# SailPoint File Access Manager Connector Documentation > SailPoint File Access Manager # SailPoint File Access Manager Connector Documentation # File Access Manager Connectors The following sources are available in our new online format for SailPoint File Access Manager. Important SailPoint is not responsible for the availability of API keys and other credentials or permissions that may be necessary to access and use third-party sources with which the connectors integrate (the "API Keys") and Customer is responsible for maintaining the API Keys. ## Base Product - Active Directory - SQL Server ## On-Premise File Storage - Windows File Server - SharePoint - Exchange - NFS - Generic Table - Linux ## NAS File Storage - NetApp - EMC-Celerra - EMC-Isilon - EMC-Unity CIFS - HDS - DFS - CIFS ## O365 File Storage - OneDrive - SharePoint Online - Exchange Online ## Cloud File Storage - Box - Dropbox - Google Drive - CTERA - AWS S3 - Azure Files ## Other Connectors - IdentityIQ Enrichment # Base Product The following are File Access Manager supported connectors: - Active Directory - SQL Server # Active Directory Connector Overview ## Capabilities This connector enables you to use File Access Manager to access and analyze data stored in Active Directory and do the following: - Analyze the structure of your stored data. - Monitor user activity in the resources. - Classify the data being stored. - Verify user permissions on the resources, and compare them against requirements. - Manage access fulfillment - automated granting and revoking of access according to rules set in File Access Manager. - Identity collector – collect IAM users, groups, roles, and the connections between them. See the File Access Manager documentation for a full description. ## Supported Versions - **Activity Monitor** - The system supports auditing on domain controllers installed on Windows Server 2008 and above. Note The relevant factor is the operating system of the domain controller. Not the domain functionality level. - **Permissions Collection and Crawling** - Supported for all domain versions, forest versions, and operating systems. ## Active Directory Installation Flow Overview To install the Active Directory connector: 1. Configure all the prerequisites. 1. Add a new Active Directory application in the Business Website. 1. Install the relevant services: - Activity Monitor- This is the activity collection engine, used by all connectors that support activity monitoring. - Permissions Collector - If you are using EC2 login, the collector should be installed on the EC2 instance. - Data Classification Collector Important Installing the permissions collector and data classification services is optional and should only be installed by someone with a full understanding of File Access Manager deployment architecture. The File Access Manager Administrator Guide has additional information on the architecture. **Activity Monitor** File Access Manager Activity Monitor for Active Directory (AD) is based on the native changes auditing capability in AD. AD writes these changes to the various domain controller event logs and the monitor collects them centrally so there is no need to install connectors on domain controllers. The Activity Monitor service correlates the events and digests them, which makes events possible for people to read. **GPO Auditing** GPO auditing uses a proprietary method with no local connectors on the Domain Controller (DC). The method accesses all GPOs on all DCs through the SYSVOL share, and correlates GPO audit change events with the content of the GPOs. **Domain Controllers** To access the DCs, the Activity Monitor reads the list of all DCs from the domain every hour. **Crawling** Crawling and Permissions Collection work with standard LDAP queries to retrieve all the domain objects and analyze their respective permissions. The Activity Monitor and Permissions Collector services can be installed on any server, including servers that are NOT members of the monitored domain. An application must be configured in File Access Manager for each monitored domain, with a separate set of Activity Monitor/Permissions Collection services, as described below. ## Monitored Actions | Action | Meaning | | ----------------------------------- | ----------------------------------------------------------------------------------- | | Create | An object was created in the domain. | | Undelete | An object was restored in the domain. | | Move | An object’s location was changed in the domain. | | Delete | An object was deleted in the domain. | | FSMO Role Change | The owners of the domain FSMO roles were changed. | | Audit Policy Change | The system audit policy was changed. | | Domain Policy Change | The domain security policy was changed. | | Account Lock | An account was locked, which includes the computer that originally caused the lock. | | Account Logout | The account was logged out. | | Reset Password | A user password was reset by another user. | | Kerberos Pre-authentication failure | Kerberos pre-authentication failed. | Note The old value will be empty and will not display in the Administrative Client if it was empty before the change. This is also true for the New value, if the attribute’s value was deleted. Note The account logon is not monitored by default. Refer to [Special Configurations](https://documentation.sailpoint.com/fam-connectors/help/base_product/active_directory/special_config.html) for a description on how to configure the Activity Monitor to collect Account Logon events. # Collecting Data Stored in an External Application ## Terminology - **Connector** - The collection of features, components and capabilities that comprise File Access Manager support for an endpoint. - **Collector** - The “Agent” component or service in a Data Classification and or Permission Collection architecture. - **Engine** - The core service counterpart of this architecture. - **Identity Collector** - A logical component used to fetch identities from an identity store and holds the configuration, settings for that identity store, and the relations between these identities. The identity collector has no physical manifest as the work is undertaken by the Collector Synchronizer. ## Installation Process The list below describes the high level installation process required to collect and analyze data from an external application. Most of these should already be set up in your File Access Manager installation. 1. Install a Data Classification central engine - One or more central engines, installed using the server installer 1. Install a Permission Collection central engine - One or more central engines, installed using the server installer 1. Create an Application in File Access Manager - From the Business Website. The application is linked to central engines listed above. 1. Add an Activity Monitor - To collect activities for this application - run the Collector Installation Manager and add an application under Activity Monitoring. ## Install Permission Collectors and / or Data Classification Collector (optional) Optionally, you can install collectors to run on a separate server and take some of the work from the central PC and DC engines (Where supported). When installing a collector, you attach it to an engine. If no collectors are installed, the central services act as both the engine and the collector. To install a collector, you must have the **RabbitMQ** service installed for communication between the central engines and the collectors. Note Some cloud connectors ignore collectors connected to the central engine (Box, Dropbox, OneDrive, SharePointOnline, Exchange Online, GoogleDrive) . In these applications the task is completed by the engine, and not relegated to its collectors. Note For further details, see section **Application > Central Service > Collector Relations** in the File Access Manager Administrator Guide. ## Installation Locations **Activity Monitor** Installed remotely on a File Access Manager monitor application server, which can be a server joined to any domain, including a domain different from the monitored domain. # Installing Services: Activity Monitor and Collectors The Collector Installation Manager is part of the File Access Manager installation package. This tool is used to install the activity monitor, permission collector, and data classification collector. 1. Run the **Collector Installation Manager** as an Administrator. The installation files are in the installation package under the folder Collectors. 1. Enter the credentials to connect to File Access Manager: - ServerName/IP should be pointed to the Agent Configuration Manager service server. - An File Access Manager user with Collector Manager permission (permission to install collectors). For Active Directory authentication, use the format `domain\username`. 1. Select **Next**. The Service Configuration window displays. 1. If you are installing the Activity Monitor, select the application, and select **Add**. 1. When installing a SharePoint Activity Monitor, you will be prompted for service account credentials. This service account will be used by the Activity Monitor service to run the service and authenticate against the SharePoint IIS servers to fetch the logs (“Log on as”). Make sure the service account provided has local administrator privileges on the local server (hosting the Activity Monitor service) and can access the activity logs on the IIS servers. 1. If you are installing the Permission Collector, select the Central Permission Collector to which to connect this service, and select **Add**. 1. If you are installing the Data Classification, select the Central Classification Collector to which to connect this service, and select **Add**. 1. Select **Next**. The Installation Folder window displays. Note If this is the first time you are installing collectors on this machine, you will be prompted to select an installation folder, in which all future collectors will also be installed. 1. Browse and select the location of the target folder for installation. 1. Browse and select the location of the folder for system logs. 1. Select **Next**. 1. The system begins installing the selected components. 1. Select **Finish**. The Finish button is displayed after all the selected components have been installed. Note The File Access Manager Administrator Guide provides more information on the collector services. # Prerequisites Make sure your system fits the descriptions below before starting the installation. ## Software Requirements File Access Manager requires the latest ASP.NET Core 8.0.x Hosting Bundle. This bundle consists of .NET Runtime and ASP .NET Core Runtime. You can download the latest 8.0.x Hosting Bundle version from [here](https://dotnet.microsoft.com/en-us/download/dotnet/8.0). ## Enabling the Audit Policy File Access Manager relies on the standard Active Directory advanced audit. The advanced audit overrides the simple audit, making the former obsolete. Be sure to migrate existing simple auditing to Advanced Auditing before proceeding. Note This guide does not cover complex GPO scenarios. Be sure that changes do not affect GPO precedence or corrupt other GPOs. Apply the following in a Domain Controller GPO: 1. Open the Default Domain Controller Policy. 1. Go to **Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies**. 1. Select **Audit to success** in the following settings: - Account Management > Audit User Account Management - DS Access > Audit Directory Services Changes - Logon/Logoff > Audit Account Lockout - Policy Change > Audit Policy Change - Policy Change > Audit Authentication Policy Change - Policy Change > Audit Authorization Policy Change To enable login audits, set Audit Kerberos Authentication Service to Success in Account Logon. ## Active Directory User Permissions The Active Directory user configured in the Application configuration must be granted permissions to manage the audit settings of the domain objects, as well as to access the Domain Controller event logs. To grant permission to manage auditing and security log: 1. Open the Default Domain Controller Policy. 1. Go to **Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > User Rights Assignment**. 1. Select **Manage auditing and security log**. Add the domain user to the Users/Groups list. Note The syntax of the user added to the list must be Domain\\User. 1. Add the user to the Event log readers security group. ## Communications Requirements | Requirement | Source | Destination | Port | | ---------------------------------- | -------------------------------------- | --------------------------- | ------------------- | | File Access Manager Message Broker | Permissions Collector | RabbitMQ | 5671 | | File Access Manager server access | Activity Monitor/Permissions Collector | File Access Manager Servers | 8000-8008 | | Event log remote | Activity Monitor | All Domain Controllers | MS RPC (135) | | SYSVOL access | Activity Monitor | All Domain Controllers | CIFS/SMB (139, 445) | | Additional queries | Activity Monitor/Permissions Collector | All Domain Controllers | LDAP (389) | The Remote Event Log Management (RPC) inbound allow firewall rule must be enabled on the Active Directory Domain Controller servers. # Special Configurations The following are a couple of configurations that may be needed: ## Excluding Domain Controllers Below Windows 2008 If there are domain controllers installed on an operating system older than Windows 2008, the system displays an error message in the Activity Monitor log, indicating that the Activity Monitor cannot connect to the Domain Controllers. To exclude these Domain Controllers, perform the following steps: 1. Open the Activity Monitor service installation folder. 1. Edit the bamframework.exe.config. 1. Under , locate the key called `ExcludedDCs:`. 1. Add the FQDN of the domain controllers to be excluded, separated by the **|** character: `` 1. Restart the Activity Monitoring service. ## Monitoring Logon Events To add monitoring of Logon events, perform the following steps: 1. Open the Activity Monitor service installation folder. 1. Edit the bamframework.exe.config. 1. Under , locate the key called “readLogonEvents”, and set it to true: `` 1. Restart the Activity Monitor service. ## Excluding Objects from Monitoring By default, SecurityIQ Activity Monitor excludes the dnsNode and msExchActiveSyncDevice object classes from monitoring. To exclude additional object classes from monitoring, perform the following steps: 1. Open the Activity Monitor service installation folder. 1. Edit the bamframework.exe.config. 1. Under , locate the key called `xcludedObjectClasses`, and set its value to the object classes to exclude: `` Note The value must contain a list of object classes separated by the **|** character. ## Crawling By default, SecurityIQ crawls and creates business resources for the following object types in the domain: - User - Group - Organizational Unit (OU) - Domain - Computer - Container Overriding the default object types is not recommended, since they are the most common, and serve to exclude irrelevant object types (such as DNS records or Exchange Active Sync objects). To override the default behavior, perform the following steps: 1. Open the Permissions Collector configured for the Active Directory Application installation folder. 1. Edit the RoleAnalyticsServiceHost.exe.config file. 1. Under the section, add the following key: `` Note The value must contain a list of object classes separated by the **|** character and the domain object class must be one of the object classes in the defined list. 1. Restart the Permissions Collector service. # Troubleshooting Check the issues below for common problems and suggested ways of handling them. ## Activities are not Shown in the Business Website - Verify that all prerequisites were set. - Check the Activity Monitor logs for errors. ## Errors in Accessing the Domain Controllers If there are errors in accessing the domain controllers, such as RPC server or server not available: - Verify that this domain controller is running on Windows 2008 or above. - Open the event viewer of the domain controller on which the change was made, with the user configured in the Application configuration. If the viewer fails to open, verify that the user has the permissions described in the prerequisites section. - Search for events with IDs 5136-5141. Verify the connection to the domain controller in which the change was made, and verify that the change audit policy was enabled as written in the prerequisites section. ## No Events Found - Run the following command on the domain controller: `Auditpol /get /subcategory: “directory service changes”` - Verify that the settings described in [Enabling the Audit Policy](https://documentation.sailpoint.com/fam-connectors/help/base_product/active_directory/prereqs.html#enabling-the-audit-policy) section are “Success”. If these settings are not defined, trigger a GPO update by running the following command: `gpupdate /force` If the settings are still not defined, verify that the GPO is properly configured in, and applied to the domain controller. ## Cannot Access Event Log ### Event Viewer of the domain controller fails to open Open the event viewer of the domain controller on which the change was made, with the user configured in the Application configuration. If the viewer fails to open, verify that the user has the permissions described in [Active Directory User Permissions](https://documentation.sailpoint.com/fam-connectors/help/base_product/active_directory/prereqs.html#active-directory-user-permissions). ### Access is Denied(5) Error when trying to access Directory Services. Navigate to **Event Viewer (DC server name) > Applications and services Logs > Directory Services** and verify that you have access to it. If you get an Access is Denied(5) error, contact your Active Directory owner and ask to remove this restriction for the relevant SecurityIQ user. The access to Directory Service should be granted with EventLogReader group association. # Verifying the Active Directory Connector Installation ## Installed Services Verify that the services installed for the connector are available and active. Using windows Service manager, or other tool, look for the File Access Manager services, and see that they are running. Example: - File Access Manager Central Activity Monitor - ` service is running`. - File Access Manager Central Permissions Collection - ` service is running`. ## Log Files Check the log files listed below for errors - `%SAILPOINT_HOME_LOGS%\ FilesMiniFilter_ .log` - `%SAILPOINT_HOME_LOGS%\PermissionCollection_.log` - `%SAILPOINT_HOME_LOGS%\DataClassification_.log` - `%SAILPOINT_HOME_LOGS%\ACTIVE DIRECTORY-.log` ## Monitored Activities 1. Simulate activities on Active Directory. 1. Wait a minute (approximately). 1. Verify that the activities display in the File Access Manager website under **Forensics > Activities**. ## Permissions Collection 1. Run the Crawler and Permissions Collector tasks in **Settings > Task Management > Scheduled Tasks**. 1. Verify that: - The tasks completed successfully. - Business resources were created in the resource explorer **Admin > Applications > [application column] > Manage Resources**. - Permissions display in the Permission Forensics page **Forensics > Permissions**. # Adding an Active Directory Application In order to integrate with Active Directory, we must first create an application entry in File Access Manager. This entry includes the identification, connection details, and other parameters necessary to create the link. To add an application, use the New Application Wizard. 1. Go to **Admin > Applications**. 1. Select **Add New**. 