- |
| Wiz Service Accounts | Wiz Service Accounts | \- |
| Cloud Resource Service Accounts | Cloud Resource Service Accounts | `SERVICE_ACCOUNT` |
| Access Keys | Access Keys | `ACCESS_KEY` |
| Access Roles | Access Roles | `ACCESS_ROLE` |
| AI Agents | AI Agents | `AI_AGENT` |
| AI Models | AI Models | `AI_MODEL` |
| AI Capabilities | AI Tools, AI Skills | `AI_TOOL`, `AI_SKILL` |
| AI Gateways | AI Gateways | `AI_GATEWAY` |
| Encryption Keys | Encryption Keys | `ENCRYPTION_KEY` |
| MCP Servers | MCP Servers | `MCP_SERVER` |
| Secrets | Secrets | `SECRET` |
| Service Blueprints | Service Blueprints | `SERVICE_BLUEPRINT` |

## Supported Resources

A resource represents a type of object the connector collects from Wiz, such as service accounts, credentials, agents, or applications. Each resource defines the attributes collected for that object type, such as name, ID, or status, and how each object appears in SailPoint.

For more information, refer to [Managing Resources](<https://documentation.sailpoint.com/saas/help/sources/datasets.html#managing-resources>).

> [!NOTE]
>
> When you enable dataset aggregation for a selected dataset, all resources in that dataset are collected at once. Activate or deactivate aggregation at the dataset level, not for individual resources.

Under **Dataset Management** \> **Resources**, the Wiz source lists each object type the connector aggregates. Select a resource to review its schema on the **Schema** tab.

| Resource Name | Resource Type | Resource ID |
| --- | --- | --- |
| Wiz Service Accounts | Account | `wiz:service-account` |
| Cloud Resource Service Accounts | Account | `wiz:cloud-resource-service-account` |
| Access Keys | Credential | `wiz:cloud-resource-access-key` |
| Access Roles | Account | `wiz:cloud-resource-access-role` |
| AI Agents | Agent | `wiz:cloud-resource-ai-agent` |
| AI Models | Application | `wiz:cloud-resource-ai-model` |
| AI Tools | Capability | `wiz:cloud-resource-ai-tool` |
| Encryption Keys | Credential | `wiz:cloud-resource-encryption-key` |
| MCP Servers | Application | `wiz:cloud-resource-mcp-server` |
| Secrets | Credential | `wiz:cloud-resource-secret` |
| Service Blueprints | Account | `wiz:cloud-resource-service-blueprint` |
| AI Skills | Capability | `wiz:cloud-resource-ai-skill` |
| AI Gateways | Application | `wiz:cloud-resource-ai-gateway` |

## Wiz Service Accounts Attributes

Schema attributes for the Wiz Service Accounts resource.

| Attribute | Type | Description |
| --- | --- | --- |
| id | string | Wiz service account identifier |
| name | string | Service account name |
| description | string | Service account description |
| spDescription | string | SailPoint internal attribute derived from the `description` attribute |
| classification | string | Account classification. Always `machine`. |
| clientId | string | OAuth client ID associated with the service account |
| enabled | boolean | Whether the service account is enabled |
| type | string | Service account type. Possible values: `WIZ_AI_AGENT`, `FIRST_PARTY`, `THIRD_PARTY`, `INTEGRATION`, `BROKER`, `KUBERNETES_CONNECTOR`, `KUBERNETES_ADMISSION_CONTROLLER`, `SENSOR`, `CLI` |
| spStatus | string | SailPoint internal attribute derived from the `enabled` attribute. Possible values: `Active`, `Inactive`, `Pending` |
| scopes | string list | Granted OAuth scopes |
| assignedProjects | string list | Assigned projects, rendered as project IDs |
| internal | boolean | Whether the service account is internal to Wiz |
| createdAt | string | Creation timestamp |
| createdById | string | ID of the user who created the service account |
| createdByName | string | Name of the user who created the service account |
| createdByEmail | string | Email of the user who created the service account |
| updatedAt | string | Update timestamp |
| updatedById | string | ID of the user who last updated the service account |
| updatedByEmail | string | Email of the user who last updated the service account |
| lastLoginAt | string | When the service account was last used |
| lastRotatedAt | string | When the service account credentials were last rotated |
| expiresAt | string | When the service account expires |
| deletedAt | string | When the service account was deleted (null if not deleted) |

## Cloud Resource Inventory Attributes

All 19 cloud resource inventory entity types share the following attribute set. Type-specific differences are listed after the table.

| Attribute | Type | Description |
| --- | --- | --- |
| id | string | Unique identifier for the cloud resource in Wiz |
| name | string | Name of the cloud resource |
| type | string | Cloud resource entity type, for example `AI_AGENT`, `SERVICE_ACCOUNT`, `SECRET` (fixed per dataset) |
| spBusinessApplication | string | SailPoint internal attribute for business application identification. Possible value: `Wiz` |
| externalId | string | External identifier from the cloud provider |
| providerUniqueId | string | Unique identifier from the cloud provider, primarily for third-party integrations |
| technology | string | Technology name, for example `AWS IAM Role` |
| nativeType | string | Resource type from the cloud provider, for example `role`, `awsIamAccessKey`, `Secret` |
| cloudAccountId | string | Cloud account identifier |
| cloudAccountName | string | Cloud account name |
| cloudAccountProvider | string | Cloud provider name, for example AWS, Azure, GCP |
| cloudAccountExternalId | string | External identifier for the cloud account from the provider |
| cloudPlatform | string | Cloud platform where the resource is deployed |
| status | string | Current status. Possible values: `Active`, `Inactive`, `Error` |
| spStatus | string | SailPoint internal attribute normalized from the `status` attribute. Mapping: `ACTIVE` → `Active`, `INACTIVE` → `Inactive` |
| owner | string | Owner value sourced from the resource's `owner` tag |
| projects | string list | Wiz project IDs associated with the resource |
| resourceGroupId | string | Resource group identifier (primarily Azure) |
| resourceGroupName | string | Resource group name (primarily Azure) |
| createdAt | string | Timestamp when the resource was created in the cloud provider |
| updatedAt | string | Timestamp when the resource was last updated |
| deletedAt | string | Timestamp when the resource was deleted (null if not deleted) |
| firstSeen | string | Timestamp when Wiz first detected the resource |
| lastSeen | string | Timestamp when Wiz last detected the resource |
| isOpenToAllInternet | boolean | True if the resource is open to all internet traffic |
| isAccessibleFromInternet | boolean | True if the resource is accessible from the internet |
| hasAccessToSensitiveData | boolean | True if the resource has access to sensitive data |
| hasSensitiveData | boolean | True if the resource contains sensitive data |
| hasAdminPrivileges | boolean | True if the resource has admin privileges |
| hasHighPrivileges | boolean | True if the resource has high-level privileges |

### Type-Specific Attributes

The following resources include an additional attribute:

| Resource Name | Attribute | Description |
| --- | --- | --- |
| AI Tools | spType | SailPoint internal attribute for capability representation. Possible value: `TOOL` |
| AI Skills | spType | SailPoint internal attribute for capability representation. Possible value: `SKILL` |