1. Select **Standard Application** as the Wizard Type. 1. Select **Next** to open the **General Details** page. ## General Details - **Application Type** - Active Directory. - **Application Name** - Logical name of the application. - **Description** - Description of the application. - **Tags** - Select tags for the application from the dropdown menu, and / or type a new name. Select **Enter** to create a new tag. The dropdown list of tags filters out matching tags as you type and displays up to 50 tags. Note The tags replace the Logical container field that was used when creating applications in releases before 8.2. - **Event Manager Server** - This option is available if there are more than one event manager servers configured in the system. Select an event manager from the drop down menu. - **Identity Collector** - Select from the Identity Collector dropdown menu. - You can create identity collectors in the administrative client. Go to **Applications > Configuration > Permissions Management > Identity Collectors**. Refer to "OOTB Identity Collection" in the Collector Installation Manager File Access Manager Administrator Guide for further details. - If adding a new identity collector, press the **Refresh** button to update the Identity Collector dropdown list. - Select **Next** to open the Connection Details page. ## Connection Details - **Domain Name** - FQDN of the domain. - **SSL** - Must be checked to connect with LDAPS. - **Domain NetBIOS Name** - The short name of the domain. - **Base DN** - Distinguished Name (DN). The level in the AD tree from which to perform a search. This field should remain empty unless needed. - **Username** - The samAccountName of the user defined in the prerequisites, or the UPN if the user is from a different trusted domain. - **Password** - The user’s password. Note If the user is from a different trusted domain, type the UPN in the User field (username@ fqdn), and type the short name of the domain in the Domain NetBIOS Name. - **Specific Server Connection** - Connection through a specific server instead of selecting a DC dynamically. - **Pool Size** - Number of parallel LDAP connections to DCs (Default is set to 50). - **Timeout** - Timeout for each LDAP query in seconds (Default is set to 15 sec). Select **Next**. # Configuring Activity Monitoring To configure the activity monitoring polling parameters: 1. Open the edit screen of the required application. 1. Go to **Admin > Applications**. 1. Scroll through the list, or use the filter to find the application 1. Select the **Edit** icon on the line of the application. 1. Select **Next** till you reach the **Activity Configurations & Decs** settings page. | Setting | Description | | ------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Polling Interval (sec) | Activity fetching interval (in seconds). Default is set to 60 seconds, | | Report Interval (sec) | Activity Monitor Health reporting interval (in seconds). Default is set yo 60 seconds. | | Local Buffer Size (MB) | Local buffer size for activities (in MB). Default is set to 200MB. This cyclic buffer is used to store activities on the Application Monitor’s machine in case of network errors that prevent the activities from being sent. | | Activity Data Retention Period | By default, this feature is disabled. When selecting the Clear Activity Data option, a user is able to provide a time frame (1 to 100) in either months or years for all activity to be retained. Once that time period is met, all data will be removed. A user can also select to backup the data before it is deleted by selecting the Backup Events Before Clearing option. **Note:** The Backup Before Clearing Option will only be enabled if the backup option is set during the system installation. If a user has not selected the backup option during the installation nor provided a backup path, this option will not be enabled. | ## Configuring Data Enrichment Connectors The Data Enrichment Connectors (DEC) configuration enables us to select data enrichment sources. These can be used to add information from other sources about identities. An enrichment source could be a local HR database that is used to combine users' job descriptions or departments to the information stored in the identity store. Select the data enrichment connectors to enrich monitored activities from the Available DECs text box. Use the **>** or **>>** arrows to move the selected DECs to the Current DECs text box. The user can select multiple DECs. Simply select each desired DEC. You can create a new DEC in the Administrative Client: **Applications>Configuration>ActivityMonitoring>DataEnrichmentConnectors.** After creating a new DEC, select **Refresh** to refresh the dropdown list. Refer to (**Connectors of the File Access Manager Administrator Guide - add link**) for more information on Data Enrichment Connectors, including what they are, how to configure them, and how they fit in the Activity Flow. # Configuring and Scheduling the Permissions Collection Permissions can be analyzed to determine the application permissions of an out-of-the-box application, provided you have defined an identity store for File Access Manager to use in its analysis, and you have run a crawl for the application. The permission collector is a software component responsible for analyzing the permissions in an application. The Central Permission Collector Service is responsible for running the Permission Collector and Crawler tasks. If the FAM Central Permission Collector wasn’t installed during the installation of the server, this configuration setting will be disabled. ## To configure the Permission Collection 1. Open the edit screen of the required application. 1. Go to **Admin > Applications**. 1. Scroll through the list, or use the filter to find the application. 1. Select the **Edit** icon on the line of the application. 1. Select **Next** until you reach the **Crawler & Permissions Collection** settings page.The actual entry fields vary according to the application type. When entering this page in edit mode, you can navigate between the various configuration windows using the **Next** and **Back** buttons. - **Central Permissions Collection Service** - Select a central permission collection service from the dropdown list. You can create permissions collection services as part of the service installation process. See section "Services Configuration" in the File Access Manager Administrator Guide for further details. - **Calculate Effective Permissions** - Calculate effective permissions during the permissions collection run. - **Calculate Riskiest Permissions** - Calculates the riskiest permission on a resource. For example, Full Control is riskier than Read permissions if both are on a resource. Note This option is available when selecting **Calculate Effective Permissions** - **Skip Identities Sync during Permission Collection** - Skip identity synchronization before running permission collection tasks when the identity collector is common to different connector. Note This option is checked by default. You can now [schedule a task](#scheduling-a-task). ## Scheduling a Task To create a schedule: 1. Select **Create a Schedule**. 1. The system will provide a Schedule Name in the format `{appName} - {type} Scheduler`. Choose to keep or override this suggestion. 1. Select a scheduling frequency from the dropdown list. Schedule Frequency Options - Run After - Create dependency of tasks. The task starts running only upon successful completion of the first task. - Hourly - Set the start time. - Daily - Set the start date and time. - Weekly - Set the day(s) of the week on which to run. - Monthly - Set the day of the month on which to run a task. - Quarterly - Set a monthly schedule with an interval of 3 months. - Half Yearly - Set a monthly schedule with an interval of 6 months. - Yearly - Set a monthly schedule with an interval of 12 months. 1. Fill the Date and Time field with scheduling times. These fields differ depending upon the scheduling frequency selected. 1. Select the **Active** checkbox to activate the schedule. 1. Select **Next**. ## Configuring and Scheduling the Crawler To set or edit the Crawler configuration and scheduling: 1. Open the edit screen of the required application. 1. Go to **Admin > Applications**. 1. Scroll through the list, or use the filter to find the application. 1. Select the edit icon **Edit** icon on the line of the application. 1. Select **Next** until you reach the **Crawler & Permissions Collection** settings page.The actual entry fields vary according to the application type. **Create a Schedule** - Select to open the schedule panel. ## Setting the Crawl Scope Note When the crawl is performed, two resources will display but neither are added by the crawl. These two resources also cannot be removed from the scope. **Configuration Resource** - for all activities that occur in the Configuration schema of the domain, which is shared across the forest. This means that in a multi-domain forest, you will still see it under the forest node rather than under the domain node. **\_Audit Policy** - specifically for changes to the domain's audit policy, which are not really associated with any part of the domain tree, thus are given their own resource. There are several options to set the crawl scope: - Setting explicit list of resources to include and / or exclude from the scan. - Creating a regex to define resources to exclude. ## Including and Excluding Paths by List To set the paths to include or exclude in the crawl process for an application: 1. Open the edit screen of the required application. 1. Go to **Admin > Applications**. 1. Scroll through the list, or use the filter to find the application. 1. Select the **Edit** icon on the line of the application. 1. Select **Next** until you reach the **Crawler & Permissions Collection** settings page. The actual entry fields vary according to the application type. 1. Scroll down to the Crawl configuration settings. 1. Select **Advanced Crawl Scope Configuration** to open the scope configuration panel. 1. Select Include/Exclude Resources to open the input fields. 1. To add a resource to a list, type in the full path to include/exclude in the top field and click **+** to add it to the list. 1. To remove a resource from a list, find the resource from the list, and select the *x* icon on the resource row. Note When creating exclusion lists, excludes take precedence over includes. ## Excluding Paths by Regex To set filters of paths to exclude in the crawl process for an application using regex. 1. Open the edit screen of the required application. 1. Go to **Admin > Applications**. 1. Scroll through the list, or use the filter to find the application. 1. Select the **Edit** icon on the line of the application. 1. Select **Next** until you reach the **Crawler & Permissions Collection** settings page.The actual entry fields vary according to the application type. 1. Click **Exclude Paths by Regex** to open the configuration panel. 1. Type in the paths to exclude by Regex. Refer to [Crawler Regex Exclusion Example](#crawler-regex-exclusion-example). Since the system does not collect BRs that match this Regex, it also does not analyze them for permissions. ## Crawler Regex Exclusion Example The following are examples of crawler Regex exclusions. **Exclude all users (CNs) under specific department (OU)** Example: All under Finance OU ```text Regex: `^CN=.+,OU=finance,DC=office,DC=mydomain,DC=com$` ``` Example: All under Finance and Accounting OU ```text Regex: `^CN=.+,OU=(finance accounting),DC=office,DC=mydomain,DC=com$` ``` **Include ONLY users (CNs) under specific department (OU)** Example: Only under Finance OU ```text Regex: `^(?! CN=.+,OU=finance,DC=office,DC=mydomain,DC=com)$` ``` **Narrow down the selection** Example: Include ONLY\* the C$ drive shares ```text Regex: \\server_name\*C$*|`^(?!\\\\server_name\\*C*\$($ \\.*)).*` ``` Example: Include ONLY one folder under a share ```text Regex: \\server\share\*folderA*|`^(?!\\\\server_name\\share\$($|\\` *folderA* `$|\\` *folderA* `\\.*)).*` ``` Example: Include ONLY all administrative shares ```text Regex: `^(?!\\\\server_name\\[a-zA-Z]\$($ )).*` ``` Note To write a backslash or a Dollar sign, add a backslash before it as an escape character. Note To add a condition in a single command, use a pipe character “|” . ## Excluding Top Level Resources Use the top level exclusion screen to select top level roots to exclude from the crawl. This setting is done per application. To exclude top level resources from the crawl process 1. Open the application screen *Admin > Applications* 1. Find the application to configure and select the drop down menu on the application line. Select **Exclude Top Level Resources** to open the configuration panel. 1. **Run Task** - The Run Task button triggers a task that runs a short detection scan to detect the current top level resources. Before running the task for the first time, the message above this button is: "Note: Run task to detect the top-level resources" If the top level resource list has changed in the application while yo u are on this screen, press this button to retrieve the updated structure. Once triggered, you can see the task status in **Settings > Task Management > Tasks**. Note This will only work if the user has access to the task page. When the task has completed, press **Refresh** to update the page with the list of top level resources. 1. Select the top level resource list, and select top level resources to exclude. 1. Select **Save** to save the change. 1. To refresh the list of top level resources, run the task again. Running the task will not clear the list of top level resources to exclude. ## Special Consideration for Long File Paths in Crawl If you need to support long file paths above 4,000 characters for the crawl, set the flag `excludeVeryLongResourcePaths` in the Permission Collection Engine App.config file to true. By default this value will be commented out and set to false. This key ensures, when enabled, that paths longer than 4000 characters are excluded from the applications’ resource discovery (Crawl), to avoid issues while storing them in the SQLServer database. When enabled, business resources with full paths longer than 4000 characters, and everything included in the hierarchical structure below them, will be excluded from the crawl, and will not be collected by File Access Manager. This scenario is extremely rare. Note You should not enable exclusion of long paths, unless you experience an issue. ### Background File Access Manager uses a hashing mechanism to create a unique identifier for each business resource stored in the File Access Manager database. The hashing mechanism in SQLServer versions 2014 and earlier, is unable to process (hash) values with 4,000 or more characters. Though resources with paths of 4000 characters or longer are extremely rare, File Access Manager is designed to handle that limitation. ### Identifying the Problem When using an SQL Server database version 2014 and earlier. The following error message in the Permission Collection Engine log file: `System.Data.SqlClient.SqlException (0x80131904): String or binary data would be truncated.` In all other cases, this feature should not be enabled. ### Setting the Long Resource Path Key The Permission Collection Engine App.config file is `RoleAnalyticsServiceHost.exe.config`, and can be found in the folder `%SailPoint_Home%\FileAccessManager\[Permission Collection instance]\` Search for the key **excludeVeryLongResourcePaths** and correct it as described above. # SQL Server Connector Overview The SQL connector enables connection to an MS SQL resource. The connector supports crawling, permissions collection and activity monitoring. ## Capabilities This connector enables you to use File Access Manager to access and analyze data stored in SQL Server and do the following: - Analyze the structure of your stored data. - Monitor user activity in the resources. - Classify the data being stored. - Verify user permissions on the resources, and compare them against requirements. - Manage access fulfillment - automated granting and revoking of access - according to rules set in File Access Manager. - Identity collector – collect IAM users, groups and roles and the connections between them. See the File Access Manager documentation for a full description. ## SQL Server Installation Flow Overview To install the SQL Server connector: 1. Configure all the prerequisites. 1. Add a new SQL Server application in the Business Website. 1. Install the relevant services: - Activity Monitor - This is the activity collection engine, used by all connectors that support activity monitoring. - Permissions CollectorIf you are using EC2 login, the collector should be installed on the EC2 instance. - Data Classification Collector Important Installing the permissions collector and data classification services is optional and should only be installed by someone with a full understanding of File Access Manager deployment architecture. The File Access Manager Administrator Guide has additional information on the architecture. ## Supported Versions The File Access Manager SQL Connector supports the following versions of MS SQLServer: - 2022 - 2019 (15.0) - 2017 (14.0) - 2016 (13.0) - 2014 (12.0) - 2012 (11.0) Note File Access Manager supports MS SQL Server versions 2012, 2014, 2016, 2017 for running the application database. This document, on the other hand, describes connecting to an MS SQL Server as an application containing business resources. ## Limitations of the SQL Server Connector The following features are not supported by the SQL Server Connector: - **Nested Roles**– Roles within other roles (Database roles and Server roles) - SQL Server Permission Covering. Refer to [Chart of SQL Server Permissions](https://docs.microsoft.com/en-us/sql/relational-databases/security/permissions-database-engine?view=sql-server-2017#chart-of-sql-server-permissions). - **Contained Users** - SQL Server Database Contained Users. Refer to [Make your database portable by using contained databases](https://docs.microsoft.com/en-us/sql/relational-databases/security/contained-database-users-making-your-database-portable). - MS SQL Server for Azure. - SQL Server Resources: - XML Schema Collections - Message Types - Contracts - Services - Remote Service Bindings - Routes - Full-text catalog and stoplists - Symmetric Key - Asymmetric Key - Certificate - Endpoints - Availability Groups - Database scoped credential File Access Manager features not supported by the SQL connector: - *What If* for local groups - Access fulfillment - Data Classification - Effective Permissions are not calculated. The flag is always set to FALSE. ## Activity Monitor Operation Principles The activity monitor collects events from the SQL server using a query that is defined in the application configuration. Each row returned by the query is an activity, and stored in the File Access Manager database. Important: Just to clarify the point, File Access Manager does not monitor database activity. It monitors a table supplied by you, analyzing the entries as activities, and entering them into the File Access Manager activity analysis engine. To configure activity monitoring in File Access Manager: 1. Identify or create a database activity table that contains the activities. 1. Create a query defining user activities as you wish to monitor them, that points to this activity table. 1. Add the query to the configuration panel described below, under Activities Query. 1. Map the fields in the Activities Query to the File Access Manager activity fields, on the same configuration panel. ## Permissions Collection Operation Principles File Access Manager connects to the SQL Server through Microsoft ODBC driver, gathers local SQL Server principals and analyzes its objects and permissions on all the server’s database instances. ## Local Principals Gathering ### Identity types Before collecting all the permission-principal relations, three types of identities are collected: - Server Logins – principals that might relate to a Windows user / active directory user or an SQL Server authentication user - Server Roles – principals that act as SQL Server groups on the entire server scope - Database Roles – principals that act as SQL Server groups on a database scope ### Principals Naming SQL Server Login names stored by the Permission Collection have certain naming patterns, whereas “domain” fields might act as – domain name, special groups such as NT SERVICE, Computer name or the server instance name. Example: `domain1\user2, NT SERVICE\MSSQLSERVER, machine45\user56` SQL Server Database Role names stored as `database name\role name`. Example: `db1\public, db2\db_owner)` ## Business Resource Full Path Conventions ### Tree Node Types Resource tree nodes can be divided into two categories: - **A Real SQL Server object node** - A server instance, table, assembly, etc. - **A Virtual SQL Server node** - Tables, Databases, Security, etc. ### Characters encoding As each real object might contain special characters such as a period (.) or back-slash (), the node name is wrapped in brackets ‘[‘ and ‘]’ Example: `[TABLE1], [VIEW1], [sp_help]` Note Virtual node names are not wrapped in brackets, since the name of virtual nodes are fixed and defined by File Access Manager. ### Root node Each resource full path starts with an instance name [SERVER\\INSTANCE NAME] ### Components - Virtual components start with a colon ( ‘:’ ) `[SERVER]:Databases` `[SERVER]:Security:Users` - Real SQL Server objects start with a period, to separate them from other components `[Server].[DB1].[Schema2].[Table3]` `[Server]:Security:Logins.[sa]` # Collecting Data Stored in an External Application ## Terminology - **Connector** - The collection of features, components and capabilities that comprise File Access Manager support for an endpoint. - **Collector** - The “Agent” component or service in a Data Classification and or Permission Collection architecture. - **Engine** - The core service counterpart of this architecture. - **Identity Collector** - A logical component used to fetch identities from an identity store and holds the configuration, settings for that identity store, and the relations between these identities. Note The identity collector has no “physical” manifest. The actual work is done by the Collector Synchronizer. The list below describes the high level installation process required to collect and analyze data from an external application. Most of these should already be set up in your File Access Manager installation. See the server Installation guide for further details. - **Install a Data Classification central engine** - One or more central engines, installed using the server installer - **Install a Permission Collection central engine** - One or more central engines, installed using the server installer - **Create an Application in File Access Manager** - From the Business Website. The application is linked to central engines listed above. - **Add an Activity Monitor** - To collect activities for this application - run the Collector Installation Manager and add an application under Activity Monitoring. ## Install Permission Collectors and / or Data Classification Collector (optional) Optionally, you can install collectors that will run on a separate server and take some of the work from the central PC and DC engines (where supported). When installing a collector, you attach it to an engine. If no collectors are installed, the central services act as both the engine and the collector. To install a collector, you must have the RabbitMQ service installed for communication between the central engines and the collectors. Note Some cloud connectors ignore collectors connected to the central engine. (Box, Dropbox, OneDrive, SharePointOnline, Exchange Online, GoogleDrive) . In these applications the task will be done entirely by the engine, and not relegated to its collectors. Note For further details, see section **Application > Central Service > Collector Relations** in the File Access Manager Administrator Guide. # Installing Services: Activity Monitor and Collectors The Collector Installation Manager is part of the File Access Manager installation package and used to install the activity monitor, permission collector, and data classification collector. 1. Run the **Collector Installation Manager** as an Administrator. The installation files are in the installation package under the folder Collectors. 1. Enter the credentials to connect to File Access Manager. - ServerName/IP should be pointed to the Agent Configuration Manager service server. - An File Access Manager user with Collector Manager permission (permission to install collectors). For Active Directory authentication, use the format domain\\username. 1. Select **Next**. The Service Configuration window is displays. 1. If you are installing the Activity Monitor, select the application. 1. Select **Add**. 1. When installing a SharePoint Activity Monitor, you'll be prompted for the service account credentials. The service account is used by the Activity Monitor service to run the service and authenticate against the SharePoint IIS servers to fetch the logs (“Log on as”). Make sure the service account provided has local administrator privileges on the local server (hosting the Activity Monitor service) and can access the activity logs on the IIS servers. 1. If you are installing the Permission Collector, select the Central Permission Collector to which to connect this service, and select **Add**. 1. If you are installing the Data Classification, select the Central Classification Collector to which to connect this service, and select **Add**. 1. Select **Next**.The Installation Folder window displays. Note If this is the first time you are installing collectors on this machine, you will be prompted to select an installation folder, in which all future collectors will also be installed. 1. Browse and select the location of the target folder for installation. 1. Browse and select the location of the folder for system logs. 1. Select **Next**. 1. The system begins installing the selected components. 1. Select **Finish** after all the selected components have been installed. Note Refer to the Admin Guide further information on the collector services. # Prerequisites Make sure your system fits the descriptions below before starting the installation. ## Software Requirements File Access Manager requires the latest ASP.NET Core 8.0.x Hosting Bundle. This bundle consists of .NET Runtime and ASP .NET Core Runtime. You can download the latest 8.0.x Hosting Bundle version from [here.](https://dotnet.microsoft.com/en-us/download/dotnet/8.0). ## Permissions File Access Manager requires the following SQL Server login permissions: - `GRANT CONNECT ANY DATABASE ON SERVER LEVEL` - `GRANT VIEW ANY DEFINITION ON SERVER LEVEL` This covers the permission: `VIEW ANY DATABASE ON SERVER LEVEL`. - `GRANT VIEW SERVER STATE ON SERVER LEVEL` ### Why do we need this access? The SQL connector uses these privileges in order to define the last access date of object in the SQL Server for use by the stale data feature. File Access Manager uses the principle of least privilege. `CONNECT ANY DATABASE` - is a simple server-level permission that provides access to all current and future databases. On its own, there is no further functionality provided, but when combined with other permissions, it enables business security needs to be met with ease. Combined with `VIEW SERVER STATE`, a login can now monitor server and database metrics via a host of dynamic management views. File Access Manager collects **last_access** properties from database metrics to define stale data. ### For users running SQL Server 2012 The permission `CONNECT ANY DATABASE` was Introduced in SQL Server 2014. For earlier versions of SQL Server, you can use a combination of the following permissions to allow the login to connect to any database, and to read from any database accessible to the user: - `CONNECT ANY DATABASE` - `SELECT ALL USER SECURABLES` ## Communications Requirements | Requirement | Source | Destination | Port | | -------------------------------------- | ------------------------------------------------- | --------------------------- | --------------------------------------------------------------------------------------------------------------------- | | File Access Manager Message Broker | Permissions Collector | RabbitMQ | 5671 | | File Access Manager Access | Activity Monitor | File Access Manager Servers | 8000-8008 | | Permissions Collection/ Activity Audit | Permissions Collector services / Activity Monitor | SQL Server Instance | As Configured in SQL Server Configuration Manager (usually TCP port 1433, Or port 0 to connect to SQL Server Browser) | # Verifying the SQL Server Connector Installation ## Installed Services Using Windows Service manager, or alternate tool, verify the File Access Manager services installed for the connector are available and running. For example: - File Access Manager Activity Monitor - `` - File Access Manager Permissions Collection - `` ## Log Files You can view these error logs to check for errors: - `%SAILPOINT_HOME_LOGS%\ FilesMiniFilter_ .log` - `%SAILPOINT_HOME_LOGS%\PermissionCollection_.log` - `%SAILPOINT_HOME_LOGS%\DataClassification_.log` ## Monitored Activities 1. Simulate activities on SQL Server. 1. Wait while activity is processed. 1. Verify that the activities display in the **File Access Manager > Forensics > Activities**. ## Permissions Collection 1. Run the Crawler and Permissions Collector tasks **Settings > Task Management > Scheduled Tasks**. 1. Verify the following: - The tasks completed successfully. - Business resources were created in the resource explorer **Admin > Applications > [application column] > Manage Resources**. - Permissions display in the Permission Forensics page **Forensics > Permissions**. # Adding an SQL Server Application To integrate with SQL Server, you must first create an application entry in File Access Manager. This entry includes the identification, connection details, and other parameters necessary to create the link. To add an application: 1. Go to **Admin > Applications**. 1. Select **Add New** to open the New Application Wizard. ## Select Wizard Type 1. Select **Standard Application** 1. Select **Next** to open the **General Details** page. ## General Details - **Application Type** - SQL Server - **Application Name** - Logical name of the application - **Description** - Description of the application - **Tags** - Select tags for the application from the dropdown menu, and / or type a new name, and select **Enter** to create a new tag. The dropdown list of tags filters out matching tags as you type and displays up to 50 tags. Note The **tags** replace the **Logical container** field that was used when creating applications in releases before 8.2. - **Event Manager Server** - This option is available if there are more than one event manager servers configured in the system. Select an event manager from the drop down menu. - **Identity Collector** - Select from the Identity Collector dropdown menu. - You can create identity collectors in the administrative client. **Applications > Configuration > Permissions Management > Identity Collectors**. Refer to **(add link to OOTB Identity Collection)** in the Collector Installation File Access Manager Administrator Guide for further details. - If adding a new identity collector, press the **Refresh** button to update the Identity Collector dropdown list. Select **Next** to open the Connection Details page. ## Connection Details - **Server / Instance Path** - The name of the SQL Server Instance. - **Port** - The port of the instance, or 0 - for SQL browser connectivity. Default is set to 1433. - **Authentication Type** - Select Windows authentication to use AD Credentials to re-authenticate for the given user/password. SQL Authentication is used by default. - **Domain Name** - For Windows authentication only. For SQL Authentication this field should remain empty. - **User Name / password** - Windows user name without domain, or SQL login for SQL authentication. Note Do not use the format domain\\username. - **Query Timeout (min)** - In minutes. The default timeout is 0, which means ‘wait indefinitely’. - **Activities Query** - This query will periodically run to fetch new activities from the table(s) defined as containing activity records. For more information, refer to [Activity Monitor Operation Principles](https://documentation.sailpoint.com/fam-connectors/help/base_product/sql_server/index.html#activity-monitor-operation-principles). - **Activity ID Column Name** - The column name in the Activities Query which identifies the unique id of the activity. This column is used to query for new activities periodically - **Business Resource Column Name** - The column name in the Activities Query which will be displayed to the user as the Business Resource Full Path in the Activities Forensics - **Domain Column Name** - The column name in the Activities Query which will be displayed to the user as the Domain in the Activities Forensics. This field is optional - **Username Column Name** - The column name in the Activities Query which will be displayed to the user as the User Name in the Activities Forensics - **Activity Timestamp Column Name** - The column name in the Activities Query which represents the time the activity occurred - **Activity Action Column Name** - The column name in the Activities Query which represents the action of the activity – not mandatory - **Sample Event Column Name** - Either by Event ID or by Date. Note The SQL Server connector adds a condition to fetch only new events for each query. This condition is created with the Sample Event Column. Select **Next**. # Configuring Activity Monitoring To configure the activity monitoring polling parameters 1. Open the edit screen of the required application 1. Go to **Admin > Applications** 1. Scroll through the list, or use the filter to find the application 1. Select the **Edit** icon on the line of the application 1. Select **Next** until you reach the **Activity Configurations & Decs** settings page. | Setting | Description | | ------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Polling Interval (sec) | Activity fetching interval (in seconds). Default is set to 60 seconds, | | Report Interval (sec) | Activity Monitor Health reporting interval (in seconds). Default is set yo 60 seconds. | | Local Buffer Size (MB) | Local buffer size for activities (in MB). Default is set to 200MB. This cyclic buffer is used to store activities on the Application Monitor machine in case of network errors that prevent the activities from being sent. | | Activity Data Retention Period | By default, this feature is disabled. When selecting the Clear Activity Data option, a user is able to provide a time frame (1 to 100) in either months or years for all activity to be retained. Once that time period is met, all data will be removed. A user can also select to backup the data before it is deleted by selecting the Backup Events Before Clearing option. **Note:** The Backup Before Clearing Option will only be enabled if the backup option is set during the system installation. If a user has not selected the backup option during the installation nor provided a backup path, this option will not be enabled. | ## Configuring Data Enrichment Connectors The Data Enrichment Connectors (DEC) configuration enables us to select data enrichment sources. These can be used to add information from other sources about identities. An enrichment source could be a local HR database that is used to combine users' job descriptions or departments to the information stored in the identity store. Select the data enrichment connectors to enrich monitored activities from the Available DECs text box. Use the > or >> arrows to move the selected DECs to the Current DECs text box. The user can select multiple DECs. Simply select each desired DEC. You can create a new DEC in the Administrative Client **Applications>Configuration>ActivityMonitoring>DataEnrichmentConnectors**. After creating a new DEC, select **Refresh** to refresh the dropdown list. Refer to (**Connectors of the File Access Manager Administrator Guide - add link**) for more information on Data Enrichment Connectors, including what they are, how to configure them, and how they fit in the Activity Flow. # Configuring and Scheduling the Permissions Collection Permissions can be analyzed to determine the application permissions of an out-of-the-box application, provided you have defined an identity store for File Access Manager to use in its analysis, and you have run a crawl for the application. The permission collector is a software component responsible for analyzing the permissions in an application. The Central Permission Collector Service is responsible for running the Permission Collector and Crawler tasks. If the IdentityIQ FAM Central Permission Collector wasn’t installed during the installation of the server, this configuration setting will be disabled. ## To configure the Permission Collection 1. Open the edit screen of the required application. 1. Go to **Admin > Applications**. 1. Scroll through the list, or use the filter to find the application. 1. Select the **Edit** icon on the line of the application. 1. Select **Next** until you reach the **Crawler & Permissions Collection** settings page. The actual entry fields vary according to the application type. Note When entering this page in edit mode, you can navigate between the various configuration windows using the **Next** and **Back** buttons. 1. **Central Permissions Collection Service** - Select a central permission collection service from the dropdown list. You can create permissions collection services as part of the service installation process. For more information, refer to **(Add link to - Services Configuration in the File Access Manager Administrator Guide)**. 1. **Skip Identities Sync during Permission Collection** - Skip identity synchronization before running permission collection tasks when the identity collector is common to different connector. Note This option is checked by default. ## Scheduling a Task To create a schedule: 1. Select **Create a Schedule**. 1. The system will provide a Schedule Name in the format `{appName} - {type} Scheduler`. Choose to keep or override this suggestion. 1. Select a scheduling frequency from the dropdown list. Schedule Frequency Options - Run After - Create dependency of tasks. The task starts running only upon successful completion of the first task. - Hourly - Set the start time. - Daily - Set the start date and time. - Weekly - Set the day(s) of the week on which to run. - Monthly - Set the day of the month on which to run a task. - Quarterly - Set a monthly schedule with an interval of 3 months. - Half Yearly - Set a monthly schedule with an interval of 6 months. - Yearly - Set a monthly schedule with an interval of 12 months. 1. Fill the Date and Time field with scheduling times. These fields differ depending upon the scheduling frequency selected. 1. Select the **Active** checkbox to activate the schedule. 1. Select **Next**. ## Configuring and Scheduling the Crawler To set or edit the Crawler configuration and scheduling 1. Open the edit screen of the required application. 1. Go to **Admin > Applications**. 1. Scroll through the list, or use the filter to find the application. 1. Select the **Edit** icon on the line of the application. 1. Select **Next** until you reach the **Crawler & Permissions Collection** settings page. The actual entry fields vary according to the application type. 1. **Create a Schedule** - Select to open the schedule panel. For more information, refer to **(Add link to - Scheduling a Task)**. ## Setting the Crawl Scope There are several options to set the crawl scope: - Setting explicit list of resources to include and / or exclude from the scan. - Creating a regex to define resources to exclude. ## Including and Excluding Paths by List To set the paths to include or exclude in the crawl process for an application 1. Open the edit screen of the required application. 1. Go to **Admin > Applications**. 1. Scroll through the list, or use the filter to find the application. 1. Select the **Edit** icon on the line of the application. 1. Press **Next** until you reach the **Crawler & Permissions Collection** settings page. The actual entry fields vary according to the application type. 1. Scroll down to the Crawl configuration settings. 1. Select **Advanced Crawl Scope Configuration** to open the scope configuration panel. 1. Select **Include / Exclude Resources** to open the input fields. 1. To add a resource to a list, type in the full path to include / exclude in the top field and select **+** to add it to the list. 1. To remove a resource from a list, find the resource from the list, and Select the *x* icon on the resource row. Note When creating exclusion lists, excludes take precedence over includes. ## Excluding Paths by Regex To set filters of paths to exclude in the crawl process for an application using regex. 1. Open the edit screen of the required application. 1. Go to **Admin > Applications**. 1. Scroll through the list, or use the filter to find the application. 1. Select the **Edit** icon on the line of the application. 1. Select **Next** until you reach the **Crawler & Permissions Collection** settings page. The actual entry fields vary according to the application type. 1. Select **Exclude Paths by Regex** to open the configuration panel. 1. Type in the paths to exclude by Regex, refer to the regex examples in the section below. Since the system does not collect BRs that match this Regex, it also does not analyze them for permissions. ## Crawler Regex Exclusion Example The following are examples of crawler Regex exclusions: **Exclude all shares which start with one or more shares names** Example: Starting with \\server_name\*shareName\* ```text Regex: `\\\\server_name\\` *shareName* `$` ``` Example: Starting with \\server_name\\shareName or \\server_name\*OtherShareName\* ```text Regex: `\\\\server_name\\(` *shareName* `|` *OtherShareName* `)$`` ``` **Include ONLY shares which start with one or more shares names** Example: Starting with \\server_name\*shareName\* ```text Regex: `^(?!\\\\server_name\\*shareName*($ \\.*)).*` ``` Example: Starting with \\server_name\*shareName\* or \\server_name\*OtherShareName\* ```text Regex: `^(?!\\\\server_name\\(` *shareName* `|` *OtherShareName* `)($|\\.*)).*` ``` **Narrow down the selection** Example: *Include ONLY* the C$ drive shares: \\server_name\*C$\* ```text Regex: `^(?!\\\\server_name\\*C*\$($ \\.*)).*` ``` Example: Include ONLY one folder under a share: \\server\\share\*folderA\* ```text Regex: `^(?!\\\\server_name\\share\$($|\\` *folderA* `$|\\` *folderA* `\\.*)).*` ``` Example: Include ONLY all administrative shares ```text Regex: `^(?!\\\\server_name\\[a-zA-Z]\$($ ))` ``` **Exclude one or more databases (For MS SQL Server)** Example: Exclude one or more databases by name ```text Regex: `[SampleDatabase3] [SampleDatabase1]` ``` **Exclude parts of a database (For MS SQL Server)** Example: Exclude an object in a database, such as a table, view etc ```text Regex: `[Database Name].[Schema Name].[Table Name]` ``` Example: For Virtual Objects propitiatory format with ":" ```text Regex: `[Database Name]:Virtual Schema Name` ``` Note To write a backslash or a Dollar sign, add a backslash before it as an escape character. Note To add a condition in a single command, use a pipe character “|”. ## Excluding Top Level Resources Use the top level exclusion screen to select top level roots to exclude from the crawl. This setting is done per application. To exclude top level resources from the crawl process: 1. Open the application screen **Admin > Applications** 1. Find the application to configure and Select the drop down menu on the application line. Select **Exclude Top Level Resources** to open the configuration panel. 1. Run Task The Run Task button triggers a task that runs a short detection scan to detect the current top level resources. Before running the task for the first time, the message above this button is: Note: Run task to detect the top-level resources. If the top level resource list has changed in the application while yo u are on this screen, press this button to retrieve the updated structure.Once triggered, you can see the task status in **Settings > Task Management > Tasks** Note This will only work if the user has access to the task page. When the task has completed, press **Refresh** to update the page with the list of top level resources. 1. Select the top level resource list, and select top level resources to exclude. 1. Select *Save* to save the change. 1. To refresh the list of top level resources, run the task again. Running the task will not clear the list of top level resources to exclude. ## Special Consideration for Long File Paths in Crawl If you need to support long file paths above 4,000 characters for the crawl, set the flag `excludeVeryLongResourcePaths` in the Permission Collection Engine App.config file to true. By default this value will be commented out and set to false. This key ensures, when enabled, that paths longer than 4000 characters are excluded from the applications’ resource discovery (Crawl), to avoid issues while storing them in the SQLServer database. When enabled, business resources with full paths longer than 4000 characters, and everything included in the hierarchical structure below them, will be excluded from the crawl, and will not be collected by File Access Manager. This scenario is extremely rare. Note You should not enable exclusion of long paths, unless you experience an issue. ### Background File Access Manager uses a hashing mechanism to create a unique identifier for each business resource stored in the File Access Manager database. The hashing mechanism in SQLServer versions 2014 and earlier, is unable to process (hash) values with 4,000 or more characters. Though resources with paths of 4000 characters or longer are extremely rare, File Access Manager is designed to handle that limitation. ### Identifying the Problem When using an SQL Server database version 2014 and earlier. The following error message in the Permission Collection Engine log file: `System.Data.SqlClient.SqlException (0x80131904): String or binary data would be truncated.` In all other cases, this feature should not be enabled. ### Setting the Long Resource Path Key The Permission Collection Engine App.config file is `RoleAnalyticsServiceHost.exe.config`, and can be found in the folder: `%SailPoint_Home%\FileAccessManager\[Permission Collection instance]\` Search for the key **excludeVeryLongResourcePaths** and correct it as described above. # Cloud File Storage The following are File Access Manager supported connectors: - AWS S3 - Azure - [Box](https://documentation.sailpoint.com/fam-connectors/help/cloud/box/index.html) - CTERA - [DropBox](https://documentation.sailpoint.com/fam-connectors/help/cloud/dropbox/index.html) - [Google Drive](https://documentation.sailpoint.com/fam-connectors/help/cloud/google-drive/index.html) # Connector Overview Accounts must be configured as described in [Prerequisites for AWS](https://documentation.sailpoint.com/fam-connectors/help/cloud/aws-s3/aws_s3_prereqs.html), for them to be analyzed. ## Capabilities This connector enables you to use File Access Manager to access and analyze data stored in AWS S3 and do the following: - Analyze the structure of your stored data. - Monitor user activity in the resources. - Classify the data being stored. - Verify user permissions on the resources, and compare them against requirements. - Manage access fulfillment - automated granting and revoking of access - according to rules set in File Access Manager. - Identity collector – collect IAM users, groups and roles and the connections between them. See the File Access Manager documentation for a full description. ## Crawler The crawler analyzes the structure of the organization and builds the hierarchy tree - Organization Root container - Organization Units (OUs) - AWS Accounts - S3 Buckets - S3 Folders Analyze all Objects in S3 Buckets - If Analyze all Objects is checked, the crawler will get also the S3 Objects (files) under the buckets, their size and total size of the containing folder. ## Permission Collector The Permission collection will retrieve and analyze the following permissions: - ACLs of buckets. If **Analyze ACLs** is checked, ACLs will be collected for the objects retrieved in the crawl. - Bucket policies for the buckets and their objects. - IAM policies which are relevant for the S3 buckets and Objects. - Account and bucket level PublicAccessBlock configurations. - Cross account permissions. Permission collection limitations and unsupported features: - Permissions are analyzed for buckets and objects, not for folders since they are not an actual object in S3. - Permissions Boundary. - Policies Conditions. - Policies Variables. - Policies elements - NotPrincipal, NotAction, NotResource. - Only S3 related permissions are analyzed. - Access points and Jobs permissions are not analyzed. ## Identity Collection The AWS identities will be collected by the permission collector at the beginning of the task. - The following identities are collected: - AWS Accounts (root users) - IAM Users - IAM Groups - IAM Roles - The AWS predefine groups are represented as the following groups: **** “Anonymous” with type "Everyone or Authenticated Users, or contains it". **** “AwsAuthenticatedUsers” with type "Everyone or Authenticated Users, or contains it". **** “S3LogDelivery” with type “Local Group”. - From each IAM Role, File Access Manager collects its trusted entities as members of the role. - The AWS entities will be mapped to the following types: - IAM Users – will be saved as FAM “Local User” type. - IAM Groups – will be saved as FAM “Local Group” type. - IAM Roles – will be saved as FAM “Local Role” type. - AWS Account – will be saved as FAM “AWS Account” type. - AWS Service – will be saved as FAM “AWS Service” type. - All other types, including “Federated”, etc. , – will be saved as FAM “AWS External Account” type. - IAM Role trusted Identity of type "\*" is represented as “**Anonymous**” with type "Everyone, Authenticated Users, or contains it". - "Principal": "\*" in bucket policy is represented as “Anonymous” with type "Everyone, Authenticated Users, or contains it". - For each Collected identity, the primary ID will be their Arn and Alternative Ids will be collected as well: - For AWS Accounts – Id, root user Arn `arn:aws:iam::{iamRootUser.Id}:root` and canonical Id. - For other identities – Id. - Additional information that is collected: - Name - Display Name - Description - Domain – will be the AccountName(#AccountId) - Email (Only for Aws Account) - LastLogin (Only for IAM Users) ## Cross Account Access To achieve cross account access, and allow an AWS IAM Identitiy from Account A to access AWS resources in account B (S3 resource in our case) two conditions must be met: 1. The IAM Identity owner account A should give permission X on the S3 resource in account B. - In File Access Manager this permission will appear as **X-ByTrustedCrossAccount**. 1. The S3 resource owner account B should give permission X on the resource to the IAM Identity from account A. - In File Access Manager this permission will appear as **X-ByTrustingCrossAccount**. Permission X will be affective only if both permissions are granted to the user / group on the resource. Otherwise, the user / group will not be allowed to perform X on this resource. In the example above, the user “FAMAdminUser1” from account “FA-QA1” has both “GetBucketLocation-ByTrustingCrossAccount” and “GetBucketLocation-ByTrustedCrossAccount” permission on bucket “bucket1-fam-qa2-user1adminpriv” from account “FAM-QA2”. ## Cross Account by Assume Roles This scenario requires 4 conditions for user USER_A from account A to have permission X on resource RESOURCE_B from account B through role ASSUME_ROLE_B: 1. ASSUME_ROLE_B is defined in account B. 1. ASSUME_ROLE_B is attached to policy that gives permission **X** on RESOURCE_B. 1. USER_A should be a member of ASSUME_ROLE - a trusted entity of the role. 1. USER_A should have in account A, permission to assume ASSUME_ROLE_B in account B. Note File Access Manager does not display this information in v8.2. In the example above, the role “FAMConnectorRole” allows “GetBucketPolicy” on bucket “fam-dev-public-bucket1”. The role and the bucket, both belong to account “FAM-Dev-Public”. The role has a member user (trusted entity) “AmirTestUser1” from account “Fam-Org”. If in account FAM-Org, “AmirTestUser1” has a policy which allows it to assume the role “FAMConnectorRole” in account “FAM-Dev-Public” (Not supported in File Access Manager view in v8.2) – The permission will be active. ## Block Public Access The Amazon S3 Block Public Access feature provides settings for buckets and accounts to help manage public access to Amazon S3 resources. By default, new buckets and objects don't allow public access. However, users can modify bucket policies or object permissions to allow public access. S3 Block Public Access settings override these policies and permissions and enable to limit public access to these resources. There are 4 settings both on the bucket level, and the account level. If the PublicAccessBlock settings are different between the bucket and the account, Amazon S3 uses the most restrictive combination of the bucket-level and account-level settings. In File Access Manager these permissions appear with the suffix “Account-Disabled” for the account level settings and “Bucket-Disabled” for the bucket level settings. If one of these settings is turned off, the Permission Forensics view shows these permissions as “Allow”. In the admin client, in **Resources > Permissions > Simple View** they will appear with warnings. ## AWS S3 Installation Flow Overview To install the AWS S3 connector: 1. Configure all the prerequisites. 1. Add a new AWS S3 application in the Business Website. 1. Install the relevant services: - Activity Monitor - This is the activity collection engine, used by all connectors that support activity monitoring. - Permissions CollectorIf you are using EC2 login, the collector should be installed on the EC2 instance. - Data Classification Collector. Important Installing the permissions collector and data classification services is optional and should only be installed by someone with a full understanding of File Access Manager deployment architecture. The File Access Manager Administrator Guide has additional information on the architecture. # Active Directory Integration with AWS Active Directory has the ability to be integrated with AWS environments and allow users to use their already established login credentials, manage their user identities outside of AWS, and give these external user identities permissions to use AWS resources in their account. When integrating Active Directory to AWS, the AWS S3 permissions needs to be mapped to the Active Directory users and groups by using an Identity Provider (IdP). We support AWS 'SAML' and 'OpenID Connect' IdPs in case this is done in one of the following two ways: - An internal configuration inside the IDP. This would be supported by using a File Access Manager data source and would include a mapping file (Excel, CSV, etc.) that the client needs to provide and maintain. - Using Active Directory group naming configuration. This method is ideal in case the client's IDP supports it and if the client created these groups. **Example:** Active Directory group name – ad-aws-int-test1#Okta_IDP_Role_2#832879285990 This is the Active Directory group name template: [some name]#[role name]#[account id]. The user configures (in File Access Manager) the regular expression (regex). **Example:** S+#(?[\\w-]+)#(?\\d+)$. We then know to use this expression to extract the IAM Role name and the AWS account ID from the Active Directory group name and do the mapping. # Prerequisites for AWS This section describes the minimal set of permissions required to configure a File Access Manager AWS connector. It is a step-by-step guide, including AWS Console Screens. Make sure your system fits the descriptions below before starting the installation. There are two methods to configure the AWS File Access Manager connector, and the require configuration is different for each. - EC2 instance to run File Access Manager (This is the recommended method). - Dedicated IAM user. ## Software Requirements File Access Manager requires the latest ASP.NET Core 8.0.x Hosting Bundle. This bundle consists of .NET Runtime and ASP .NET Core Runtime. You can download the latest 8.0.x Hosting Bundle version from [here](https://dotnet.microsoft.com/en-us/download/dotnet/8.0). ## Configuring an EC2 for File Access Manager Connector This is the recommended connection method for the File Access Manager connector. Create a role and policies to enable running the File Access Manager activities on all accounts in the organization. 1. Sign into your AWS account. 1. Create a new policy “FileAccessManager_AssumeRolePolicy”. This policy will allow the File Access Manager application, created in the next step, to perform an **Assume Role** on the roles that will be created in each account. ```text { "Version": "2012-10-17", "Statement": [ { "Sid": "VisualEditor0", "Effect": "Allow", "Action": "sts:AssumeRole", "Resource": "arn:aws:iam::*:role/IdentityIQ_FileAccessManagerRole" } ] } ``` 1. Create a new role. - Select **AWS Service** as the trusted entity type. - Select EC2 as the service. 1. Attach the role to the FileAccessManager_AssumeRolePolicy policy created above. 1. Give the role a name (e.g. FileAccessManager_EC2_Role) and create it. 1. If you are creating a **new** EC2 instance select the above role as the IAM role for the instance. 1. If you are using an **existing** EC2 instance, modify the IAM role to the role above in the option **EC2 > Instances > Actions > Security > Modify IAM role**. 1. Create a new policy for each organization account the connector is supposed to analyze. Create a new policy called “FileAccessManager_S3IAMReadOnlyAccessPolicy” with all the required permissions for the connector. ```text { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets", "s3:ListBucket", "s3:GetBucketAcl", "s3:GetBucketLocation", "s3:GetBucketPolicy", "s3:GetBucketPolicyStatus", "s3:GetBucketPublicAccessBlock", "s3:GetAccountPublicAccessBlock", "s3:GetObject", "s3:GetObjectAcl", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListGroupPolicies", "iam:ListGroups", "iam:ListPolicies", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListRoles", "iam:ListUserPolicies", "iam:ListUsers", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRolePolicy", "iam:GetUserPolicy", "organizations:ListAccountsForParent", "organizations:ListRoots", "organizations:ListAccounts", "organizations:ListOrganizationalUnitsForParent" ], "Resource": "*" } ] } ``` 1. Create a new role for the File Access Manager user to assume. On each organization account the connector should analyze, create a new role called “FileAccessManagerRole” which the FAM user will assume. Select **Another AWS Account** and enter the account Id of the organization’s management account. Important The role name should be kept as **FileAccessManagerRole**. 1. Attach the FileAccessManager_S3IAMReadOnlyAccessPolicy policy created above. 1. Enter the role name - FileAccessManagerRole. 1. Edit the trust relationship of the new role. 1. Edit the json file. Replace “root” in the Principal section with `assumed-role/{**EC2 role name**}/{**EC2 instance ID**}` Where: - “EC2 role name” is the name of the role created above (“FileAccessManager_EC2_Role“ in this manual). - “EC2 instance ID” is the ID of the instance on which the FAM application is installed. ```text { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "AWS": [ "AWS": "arn:aws:iam::{The EC2 instance account Id}:assumed-role/{EC2 instance role name}/{EC2 instance Id}" ] }, "Action": "sts:AssumeRole" } ] } ``` ## Creating a Dedicated IAM User Note The recommended method to install the File Access Manager connector is using the EC2 Login method. See [Configuring an EC2 for File Access Manager Connector](https://documentation.sailpoint.com/fam-connectors/help/cloud/aws-s3/aws_s3_prereqs.html#configuring-an-ec2-for-file-access-manager-connector). If you wish to use a dedicated IAM user login instead, follow this section: To configure the connector, create dedicated users with the appropriate users and policies: 1. Sign into your organization’s management account. 1. Create a new policy “IdentityIQ_FileAccessManager_AssumeRolePolicy”. This policy will allow the File Access Manager user created in the next step to perform an **Assume Role** on the roles that will be created in each account. ```text { "Version": "2012-10-17", "Statement": [ { "Sid": "VisualEditor0", "Effect": "Allow", "Action": "sts:AssumeRole", "Resource": "arn:aws:iam::*:role/IdentityIQ_FileAccessManagerRole" } ] } ``` 1. Create an IAM User for File Access Manager and select Programmatic access. This access requires an access key and secret key. 1. Attach the policy IdentityIQ_FileAccessManager_AssumeRolePolicy policy created above to the new user. 1. Save the generated Access Key and Secret Key in a secure place. 1. On each organization account the connector should analyze - Create new policy “*IdentityIQ_FileAccessManager_S3IAMReadOnlyAccessPolicy*” with all the required permissions for the connector. ```text { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets", "s3:ListBucket", "s3:GetBucketAcl", "s3:GetBucketLocation", "s3:GetBucketPolicy", "s3:GetBucketPolicyStatus", "s3:GetBucketPublicAccessBlock", "s3:GetAccountPublicAccessBlock", "s3:GetObject", "s3:GetObjectAcl", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListGroupPolicies", "iam:ListGroups", "iam:ListPolicies", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListRoles", "iam:ListUserPolicies", "iam:ListUsers", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRolePolicy", "iam:GetUserPolicy", "organizations:ListAccountsForParent", "organizations:ListRoots", "organizations:ListAccounts", "organizations:ListOrganizationalUnitsForParent" ], "Resource": "*" } ] } ``` . 1. Create a new role “*IdentityIQ_FileAccessManagerRole*” which the File Access Manager user will assume on each organization account the connector should analyze. Select **Another AWS Account** and enter the user account ID. 1. Attach the policy *IdentityIQ_FileAccessManager_S3IAMReadOnlyAccessPolicy* created above. 1. Enter the role name - *IdentityIQ_FileAccessManagerRole*. Important This name cannot be changed. 1. Edit the trust relationship of the new role. 1. Edit the json file. Replace “root” in the Principal section with `user/{FAM IAM User username}` Where: - “FAM IAM User username” is the user created above. ```text { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "AWS": [ "arn:aws:iam::{The user account ID}:user/{FAM IAM User username}" ] }, "Action": "sts:AssumeRole" } ] } ``` # Collecting Data Stored in an External Application ## Terminology - **Connector** - The collection of features, components and capabilities that comprise File Access Manager support for an endpoint. - **Collector** - The “Agent” component or service in a Data Classification and or Permission Collection architecture. - **Engine** - The core service counterpart of this architecture. - **Identity Collector** - A logical component used to fetch identities from an identity store and holds the configuration, settings for that identity store, and the relations between these identities. The identity collector has no “physical” manifest. The actual work is done by the Collector Synchronizer. ## Configuring Data Collection and Analysis The list below describes the high level installation process required to collect and analyze data from an external application. Most of these should already be set up in your File Access Manager installation. See the server Installation guide for further details. - **Install a Data Classification central engine** - One or more central engines, installed using the server installer. - **Install a Permission Collection central engine** - One or more central engines, installed using the server installer. - **Create an Application in File Access Manager** - From the Business Website. The application is linked to central engines listed above. - **Add an Activity Monitor** - To collect activities for this application - run the Collector Installation Manager and add an application under Activity Monitoring. ## Installing Permission Collectors and / or Data Classification Collector (optional) Optionally, you can install collectors that will run on a separate server and take some of the work from the central PC and DC engines (where supported). When installing a collector, you attach it to an engine. If no collectors are installed, the central services act as both the engine and the collector. To install a collector, you must have the RabbitMQ service installed for communication between the central engines and the collectors. RabbitMQ is installed. Notes - Some cloud connectors ignore collectors connected to the central engine (Box, Dropbox, OneDrive, SharePointOnline, Exchange Online, GoogleDrive). In these applications the task will be done entirely by the engine, and not relegated to its collectors. - For further details, see section **Application > Central Service > Collector Relations** in the File Access Manager Administrator Guide. # Installing Services: Collector Installation The Collector Installation Manager is part of the File Access Manager installation package. This tool is used to install the activity monitor, permission collector, and data classification collector. 1. Run the **Collector Installation Manager** as an Administrator. The installation files are in the installation package under the folder Collectors. The Collector Installation Manager window displays. 1. Enter the credentials to connect to File Access Manager. - ServerName/IP should be pointed to the Agent Configuration Manager service server. - A File Access Manager user with Collector Manager permission (permission to install collectors). For Active Directory authentication, use the format domain\\username. 1. Select **Next**. The Service Configuration window displays. 1. If you are installing the Permission Collector, select the Central Permission Collector to which to connect this service, and select **Add**. 1. If you are installing the Data Classification, select the Central Classification Collector to which to connect this service, and select **Add**. 1. Select **Next**. The Installation Folder window displays. Note If this is the first time you are installing collectors on this machine, you will be prompted to select an installation folder, in which all future collectors will also be installed. 1. Browse and select the location of the target folder for installation. 1. Browse and select the location of the folder for system logs. 1. Select **Next**. 1. The system begins installing the selected components. 1. Select **Finish**. The Finish button is displayed after all the selected components have been installed. Note The File Access Manager Administrator Guide provides more information on the collector services. # Appendix A: JSON Scripts This appendix includes the scripts required for creating the roles and policies mentioned in this guide. Please make sure not to change the file names. ## IdentityIQ_FileAccessManagerRole.json [EC2] This is the version of the role to create for installation using an EC2 login. Identity IQ File Access Manager Role" JSON Sample ```json { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "AWS": [ "AWS": "arn:aws:iam::{The EC2 instance account Id}:assumed-role/{EC2 instance role name}/{EC2 instance Id}" ] }, "Action": "sts:AssumeRole" } ] } ``` ## IdentityIQ_FileAccessManagerRole.json [Dedicated User] This is the version of the role to create for installation using a dedicated IAM user login. Identity IQ File Access Manager Role" JSON Sample ```json { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "AWS": [ "arn:aws:iam::{The user account ID}:user/{FAM IAM User username}" ] }, "Action": "sts:AssumeRole" } ] } ``` ## IdentityIQ_FileAccessManager_AssumeRolePolicy.json Identity IQ File Access Manager Role" JSON Sample ```json { "Version": "2012-10-17", "Statement": [ { "Sid": "VisualEditor0", "Effect": "Allow", "Action": "sts:AssumeRole", "Resource": "arn:aws:iam::*:role/IdentityIQ_FileAccessManagerRole" } ] } ``` ## IdentityIQ_FileAccessManager_S3IAMReadOnlyAccessPolicy.json Identity IQ File Access Manager Role" JSON Sample ```json { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:ListAllMyBuckets", "s3:ListBucket", "s3:GetBucketAcl", "s3:GetBucketLocation", "s3:GetBucketPolicy", "s3:GetBucketPolicyStatus", "s3:GetBucketPublicAccessBlock", "s3:GetAccountPublicAccessBlock", "s3:GetObject", "s3:GetObjectAcl", "iam:ListAttachedGroupPolicies", "iam:ListAttachedRolePolicies", "iam:ListAttachedUserPolicies", "iam:ListGroupPolicies", "iam:ListGroups", "iam:ListPolicies", "iam:ListPolicyVersions", "iam:ListRolePolicies", "iam:ListRoles", "iam:ListUserPolicies", "iam:ListUsers", "iam:GetGroup", "iam:GetGroupPolicy", "iam:GetPolicy", "iam:GetPolicyVersion", "iam:GetRolePolicy", "iam:GetUserPolicy", "organizations:ListAccountsForParent", "organizations:ListRoots", "organizations:ListAccounts", "organizations:ListOrganizationalUnitsForParent" ], "Resource": "*" } ] } ``` # Mapping Extractions from IDPs This section provide the steps to extract mappings from the following IDPs: - Okta - ADFS - Azure AD - Ping ## Okta In Okta, use the [Okta API Reference Overview: Okta Developer](https://developer.okta.com/docs/reference/), to get the Active Directory identities - AWS identities mappings. 1. Get the AWS application and extract the Account ID from the `identityProviderArn` property. Okta Documentation [Apps: Okta Developer](https://developer.okta.com/docs/reference/api/apps/) Request Example `https://{yourOktaDomain}/api/v1/apps/{applicationId}` Response Example ```json { "id": "0oapruvo3xnNEuI12345", "name": "amazon_aws", "label": "AWS Account Federation", "status": "ACTIVE", "lastUpdated": "2021-08-02T14:51:07.000Z", "created": "2021-07-22T11:00:28.000Z", "accessibility": { "selfService": false, "errorRedirectUrl": null, "loginRedirectUrl": null }, "visibility": { "autoLaunch": false, "autoSubmitToolbar": true, "hide": { "iOS": false, "web": false }, "appLinks": { "login": true } }, "features": [ "PUSH_NEW_USERS", "PUSH_PROFILE_UPDATES" ], "signOnMode": "SAML_2_0", "credentials": { "userNameTemplate": { "template": "${source.login}", "type": "BUILT_IN" }, "signing": { "kid": "BNfWuNclhWcvmRpgv2C8MoP1A34vLbDMNQ2odOK97VY" } }, "settings": { "app": { "appFilter": "okta", "groupFilter": "aws_(?{{accountid}}\\d+)_(?{{role}}[a-zA-Z0-9+=,.@\\-_]+)", "secretKey": null, "useGroupMapping": true, "joinAllRoles": true, "identityProviderArn": "arn:aws:iam::832879212345:saml-provider/okta2", "overrideAcsURL": null, "sessionDuration": 3600, "roleValuePattern": "arn:aws:iam::${accountid}:saml-provider/okta2, arn:aws:iam::${accountid}:role/${role}", "awsEnvironmentType": "aws.amazon", "accessKey": null, "loginURL": "https://console.aws.amazon.com/ec2/home", "secretKeyEnc": null }, "notifications": { "vpn": { "network": { "connection": "DISABLED" }, "message": null, "helpUrl": null } }, "notes": { "admin": null, "enduser": null }, "signOn": { "defaultRelayState": null, "ssoAcsUrlOverride": null, "audienceOverride": null, "recipientOverride": null, "destinationOverride": null, "attributeStatements": [] } }, "_links": { "help": { "href": "https://sailpointamirmono-admin.okta.com/app/amazon_aws/0oapruvo3xnNEuI12345/setup/help/SAML_2_0/external-doc", "type": "text/html" }, "metadata": { "href": "https://sailpointamirmono.okta.com/api/v1/apps/0oapruvo3xnNEuI12345/sso/saml/metadata", "type": "application/xml" }, "uploadLogo": { "href": "https://sailpointamirmono.okta.com/api/v1/apps/0oapruvo3xnNEuI12345/logo", "hints": { "allow": [ "POST" ] } }, "appLinks": [ { "name": "login", "href": "https://sailpointamirmono.okta.com/home/amazon_aws/0oapruvo3xnNEuI12345/272", "type": "text/html" } ], "groups": { "href": "https://sailpointamirmono.okta.com/api/v1/apps/0oapruvo3xnNEuI12345/groups" }, "logo": [ { "name": "medium", "href": "https://ok14static.oktacdn.com/fs/bcg/4/gfs1f2p5y2qNcK02w1d8", "type": "image/png" } ], "users": { "href": "https://sailpointamirmono.okta.com/api/v1/apps/0oapruvo3xnNEuI12345/users" }, "deactivate": { "href": "https://sailpointamirmono.okta.com/api/v1/apps/0oapruvo3xnNEuI12345/lifecycle/deactivate" } } } ``` 1. Get the applications users and groups and extract the role names from "profile" > "role". 1. Build the role ARN from the Account ID and Role Name and get the user and group Okta ID. Okta Documentation [Groups: Okta Developer](https://developer.okta.com/docs/reference/api/groups/) [Users: Okta Developer](https://developer.okta.com/docs/reference/api/users/) Request Example `https://{yourOktaDomain}/api/v1/apps/{applicationId}/users` `https://{yourOktaDomain}/api/v1/apps/{applicationId}/groups` Response Example ```json [ { "id": "00gpsbh7o3OJOfoeV695", "lastUpdated": "2021-08-22T14:32:44.000Z", "priority": 0, "profile": { "role": "AWSServiceRoleForCloudTrail", "samlRoles": [ "Okta_IDP_Role_2" ] }, "_links": { "app": { "href": "https://sailpointamirmono.okta.com/api/v1/apps/0oapruvo3xnNEuI12345" }, "self": { "href": "https://sailpointamirmono.okta.com/api/v1/apps/0oapruvo3xnNEuI12345/groups/00gpsbh7o3OJOfo12345" }, "group": { "href": "https://sailpointamirmono.okta.com/api/v1/groups/00gpsbh7o3OJOfo12345" } } }, { "id": "00gymrmrGOkWUyKGf695", "lastUpdated": "2021-08-22T14:35:17.000Z", "priority": 1, "profile": { "role": "AWSServiceRoleForCloudTrail", "samlRoles": [ "Okta_IDP_Role" ] }, "_links": { "app": { "href": "https://sailpointamirmono.okta.com/api/v1/apps/0oapruvo3xnNEuI12345" }, "self": { "href": "https://sailpointamirmono.okta.com/api/v1/apps/0oapruvo3xnNEuI12345/groups/00gymrmrGOkWUyK12345" }, "group": { "href": "https://sailpointamirmono.okta.com/api/v1/groups/00gymrmrGOkWUyK12345" } } } ] ``` 1. List all the groups and users and get the groups and users names by the ID. Okta Documentation [Groups: Okta Developer](https://developer.okta.com/docs/reference/api/groups/) [Users: Okta Developer](https://developer.okta.com/docs/reference/api/users/) Request Example `https://{yourOktaDomain}/api/v1/groups` `https://{yourOktaDomain}/api/v1/users` Response Example ```json [ { "id": "00gymrmrGOkWUyK12345", "created": "2021-07-29T10:40:08.000Z", "lastUpdated": "2021-07-29T10:40:08.000Z", "lastMembershipUpdated": "2021-07-29T10:41:25.000Z", "objectClass": [ "okta:user_group" ], "type": "OKTA_GROUP", "profile": { "name": "aws_832879285990_Okta_IDP_Role_2", "description": null }, "_links": { "logo": [ { "name": "medium", "href": "https://ok14static.oktacdn.com/assets/img/logos/groups/odyssey/okta-medium.1a5ebe44c4244fb796c235d86b47e3bb.png", "type": "image/png" }, { "name": "large", "href": "https://ok14static.oktacdn.com/assets/img/logos/groups/odyssey/okta-large.d9cfbd8a00a4feac1aa5612ba02e99c0.png", "type": "image/png" } ], "users": { "href": "https://sailpointamirmono.okta.com/api/v1/groups/00gymrmrGOkWUyK12345/users" }, "apps": { "href": "https://sailpointamirmono.okta.com/api/v1/groups/00gymrmrGOkWUyK12345/apps" } } }, { "id": "00gpsbh7o3OJOfo12345", "created": "2021-07-22T09:26:50.000Z", "lastUpdated": "2021-07-22T09:26:50.000Z", "lastMembershipUpdated": "2021-07-29T10:41:25.000Z", "objectClass": [ "okta:user_group" ], "type": "BUILT_IN", "profile": { "name": "Everyone", "description": "All users in your organization" }, "_links": { "logo": [ { "name": "medium", "href": "https://ok14static.oktacdn.com/assets/img/logos/groups/odyssey/okta-medium.1a5ebe44c4244fb796c235d86b47e3bb.png", "type": "image/png" }, { "name": "large", "href": "https://ok14static.oktacdn.com/assets/img/logos/groups/odyssey/okta-large.d9cfbd8a00a4feac1aa5612ba02e99c0.png", "type": "image/png" } ], "users": { "href": "https://sailpointamirmono.okta.com/api/v1/groups/00gpsbh7o3OJOfo12345/users" }, "apps": { "href": "https://sailpointamirmono.okta.com/api/v1/groups/00gpsbh7o3OJOfo12345/apps" } } } ] ``` ## ADFS In ADFS, the Active Directory identities-AWS identities mapping is done on one of the Active Directory identity attributes. For more information, see [Establish Federated Access to AWS Resources by Using AD User Attributes](https://aws.amazon.com/blogs/security/how-to-establish-federated-access-to-your-aws-resources-by-using-active-directory-user-attributes/). See - A. Configure an AD user’s account. Filter all the users and groups with the specific attribute and export it to a csv or Excel file. PS Example `Get-ADUser -Filter 'url -like "*AWS*"' -properties "url" | Export-Csv c:\file.csv` Response Example ```json #TYPE Microsoft.ActiveDirectory.Management.ADUser,,,,,,,,,, DistinguishedName,Enabled,GivenName,Name,ObjectClass,ObjectGUID,SamAccountName,SID,Surname,url,UserPrincipalName "CN=Adiel,CN=Users,DC=office,DC=whitebox,DC=forest",TRUE,Adiel,Adiel,user,e3fe35c1-0daf-4379-a379-73364ec12345,Adiel,S-1-5-21-3335839157-1594281566-240188981-12345,Moshed,Microsoft.ActiveDirectory.Management.ADPropertyValueCollection,Adiel@office.whitebox.forest ``` Note Remember that the response will be exported to a csv or Excel file. ## Azure AD In Azure AD, it is possible to get the AD identities-AWS identities mapping by using Microsoft Graph. 1. Get all the AWS account’s roles by the `AWS Single-Account Access` Object ID (one account per request). 1. Acquire the roles ARNs. Request Example `https://graph.microsoft.com/beta/servicePrincipals/{AWS Single-Account Access object id}` Response Example ```json { "@odata.context": "https://graph.microsoft.com/beta/$metadata#servicePrincipals/$entity", "@odata.id": "https://graph.microsoft.com/v2/154dccc9-b44e-4883-860c-12345/directoryObjects/726e2abf-b192-462d-a977-12345/Microsoft.DirectoryServices.ServicePrincipal", "id": "726e2abf-b192-462d-a977-12345", "deletedDateTime": null, "accountEnabled": true, "alternativeNames": [], "createdDateTime": "2021-09-05T11:27:45Z", "deviceManagementAppType": null, "appDescription": null, "appDisplayName": "AWS Single-Account Access", "appId": "944b9a2c-51dd-41eb-a018-12345", "applicationTemplateId": "8b1025e4-1dd2-430b-a150-12345", "appOwnerOrganizationId": "154dccc9-b44e-4883-860c-12345", "appRoleAssignmentRequired": true, "description": null, "disabledByMicrosoftStatus": null, "displayName": "AWS Single-Account Access", "errorUrl": null, "homepage": "https://signin.aws.amazon.com/saml?metadata=aws|ISV9.1|primary|z", "isAuthorizationServiceEnabled": false, "isManagementRestricted": null, "loginUrl": null, "logoutUrl": null, "notes": null, "notificationEmailAddresses": [ "admin@501.sailpointtechnologies.com" ], "preferredSingleSignOnMode": "saml", "preferredTokenSigningKeyEndDateTime": null, "preferredTokenSigningKeyThumbprint": null, "publisherName": "SailPoint Technologies, Inc.", "replyUrls": [ "https://signin.aws.amazon.com/saml" ], "samlMetadataUrl": null, "servicePrincipalNames": [ "944b9a2c-51dd-41eb-a018-12345" ], "servicePrincipalType": "Application", "signInAudience": "AzureADMyOrg", "tags": [ "WindowsAzureActiveDirectoryIntegratedApp" ], "tokenEncryptionKeyId": null, "samlSingleSignOnSettings": null, "verifiedPublisher": { "displayName": null, "verifiedPublisherId": null, "addedDateTime": null }, "addIns": [], "api": { "resourceSpecificApplicationPermissions": [] }, "appRoles": [ { "allowedMemberTypes": [ "User" ], "description": "msiam_access", "displayName": "msiam_access", "id": "7dfd756e-8c27-4472-b2b7-12345", "isEnabled": true, "origin": "Application", "value": null }, { "allowedMemberTypes": [ "User" ], "description": "ChessPlayersRole", "displayName": "ChessPlayersRole,Okta1", "id": "2d9e11e2-14c9-4f34-bf19-12345", "isEnabled": true, "origin": "ServicePrincipal", "value": "arn:aws:iam::832879212345:role/ChessPlayersRole,arn:aws:iam::832879212345:saml-provider/Okta1" }, { "allowedMemberTypes": [ "User" ], "description": "DOMAIN_ALIAS_RID_ADMIN-AWS", "displayName": "DOMAIN_ALIAS_RID_ADMIN-AWS,Azure_test1", "id": "ad3d751a-b615-4bf7-930b-c06a62712345", "isEnabled": true, "origin": "ServicePrincipal", "value": "arn:aws:iam::832879212345:role/DOMAIN_ALIAS_RID_ADMIN-AWS,arn:aws:iam::832879212345:saml-provider/Azure_test1" } ], "info": { "termsOfServiceUrl": null, "supportUrl": null, "privacyStatementUrl": null, "marketingUrl": null, "logoUrl": null }, "keyCredentials": [], "publishedPermissionScopes": [ { "adminConsentDescription": "Allow the application to access AWS Single-Account Access on behalf of the signed-in user.", "adminConsentDisplayName": "Access AWS Single-Account Access", "id": "419e3996-3684-4265-890a-12345", "isEnabled": true, "type": "User", "userConsentDescription": "Allow the application to access AWS Single-Account Access on your behalf.", "userConsentDisplayName": "Access AWS Single-Account Access", "value": "user_impersonation" } ], "passwordCredentials": [], "resourceSpecificApplicationPermissions": [] } ``` 1. Get the users and groups which are assigned to the AWS roles. 1. Acquire the users and groups details. Request Example `https://graph.microsoft.com/beta/servicePrincipals/{AWS Single-Account Access object id}/appRoleAssignedTo` Response Example ```json { "@odata.context": "https://graph.microsoft.com/beta/$metadata#appRoleAssignments", "value": [ { "@odata.id": "https://graph.microsoft.com/v2/154dccc9-b44e-4883-860c-12345/directoryObjects/$/Microsoft.DirectoryServices.ServicePrincipal('726e2abf-b192-462d-a977-12345')/appRoleAssignedTo/v9raS1IPQkuV98HJH2Uqhsg4ilzG80ZOi0OMy-8m5iw", "id": "v9raS1IPQkuV98HJH2Uqhsg4ilzG80ZOi0OMy-8m5iw", "creationTimestamp": "2021-09-09T11:45:26.3084935Z", "appRoleId": "d3a9b01b-1736-4f1b-ac5f-12345", "principalDisplayName": "anatoly_azure_gr1", "principalId": "4bdadabf-0f52-4b42-95f7-12345", "principalType": "Group", "resourceDisplayName": "AWS Single-Account Access", "resourceId": "726e2abf-b192-462d-a977-12345" }, { "@odata.id": "https://graph.microsoft.com/v2/154dccc9-b44e-4883-860c-12345/directoryObjects/$/Microsoft.DirectoryServices.ServicePrincipal('726e2abf-b192-462d-a977-12345')/appRoleAssignedTo/CF0PHVm9hka00WBTgEPxaoZKebW4inxCsBpqIGxRwFI", "id": "CF0PHVm9hka00WBTgEPxaoZKebW4inxCsBpqIGxRwFI", "creationTimestamp": "2021-09-09T11:45:26.3302622Z", "appRoleId": "d3a9b01b-1736-4f1b-ac5f-12345", "principalDisplayName": "anatoly_azure_group3", "principalId": "1d0f5d08-bd59-4686-b4d1-12345", "principalType": "Group", "resourceDisplayName": "AWS Single-Account Access", "resourceId": "726e2abf-b192-462d-a977-12345" }, { "@odata.id": "https://graph.microsoft.com/v2/154dccc9-b44e-4883-860c-12345/directoryObjects/$/Microsoft.DirectoryServices.ServicePrincipal('726e2abf-b192-462d-a977-12345')/appRoleAssignedTo/INRoSKbmpUaZrnYaVRU3XMRgM8C1kZ9GjHjSB9vW1e4", "id": "INRoSKbmpUaZrnYaVRU3XMRgM8C1kZ9GjHjSB9vW1e4", "creationTimestamp": "2021-09-09T11:32:47.4228653Z", "appRoleId": "277f83e1-4903-4b06-baf7-12345", "principalDisplayName": "Adiel", "principalId": "4868d420-e6a6-46a5-99ae-12345", "principalType": "User", "resourceDisplayName": "AWS Single-Account Access", "resourceId": "726e2abf-b192-462d-a977-12345" } ] } ``` # Verifying the AWS S3 Connector Installation ## Installed Services Verify that the services installed for the connector are available and active. Using windows Service manager, or other tool, look for the File Access Manager services, and see that they are running. For example: - File Access Manager Central Activity Monitor - `` ## Log Files Check the log files listed below for errors: - `%SAILPOINT_HOME_LOGS%\ FilesMiniFilter_ .log` - `%SAILPOINT_HOME_LOGS%\PermissionCollection_.log` - `%SAILPOINT_HOME_LOGS%\DataClassification_.log` ## Permissions Collection 1. Run the Crawler and Permissions Collector tasks (**Settings > Task Management > Scheduled Tasks**) 1. Verify that: - The tasks completed successfully. - Business resources were created in the resource explorer (**Admin > Applications > *[application column]* > Manage Resources**). - Permissions display in the Permission Forensics page (**Forensics > Permissions**). # Adding a AWS S3 Application In order to integrate with AWS S3, we must first create an application entry in File Access Manager. This entry includes the identification, connection details, and other parameters necessary to create the link. To add an application, use the New Application Wizard. 1. Go to to **Admin > Applications**. 1. Select **Add New** to open the wizard. ## Select Wizard Type 1. Select **Standard Application** 1. Select **Next** to open the **General Details** page. ## General Details - **Application Type** - AWS S3. - **Application Name** - Logical name of the application. - **Description** - Description of the application. - **Tags** - Select tags for the application from the dropdown menu, and / or type a new name, and select **Enter** to create a new tag. The dropdown list of tags filters out matching tags as you type and displays up to 50 tags. Note The **tags** replace the **Logical container** field that was used when creating applications in releases before 8.2. - **Event Manager Server** - This option is available if there are more than one event manager servers configured in the system. Select an event manager from the drop down menu. Select **Next**. to open the **Connection Details** page. ## Connection Details Complete the Connection Details fields: - Server Name - The name of the CTERA Master Gateway. - Domain Name - The user defined in the prerequisites. - User / Password - Credentials of the user defined in the prerequisites. This must be an admin user on the CTERA master gateway. Select **Next**. # Configuring and Scheduling the Permissions Collection Permissions can be analyzed to determine the application permissions of an out-of-the-box application, provided you have defined an identity store for File Access Manager to use in its analysis, and you have run a crawl for the application. The permission collector is a software component responsible for analyzing the permissions in an application. The Central Permission Collector Service is responsible for running the Permission Collector and Crawler tasks. If the “File Access Manager Central Permission Collector” wasn’t installed during the installation of the server, this configuration setting will be disabled. ## Configuring the Permission Collection 1. Open the edit screen of the required application. - Go to **Admin > Applications**. - Scroll through the list, or use the filter to find the application. - Select the edit icon on the line of the application. 1. Select **Next** until you reach the **Crawler & Permissions Collection** settings page. The actual entry fields vary according to the application type. When entering this page in edit mode, you can navigate between the various configuration windows using the **Next** and **Back** buttons. - **Central Permissions Collection Service** - Select a central permission collection service from the dropdown list. You can create permissions collection services as part of the service installation process. See section "Services Configuration" in the File Access Manager Administrator Guide for further details. - **Skip Identities Sync during Permission Collection** - Skip identity synchronization before running permission collection tasks when the identity collector is common to different connector. Note This option is checked by default. - **Active Directory Group Regex** - If matching an Active Directory group to an AWS IAM role is done by the Active Directory group naming convention, enter a regex. This will enable extracting the AWS account ID and name role from the group. The regex must include these exact named groups in this exact format: - `` - `` You can now [schedule a task](#scheduling-a-task). ## Scheduling a Task To create a schedule: 1. Select **Create a Schedule**. 1. The system will provide a Schedule Name in the format `{appName} - {type} Scheduler`. Choose to keep or override this suggestion. 1. Select a scheduling frequency from the dropdown list. Schedule Frequency Options - Run After - Create dependency of tasks. The task starts running only upon successful completion of the first task. - Hourly - Set the start time. - Daily - Set the start date and time. - Weekly - Set the day(s) of the week on which to run. - Monthly - Set the day of the month on which to run a task. - Quarterly - Set a monthly schedule with an interval of 3 months. - Half Yearly - Set a monthly schedule with an interval of 6 months. - Yearly - Set a monthly schedule with an interval of 12 months. 1. Fill the Date and Time field with scheduling times. These fields differ depending upon the scheduling frequency selected. 1. Select the **Active** checkbox to activate the schedule. 1. Select **Next**. ## Configuring and Scheduling the Crawler **Set or edit the Crawler configuration and scheduling** 1. Open the edit screen of the required application. - Go to **Admin > Applications**. - Scroll through the list, or use the filter to find the application. - Select the edit icon on the line of the application. 1. Select **Next** until you reach the **Crawler & Permissions Collection** settings page. The actual entry fields vary according to the application type. **Create a Schedule** - Select to open the schedule panel. See Scheduling a Task. ## Setting the Crawl Scope There are several options to set the crawl scope: - Setting explicit list of resources to include and / or exclude from the scan. - Creating a regex to define resources to exclude. ## Including and Excluding Paths by List To set the paths to include or exclude in the crawl process for an application: 1. Open the edit screen of the required application. - Go to **Admin > Applications**. - Scroll through the list, or use the filter to find the application. - Select the edit icon on the line of the application. 1. Select **Next** until you reach the **Crawler & Permissions Collection** settings page.\ The actual entry fields vary according to the application type. 1. Scroll down to the **Crawl configuration** settings. 1. Select **Advanced Crawl Scope Configuration** to open the scope configuration panel. 1. Select **Include / Exclude Resources** to open the input fields. 1. To add a resource to a list, type in the full path to include / exclude in the top field and select **+** to add it to the list. 1. To remove a resource from a list, find the resource from the list, and select the *x* icon on the resource row. Note When creating exclusion lists, excludes take precedence over includes. ## Excluding Paths by Regex Set filters of paths to exclude in the crawl process for an application using regex: 1. Open the edit screen of the required application. - Go to **Admin > Applications**. - Scroll through the list, or use the filter to find the application. - Select the edit icon on the line of the application. 1. Select **Next** until you reach the **Crawler & Permissions Collection** settings page.\ The actual entry fields vary according to the application type. 1. Select **Exclude Paths by Regex** to open the configuration panel. 1. Type in the paths to exclude by Regex. See regex examples in the section below. Since the system does not collect BRs that match this Regex, it also does not analyze them for permissions. ## Crawler Regex Exclusion Examples The following are examples of crawler Regex exclusions: **Exclude all bucket folders which start with one or more folder names:** | Example | Regex | | -------------------------------------------------------------------------------- | ------------------------------------------------------------------------------- | | All starting with folderName under path | `^Root\/[account_name]\(#[AccountID]\)\/s3.[region].[bucket_name]\/folder_name` | | Real Example Path: `Root/my-account(#1234567890)/s3.ap-south-1.bucket1/myFolder` | `^Root\/my-account\(#1234567890\)\/s3.ap-south-1.bucket1\/myFolder` | | All starting with folderName of otherFolderName under path | \`^Root/\[account_name\](#[AccountID])/s3.[region].[bucket_name]/(folderName | **Include ONLY bucket folders that start with one or more folder names:** | Example | Regex | | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------- | | Starting with folderName under path | \`^(?!Root($ | | Real Example Path: `Root/FAM_Test(#1234567890)/s3.us-west-1.service/logs/logs_01` `Root/FAM_Test(#1234567890)/s3.us-west-1.service/logs/logs_02` `Root/FAM_Test(#1234567890)/s3.us-west-1.service/logs/logs_03` | \`^(?!Root/FAM_Test($ | | Starting with folderName of otherFolderName under path | \`^(?!Root($ | ## Excluding Top Level Resources Use the top level exclusion screen to select top level roots to exclude from the crawl. This setting is done per application. **Exclude top level resources from the crawl process** 1. Open the application screen **Admin > Applications**. 1. Find the application to configure and select the drop down menu on the application line. Select **Exclude Top Level Resources** to open the configuration panel. 1. Run Task - The Run Task button triggers a task that runs a short detection scan to detect the current top level resources. - Before running the task for the first time, the message above this button is:\ "Note: Run task to detect the top-level resources" - If the top level resource list has changed in the application while you are on this screen, select this button to retrieve the updated structure. - Once triggered, you can see the task status in **Settings > Task Management > Tasks**. Note This will only work if the user has access to the task page - When the task has completed, select **Refresh** to update the page with the list of top level resources. 1. Select the top level resource list, and select top level resources to exclude. 1. Select **Save** to save the change. 1. To refresh the list of top level resources, run the task again. Running the task will not clear the list of top level resources to exclude. ## Special Consideration for Long File Paths in Crawl If you need to support long file paths above 4,000 characters for the crawl, set the flag `excludeVeryLongResourcePaths` in the Permission Collection Engine App.config file to true. By default this value will be commented out and set to false. This key ensures, when enabled, that paths longer than 4000 characters are excluded from the applications’ resource discovery (Crawl), to avoid issues while storing them in the SQLServer database. When enabled, business resources with full paths longer than 4000 characters, and everything included in the hierarchical structure below them, will be excluded from the crawl, and will not be collected by File Access Manager. This scenario is extremely rare. Note You should not enable exclusion of long paths, unless you experience an issue. - **Background** - File Access Manager uses a hashing mechanism to create a unique identifier for each business resource stored in the File Access Manager database. The hashing mechanism in SQLServer versions 2014 and earlier, is unable to process (hash) values with 4,000 or more characters. - Though resources with paths of 4000 characters or longer are extremely rare, File Access Manager is designed to handle that limitation. - **Identifying the Problem** - When using an SQL Server database version 2014 and ealier. - The following error message in the Permission Collection Engine log file:\ `System.Data.SqlClient.SqlException (0x80131904): String or binary data would be truncated.` - In all other cases, this feature should not be enabled. - **Setting the Long Resource Path Key** - The Permission Collection Engine App.config file is `RoleAnalyticsServiceHost.exe.config`, and can be found in the folder:\ `%SailPoint_Home%\FileAccessManager\[Permission Collection instance]\` - Search for the key `excludeVeryLongResourcePaths` and correct it as described above. # Capabilities This connector enables you to use File Access Manager to access and analyze data stored in Azure Files and do the following: - Analyze the structure of stored data. - Classify the data being stored. - Verify user permissions on the resources and compare them against requirements. ## Supported Versions The File Access Manager Azure Files Connector supports the following versions of MS Windows Server: - 2012 R2, 2016, 2019 - 32 and 64-bit support for all versions ## Connector Installation Flow Overview To install the Azure Files connector: 1. Configure all the prerequisites. 1. Add a new Azure Files application in the Business Website. 1. Install the relevant services: - Permission Collector - Data Classification Collector Note Installing the permissions collector and data classification services is optional and should only be installed by someone with a full understanding of File Access Manager deployment architecture. The File Access Manager Administrator Guide has additional information on the architecture. # Prerequisites Make sure your system fits the descriptions below before starting the installation. ## Software Requirements File Access Manager requires the latest ASP.NET Core 8.0.x Hosting Bundle. This bundle consists of .NET Runtime and ASP .NET Core Runtime. You can download the latest 8.0.x Hosting Bundle version from [here](https://dotnet.microsoft.com/en-us/download/dotnet/8.0). ## Active Directory DS Authentication This connector requires identity-based authentication over Server Message Block (SMB) through on-premises Active Directory Domain Services (AD DS). ## Permissions File Access Manager requires different permissions, based on the tasks that require those permissions. The user configured in the Application configuration wizard must have the following permissions on the Azure Files storage: - Read share-level RBAC permissions for the desirable shares. - Read NTFS permissions to all folders on the share. ### Why do we need this access? In order to get the following information from the Azure Files Storage, File Access Management uses the SMB/CIFS protocol. This requires permissions both on the share level (Azure role-based access control - Azure RBAC) and on the directory level (New Technology File System - NTFS). The following detailed explanation describes required permissions by each File Access Manager task: - **Crawling** - The user must have Read permissions to the requested shares and all its folders on the Azure Files storage. - **Permission Collection** - The user must have Read permissions to the requested shares and all its folders on the Azure Files storage. - **Data Classification** - The user must have Read permissions to the requested shares and all its folders on the Azure Files storage. ## Communications Requirements | Requirement | Source | Destination | Port | | --------------------------------------------------- | ---------------------------------------------------- | ----------------------------- | ------------------- | | File Access Manager Message Broker | Permission Collector / Data Classification Collector | RabbitMQ | 5671 | | Permissions Collector /Data Classification Analysis | Permissions Collector/Data Classification Server | Monitored Azure Files Storage | CIFS/SMB (139, 445) | ## How to Use Proxy in a File Access Manager Environment - **ALL_PROXY** - The proxy server used on HTTP and/or HTTPS requests in case HTTP_PROXY and/or HTTPS_PROXY are not defined. - Example: `10.10.10.10:8080` - **NO_PROXY** - A comma-separated list of hostnames that should be excluded from proxying. - Example: `SOME.DOMAIN.COM,LocalFAMServer1,LocalFAMServer2` # Collecting Data Stored in an External Application ## Terminology - **Connector** - The collection of features, components and capabilities that comprise File Access Manager support for an endpoint. - **Collector** - The “Agent” component or service in a Data Classification and or Permission Collection architecture. - **Engine** - The core service counterpart of this architecture. - **Identity Collector** - A logical component used to fetch identities from an identity store and holds the configuration, settings for that identity store, and the relations between these identities. The identity collector has no “physical” manifest. The actual work is done by the Collector Synchronizer. ## Configuring Data Collection and Analysis The list below describes the high level installation process required to collect and analyze data from an external application. Most of these should already be set up in your File Access Manager installation. See the server Installation guide for further details. - **Install a Data Classification central engine** - One or more central engines, installed using the server installer. - **Install a Permission Collection central engine** - One or more central engines, installed using the server installer. - **Create an Application in File Access Manager** - From the Business Website. The application is linked to central engines listed above. - **Install Permission Collectors and/or Data Classification Collector (optional)** - Optionally, you can install collectors that will run on a separate server and take some of the work from the central PC and DC engines (where supported). When installing a collector, attach it to an engine. If no collectors are installed, the central services act as both the engine and the collector. - To install a collector, you must have the RabbitMQ service installed for communication between the central engines and the collectors. RabbitMQ is installed. Note For further details, see section Application > Central Service > Collector Relations in the File Access Manager Administrator Guide. # Installing Services: Collector Installation The Collector Installation Manager is part of the File Access Manager installation package. This tool is used to install the activity monitor, permission collector, and data classification collector. 1. Run the **Collector Installation Manager** as an Administrator. The installation files are in the installation package under the folder Collectors. The Collector Installation Manager window displays. 1. Enter the credentials to connect to File Access Manager. - ServerName/IP should be pointed to the Agent Configuration Manager service server. - A File Access Manager user with Collector Manager permission (permission to install collectors). For Active Directory authentication, use the format domain\\username. 1. Select **Next**. The Service Configuration window displays. 1. If you are installing the Permission Collector, select the Central Permission Collector to which to connect this service, and select **Add**. 1. If you are installing the Data Classification, select the Central Classification Collector to which to connect this service, and select **Add**. 1. Select **Next**. The Installation Folder window displays. Note If this is the first time you are installing collectors on this machine, you will be prompted to select an installation folder, in which all future collectors will also be installed. 1. Browse and select the location of the target folder for installation. 1. Browse and select the location of the folder for system logs. 1. Select **Next**. 1. The system begins installing the selected components. 1. Select **Finish**. The Finish button is displayed after all the selected components have been installed. Note The File Access Manager Administrator Guide provides more information on the collector services. # Verifying the Azure Files Connector Installation ## Installed Services Verify that the services installed for the connector are available and active. Using windows Service manager, or other tool, look for the File Access Manager services, and see that they are running. For example: - File Access Manager Central Activity Monitor - `` - File Access Manager Central Data Classification - `` ## Log Files Check the log files listed below for errors: - `%SAILPOINT_HOME_LOGS%\PermissionCollection_.log` - `%SAILPOINT_HOME_LOGS%\DataClassification_.log` ## Permissions Collection 1. Run the Crawler and Permissions Collector tasks (**Settings > Task Management > Scheduled Tasks**) 1. Verify that: - The tasks completed successfully. - Business resources were created in the resource explorer (**Admin > Applications > *[application column]* > Manage Resources**). - Permissions display in the Permission Forensics page (**Forensics > Permissions**). # Adding a Azure Files Application In order to integrate with Azure Files, we must first create an application entry in File Access Manager. This entry includes the identification, connection details, and other parameters necessary to create the link. To add an application, use the New Application Wizard. 1. Go to to **Admin > Applications**. 1. Select **Add New** to open the wizard. ## Select Wizard Type 1. Select **Standard Application** 1. Select **Next** to open the **General Details** page. ## General Details - **Application Type** - Azure Files. - **Application Name** - Logical name of the application. - **Description** - Description of the application. - **Tags** - Select tags for the application from the dropdown menu, and / or type a new name, and select **Enter** to create a new tag. The dropdown list of tags filters out matching tags as you type and displays up to 50 tags. Note The **tags** replace the **Logical container** field that was used when creating applications in releases before 8.2. - **Identity Collector** - Select from the Identity Collector dropdown menu. - You can create identity collectors in the administrative client. **Applications > Configuration > Permissions Management > Identity Collectors**. See section "OOTB Identity Collection" in the Collector Installation ManagerFile Access Manager Administrator Guide for further details. - If adding a new identity collector, select **Refresh** to update the Identity Collector dropdown list. Select **Next**. to open the **Connection Details** page. ## Connection Details Complete the Connection Details fields: - Server Name - The name of the Azure Files storage account which is monitored. - The correct format is: `.file.core.windows.net`. - Domain Name - Domain name which will be used by the Permission Collector, Crawler, and Data Classification. - Username - Username which will be used by the Permission Collector, Crawler, and Data Classifications. - Password - Password which will be used by the Permission Collector, Crawler, and Data Classifications. Select **Next**. # Selecting and Scheduling the Data Classification Settings ## Associating an Application with Data Classification Server To associate an application with a data classification service, and set the schedule 1. Open the edit screen of the required application. - Go to **Admin > Applications** - Scroll through the list, or use the filter to find the application. - Select the edit icon on the line of the application. 1. Select **Next** till you reach the **Data Classification** settings page. The actual entry fields vary according to the application type. - **Central Data Classification Service** - Associate the application with a Central Data Classification Service. This service is responsible for running the Data Classification tasks. - If the “Central Data Classification” wasn’t installed during the installation of the server, this field is disabled. - **Disabling Data Classification** - To disable data classification, delete the entry from the central data classification field. - Disabling data classification can also be achieved by setting the scheduler to be inactive (which is the default setting for data classification). - **Create a Schedule** - This option is enabled only if a central data classification service is selected. - See Scheduling a Task. Note See the chapter “Data Classification” in the File Access Manager Administrator Guide for more information Select **Next** or **Finish**. ## Data Privacy A user can associate the application with a Central Data Classification Engine Service. This engine will be responsible for executed Data Privacy tasks. Though using different processes for each, the Data Classification engine service is in charge for both Data Privacy and Data Classification discovery tasks. You may choose the same service for both, or use a different one for each, to run them in parallel. Note The fields on the Data Privacy step are the same as the Data Classification step. # Configuring the Permissions Collection Permissions can be analyzed to determine the application permissions of an out-of-the-box application, provided you have defined an identity store for File Access Manager to use in its analysis, and you have run a crawl for the application. The permission collector is a software component responsible for analyzing the permissions in an application. The Central Permission Collector Service is responsible for running the Permission Collector and Crawler tasks. If the “File Access Manager Central Permission Collector” wasn’t installed during the installation of the server, this configuration setting will be disabled. ## Configuring the Permission Collection 1. Open the edit screen of the required application. - Go to **Admin > Applications**. - Scroll through the list, or use the filter to find the application. - Select the edit icon on the line of the application. 1. Select **Next** until you reach the **Crawler & Permissions Collection** settings page. The actual entry fields vary according to the application type. When entering this page in edit mode, you can navigate between the various configuration windows using the **Next** and **Back** buttons. - **Central Permissions Collection Service** - Select a central permission collection service from the dropdown list. You can create permissions collection services as part of the service installation process. See section "Services Configuration" in the File Access Manager Administrator Guide for further details. - **Calculate Effective Permissions** - Calculate effective permissions during the permissions collection run - **Calculate Riskiest Permissions** - Calculates the riskiest permission on a resource, for example, Full Control is riskier than Read permissions if both are on a resource. This option is available when selecting Calculate Effective Permissions. - **Skip Identities Sync during Permission Collection** - Skip identity synchronization before running permission collection tasks when the identity collector is common to different connector. Note This option is checked by default. You can now [schedule a task](#scheduling-a-task). ## Scheduling a Task To create a schedule: 1. Select **Create a Schedule**. 1. The system will provide a Schedule Name in the format `{appName} - {type} Scheduler`. Choose to keep or override this suggestion. 1. Select a scheduling frequency from the dropdown list. Schedule Frequency Options - Run After - Create dependency of tasks. The task starts running only upon successful completion of the first task. - Hourly - Set the start time. - Daily - Set the start date and time. - Weekly - Set the day(s) of the week on which to run. - Monthly - Set the day of the month on which to run a task. - Quarterly - Set a monthly schedule with an interval of 3 months. - Half Yearly - Set a monthly schedule with an interval of 6 months. - Yearly - Set a monthly schedule with an interval of 12 months. 1. Fill the Date and Time field with scheduling times. These fields differ depending upon the scheduling frequency selected. 1. Select the **Active** checkbox to activate the schedule. 1. Select **Next**. ## Configuring and Scheduling the Crawler **Set or edit the Crawler configuration and scheduling** 1. Open the edit screen of the required application. - Go to **Admin > Applications**. - Scroll through the list, or use the filter to find the application. - Select the edit icon on the line of the application. 1. Select **Next** until you reach the **Crawler & Permissions Collection** settings page. The actual entry fields vary according to the application type. **Top Level Shares** - Add the top-level shares names you would like to analyze: - To add a share to a list, type in the name in the top field and select + to add it to the list. - To remove a share from a list, find the share from the list and select the trashcan icon on the resource row. **Calculate Resource Size** - Determine when, or at what frequency, File Access Manager calculates the resources' size. Select one of the following: - Never - Always - Second crawl and on (This is the default) **Create a Schedule** - Select to open the [schedule](#scheduling-a-task) panel. ## Setting the Crawl Scope There are several options to set the crawl scope: - Setting explicit list of resources to include and / or exclude from the scan. - Creating a regex to define resources to exclude. ## Including and Excluding Paths by List To set the paths to include or exclude in the crawl process for an application: 1. Open the edit screen of the required application. - Go to **Admin > Applications**. - Scroll through the list, or use the filter to find the application. - Select the edit icon on the line of the application. 1. Select **Next** until you reach the **Crawler & Permissions Collection** settings page.\ The actual entry fields vary according to the application type. 1. Scroll down to the **Crawl configuration** settings. 1. Select **Advanced Crawl Scope Configuration** to open the scope configuration panel. 1. Select **Include / Exclude Resources** to open the input fields. 1. To add a resource to a list, type in the full path to include / exclude in the top field and select **+** to add it to the list. 1. To remove a resource from a list, find the resource from the list, and select the *x* icon on the resource row. Note When creating exclusion lists, excludes take precedence over includes. ## Excluding Paths by Regex Set filters of paths to exclude in the crawl process for an application using regex: 1. Open the edit screen of the required application. - Go to **Admin > Applications**. - Scroll through the list, or use the filter to find the application. - Select the edit icon on the line of the application. 1. Select **Next** until you reach the **Crawler & Permissions Collection** settings page.\ The actual entry fields vary according to the application type. 1. Select **Exclude Paths by Regex** to open the configuration panel. 1. Type in the paths to exclude by Regex. See regex examples in the section below. Since the system does not collect BRs that match this Regex, it also does not analyze them for permissions. ## Crawler Regex Exclusion Examples The following are examples of crawler Regex exclusions: **Exclude all shares that start with one or more shares names** | Example | Regex | | ------------------------------------------------------------------------- | ----------------------------- | | Starting with `\\server_name\shareName` | `\\\\server_name\\shareName$` | | Starting with `\\server_name\shareName` or `\\server_name\OtherShareName` | \`\\\\server_name\\(shareName | **Include ONLY shares that start with one or more share names** | Example | Regex | | ------------------------------------------------------------------------- | ---------------------------------- | | Starting with `\\server_name\shareName` | \`^(?!\\\\server_name\\shareName($ | | Starting with `\\server_name\shareName` or `\\server_name\OtherShareName` | \`^(?!\\\\server_name\\(shareName | **Narrow down the selection:** Notes - To write a backslash or a Dollar sign, add a backslash before it as an escape character. - To add a condition in a single command, use a pipe character “|”. ## Special Consideration for Long File Paths in Crawl If you need to support long file paths above 4,000 characters for the crawl, set the flag `excludeVeryLongResourcePaths` in the Permission Collection Engine App.config file to true. By default this value will be commented out and set to false. This key ensures, when enabled, that paths longer than 4000 characters are excluded from the applications’ resource discovery (Crawl), to avoid issues while storing them in the SQLServer database. When enabled, business resources with full paths longer than 4000 characters, and everything included in the hierarchical structure below them, will be excluded from the crawl, and will not be collected by File Access Manager. This scenario is extremely rare. Note You should not enable exclusion of long paths, unless you experience an issue. - **Background** - File Access Manager uses a hashing mechanism to create a unique identifier for each business resource stored in the File Access Manager database. The hashing mechanism in SQLServer versions 2014 and earlier, is unable to process (hash) values with 4,000 or more characters. - Though resources with paths of 4000 characters or longer are extremely rare, File Access Manager is designed to handle that limitation. - **Identifying the Problem** - When using an SQL Server database version 2014 and ealier. - The following error message in the Permission Collection Engine log file:\ `System.Data.SqlClient.SqlException (0x80131904): String or binary data would be truncated.` - In all other cases, this feature should not be enabled. - **Setting the Long Resource Path Key** - The Permission Collection Engine App.config file is `RoleAnalyticsServiceHost.exe.config`, and can be found in the folder:\ `%SailPoint_Home%\FileAccessManager\[Permission Collection instance]\` - Search for the key `excludeVeryLongResourcePaths` and correct it as described above. # Capabilities This connector enables you to use File Access Manager to access and analyze data stored in Box and do the following: - Analyze the structure of your stored data. - Monitor user activity in the resources. - Classify the data being stored. - Verify user permissions on the resources, and compare them against requirements. - Manage access fulfillment - automated granting and revoking of access - according to rules set in File Access Manager. - Identity collector – collect IAM users, groups and roles and the connections between them. See the File Access Manager documentation for a full description. ## Box Connector Installation Flow Overview To install the Box connector: 1. Configure all the prerequisites. 1. Add a new Box application in the File Access Manager website. 1. Install the relevant services: - Activity Monitor Note Box currently does not support the Cloud-Ready architecture for permissions collection and data classification. Permission collection and data classification tasks will run on the central engine services associated with the application, regardless of whether these services have one or more collectors associated with the central engine. ## Installation Locations **Activity Monitor** – installed remotely on a File Access Manager monitor application server, which can be a server joined to any domain, including a domain different from the monitored domain. ## Box Connector Operation Principles - File Access Manager Connector for Box uses the Box Content API for event monitoring, identity, and permissions collection. - The Box Content API uses the OAuth 2.0 authorization protocol to authenticate and authorize API requests. - SailPoint SecurityIQ for Box Connector is a registered Box App, which requires a short authorization process to use the Box API during the definition of the Box application. - After the initial authorization process, File Access Manager handles the OAuth token management automatically and refreshes the token if needed. ## Permissions Collection Operation Principles - File Access Manager Box Permissions Collection task uses Box Content API to retrieve information from the Box application. - File Access Manager creates a Box Identity Collector automatically at the end of the “Add New Application” wizard, which collects the Users and Groups from Box. Note Users will only display in the Box Resource Tree if they are an owner of a resource. - By default, permissions are analyzed on the folder level, but can also be analyzed on the file level. If the latter is the case, the system will only display uniquely managed files in the Business Resource Tree. In contrast to other application types, to improve performance, Box permissions are also fetched from the target application during the Crawl task. The permissions will only display in the client after the permission collection task has run, since they must be analyzed. If the crawler was unable to fetch the permissions, the permission collection task will fetch them. # Box Connector Prerequisites ## Box User Permissions During the OAuth authorization process, a Box for Business Team Admin user must grant the SailPoint Box Application access to the data on Box. Note If the "Disable unpublished apps by default" is set to True, the user will be unable to obtain the authentication code when configuring Box applications. ## Communications Requirements | Requirement | Source | Destination | Port | | -------------------------------------------- | ----------------------------------------------------- | --------------------------- | --------- | | File Access Manager Message Broker | Permissions Collector / Data Classification Collector | RabbitMQ | 5671 | | File Access Manager Access | Activity Monitor / Permissions Collector | File Access Manager Servers | 8000-8008 | | Permissions Collection / Data Classification | Permissions Collector / Data Classification | Box API | https | | Activity Audit | Activity Monitor | Box API | https | ## Software Requirements File Access Manager requires the latest ASP.NET Core 8.0.x Hosting Bundle. This bundle consists of .NET Runtime and ASP .NET Core Runtime. You can download the latest 8.0.x Hosting Bundle version from [here](https://dotnet.microsoft.com/en-us/download/dotnet/8.0). # Collecting Data Stored in an External Application ## Terminology - **Connector** - The collection of features, components and capabilities that comprise File Access Manager support for an endpoint. - **Collector** - The “Agent” component or service in a Data Classification and or Permission Collection architecture. - **Engine** - The core service counterpart of this architecture. - **Identity Collector** - A logical component used to fetch identities from an identity store and holds the configuration, settings for that identity store, and the relations between these identities. The identity collector has no “physical” manifest. The actual work is done by the Collector Synchronizer. ## Configuring Data Collection and Analysis The list below describes the high level installation process required to collect and analyze data from an external application. Most of these should already be set up in your File Access Manager installation. See the server Installation guide for further details. - **Install a Data Classification central engine** - One or more central engines, installed using the server installer. - **Install a Permission Collection central engine** - One or more central engines, installed using the server installer. - **Create an Application in File Access Manager** - From the Business Website. The application is linked to central engines listed above. - **Add an Activity Monitor** - To collect activities for this application - run the Collector Installation Manager and add an application under Activity Monitoring. ## Installation Locations **Activity Monitor** – Installed remotely on a File Access Manager monitor application server, which can be a server joined to any domain, including a domain different from the monitored domain. ## Box Connector Operation Principles - File Access Manager Connector for Box uses the Box Content API for event monitoring, identity, and permissions collection. - The Box Content API uses the OAuth 2.0 authorization protocol to authenticate and authorize API requests. - SailPoint SecurityIQ for Box Connector is a registered Box App, which requires a short authorization process to use the Box API during the definition of the Box application. - After the initial authorization process, File Access Manager handles the OAuth token management automatically and refreshes the token if needed. ## Permissions Collection Operation Principles - File Access Manager Box Permissions Collection task uses Box Content API to retrieve information from the Box application. - File Access Manager creates a Box Identity Collector automatically at the end of the “Add New Application” wizard, which collects the Users and Groups from Box. Note Users will only display in the Box Resource Tree if they are an owner of a resource. - By default, permissions are analyzed on the folder level, but can also be analyzed on the file level. If the latter is the case, the system will only display uniquely managed files in the Business Resource Tree. In contrast to other application types, to improve performance, Box permissions are also fetched from the target application during the Crawl task. The permissions will only display in the client after the permission collection task has run, since they must be analyzed. If the crawler was unable to fetch the permissions, the permission collection task will fetch them. # Installing Services: Activity Monitor and Collectors The Collector Installation Manager is part of the File Access Manager installation package. This tool is used to install the activity monitor, permission collector, and data classification collector. 1. Run the **Collector Installation Manager** as an Administrator. The installation files are in the installation package under the folder Collectors. The Collector Installation Manager window displays. 1. Enter the credentials to connect to File Access Manager. - ServerName/IP should be pointed to the Agent Configuration Manager service server. - A File Access Manager user with Collector Manager permission (permission to install collectors). For Active Directory authentication, use the format domain\\username. 1. Select **Next**. The Service Configuration window displays. 1. If you are installing the Activity Monitor, select the application, and select **Add**. 1. When installing a SharePoint Activity Monitor, you will be prompted for service account credentials. This service account will be used by the Activity Monitor service to run the service and authenticate against the SharePoint IIS servers to fetch the logs (“Log on as”). Make sure the service account provided has local administrator privileges on the local server (hosting the Activity Monitor service) and can access the activity logs on the IIS servers. 1. If you are installing the Permission Collector, select the Central Permission Collector to which to connect this service, and select **Add**. 1. If you are installing the Data Classification, select the Central Classification Collector to which to connect this service, and select **Add**. 1. Select **Next**. The Installation Folder window displays. Note If this is the first time you are installing collectors on this machine, you will be prompted to select an installation folder, in which all future collectors will also be installed. 1. Browse and select the location of the target folder for installation. 1. Browse and select the location of the folder for system logs. 1. Select **Next**. 1. The system begins installing the selected components. 1. Select **Finish**. The Finish button is displayed after all the selected components have been installed. Note The File Access Manager Administrator Guide provides more information on the collector services. # Verifying the Box Connector Installation ## Installed Services Verify that the services installed for the connector are available and active. Using windows Service manager, or other tool, look for the File Access Manager services, and see that they are running. For example: - File Access Manager Central Activity Monitor - `` - File Access Manager Central Permissions Collection - `` ## Log Files Check the log files listed below for errors: - `%SAILPOINT_HOME_LOGS%\ FilesMiniFilter_ .log` - `%SAILPOINT_HOME_LOGS%\PermissionCollection_.log` - `%SAILPOINT_HOME_LOGS%\DataClassification_.log` - `%SAILPOINT_HOME_LOGS%\BOX-.log` ## Monitored Activities 1. Simulate activities on Box. 1. Wait a minute (approximately). 1. Verify that the activities display in the File Access Manager website under **Forensics > Activities**. ## Permissions Collection 1. Run the Crawler and Permissions Collector tasks (**Settings > Task Management > Scheduled Tasks**) 1. Verify that: - The tasks completed successfully. - Business resources were created in the resource explorer (**Admin > Applications > *[application column]* > Manage Resources**). - Permissions display in the Permission Forensics page (**Forensics > Permissions**). # Adding a Box Application In order to integrate with Box, we must first create an application entry in File Access Manager. This entry includes the identification, connection details, and other parameters necessary to create the link. To add an application, use the New Application Wizard. 1. Go to **Admin** > **Applications**. 1. Select **Add New** to open the wizard. ## Select Wizard Type 1. Select **Standard Application**. 1. Select **Next** to open the **General Details** page. ## General Details - **Application Type** - Box - **Application Name** - Logical name of the application - **Description** - Description of the application - **Tags** - Select tags for the application from the dropdown menu, and / or type a new name, and select **Enter** to create a new tag. The dropdown list of tags filters out matching tags as you type and displays up to 50 tags. Note The **tags** replace the **Logical container** field that was used when creating applications in releases before 8.2. - **Event Manager Server** - This option is available if there are more than one event manager servers configured in the system. Select an event manager from the drop down menu. Select **Next** to open the **Connection Details** page. ## Connection Details - **Management Account ID** - The account ID of the AWS management account. This is required for collecting user details and permissions from different accounts. - **Use Dedicated IAM User** - Use this to select the login method. Leave unchecked to use the recommended method of EC2 login. - Check this box to use a dedicated IAM use account for login. - If selecting a Dedicated IAM User method, fill in the following fields: - **Access Key Id** - The IAM user programmatic username of the File Access Manager user that was created in the prerequisites. - **Secret Access Key** - The IAM user programmatic password. Select **Next**. # Configuring Activity Monitoring ## Configuring Activity Monitoring Process Frequency - **Polling Interval (sec)** - Activity fetching interval [in seconds]. Default is set to 60 seconds, - **Report Interval (sec)** - Activity Monitor Health reporting interval [in seconds]. Default is set yo 60 seconds. - **Local Buffer Size (MB)** - Local buffer size for activities [in MB]. Default is set to 200MB. - This cyclic buffer is used to store activities on the Application Monitor’s machine in case of network errors that prevent the activities from being sent. - **Activity Data Retention Period** - When selecting the Clear Activity Data option, a user is able to provide a time frame (1 to 100) in either months or years for all activity to be retained. Once that time period is met, all data will be removed. - A user can also select to backup the data before it is deleted by selecting the Backup Events Before Clearing option. Notes - By default, this feature is disabled. - The Backup Before Clearing Option will only be enabled if the backup option is set during the system installation. If a user has not selected the backup option during the installation nor provided a backup path, this option will not be enabled. ## Configuring Data Enrichment Connectors The Data Enrichment Connectors (DEC) configuration enables us to select data enrichment sources. These can be used to add information from other sources about identities. An enrichment source could be a local HR database that is used to combine users' job descriptions or departments to the information stored in the identity store. - Select the data enrichment connectors to enrich monitored activities from the Available DECs text box. - Use the **>** or **>>** arrows to move the selected DECs to the Current DECs text box. - The user can select multiple DECs. Simply select each desired DEC. - You can create a new DEC in the Administrative Client, **Applications > Configuration > ActivityMonitoring > DataEnrichmentConnectors**. - After creating a new DEC, select **Refresh** to refresh the dropdown list. The chapter Connectors of the File Access Manager Administrator Guide provides more information on Data Enrichment Connectors, including what they are, how to configure them, and how they fit in the Activity Flow. # Selecting and Scheduling the Data Classification Settings ## Associating an Application with Data Classification Server To associate an application with a data classification service, and set the schedule 1. Open the edit screen of the required application. - Go to **Admin > Applications** - Scroll through the list, or use the filter to find the application. - Select the edit icon on the line of the application. 1. Select **Next** till you reach the **Data Classification** settings page. The actual entry fields vary according to the application type. - **Central Data Classification Service** - Associate the application with a Central Data Classification Service. This service is responsible for running the Data Classification tasks. - If the “Central Data Classification” wasn’t installed during the installation of the server, this field is disabled. - **Disabling Data Classification** - To disable data classification, delete the entry from the central data classification field. - Disabling data classification can also be achieved by setting the scheduler to be inactive (which is the default setting for data classification). - **Create a Schedule** - This option is enabled only if a central data classification service is selected. - See Scheduling a Task. Note See the chapter “Data Classification” in the File Access Manager Administrator Guide for more information Select **Next** or **Finish**. ## Data Privacy A user can associate the application with a Central Data Classification Engine Service. This engine will be responsible for executed Data Privacy tasks. Though using different processes for each, the Data Classification engine service is in charge for both Data Privacy and Data Classification discovery tasks. You may choose the same service for both, or use a different one for each, to run them in parallel. Note The fields on the Data Privacy step are the same as the Data Classification step. # Configuring and Scheduling the Permissions Collection Permissions can be analyzed to determine the application permissions of an out-of-the-box application, provided you have defined an identity store for File Access Manager to use in its analysis, and you have run a crawl for the application. The permission collector is a software component responsible for analyzing the permissions in an application. The Central Permission Collector Service is responsible for running the Permission Collector and Crawler tasks. If the “File Access Manager Central Permission Collector” wasn’t installed during the installation of the server, this configuration setting will be disabled. Note Users should always run the crawl task before running a permission collection task. ## Configuring the Permission Collection 1. Open the edit screen of the required application. - Go to **Admin > Applications**. - Scroll through the list, or use the filter to find the application. - Select the edit icon on the line of the application. 1. Select **Next** until you reach the **Crawler & Permissions Collection** settings page. The actual entry fields vary according to the application type. When entering this page in edit mode, you can navigate between the various configuration windows using the **Next** and **Back** buttons. - **Central Permissions Collection Service** - Select a central permission collection service from the dropdown list. You can create permissions collection services as part of the service installation process. See section "Services Configuration" in the File Access Manager Administrator Guide for further details. - **Analyze all Objects in S3 Bucket** - If checked, collect and analyze files in the buckets, and not only buckets and folders. - Default is unchecked. - **Analyze ACL Permissions** - Select to fetch and analyze ACL-type Permissions. - If checked, ACLs will be collected for business resources, which will impact the performance of the Permission Collector. For cases with a large number of resources, skipping the ACL permission fetch can improve the service run time considerably. - This option is checked by default. Note If ACL is not supported by your server, make sure this field is unchecked. You can now [schedule a task](#scheduling-a-task). ## Scheduling a Task To create a schedule: 1. Select **Create a Schedule**. 1. The system will provide a Schedule Name in the format `{appName} - {type} Scheduler`. Choose to keep or override this suggestion. 1. Select a scheduling frequency from the dropdown list. Schedule Frequency Options - Run After - Create dependency of tasks. The task starts running only upon successful completion of the first task. - Hourly - Set the start time. - Daily - Set the start date and time. - Weekly - Set the day(s) of the week on which to run. - Monthly - Set the day of the month on which to run a task. - Quarterly - Set a monthly schedule with an interval of 3 months. - Half Yearly - Set a monthly schedule with an interval of 6 months. - Yearly - Set a monthly schedule with an interval of 12 months. 1. Fill the Date and Time field with scheduling times. These fields differ depending upon the scheduling frequency selected. 1. Select the **Active** checkbox to activate the schedule. 1. Select **Next**. ## Configuring and Scheduling the Crawler **Set or edit the Crawler configuration and scheduling** 1. Open the edit screen of the required application. - Go to **Admin > Applications**. - Scroll through the list, or use the filter to find the application. - Select the edit icon on the line of the application. 1. Select **Next** until you reach the **Crawler & Permissions Collection** settings page. The actual entry fields vary according to the application type. **Calculate Resource Size** - Determine when, or at what frequency, File Access Manager calculates the resources' size.\ Select one of the following: - Never - Always - Second crawl and on (This is the default) **Exclude CloudTrail Logs** - Check this box to exclude CloudTrail logs from being crawled and analyzed. There could be a very large number of these log files, and scanning them will have a negative impact on performance. - The default is checked. **Create a Schedule** - Select to open the [schedule](#scheduling-a-task) panel. ## Setting the Crawl Scope There are several options to set the crawl scope: - Setting explicit list of resources to include and / or exclude from the scan. - Creating a regex to define resources to exclude. ## Including and Excluding Paths by List To set the paths to include or exclude in the crawl process for an application: 1. Open the edit screen of the required application. - Go to **Admin > Applications**. - Scroll through the list, or use the filter to find the application. - Select the edit icon on the line of the application. 1. Select **Next** until you reach the **Crawler & Permissions Collection** settings page.\ The actual entry fields vary according to the application type. 1. Scroll down to the **Crawl configuration** settings. 1. Select **Advanced Crawl Scope Configuration** to open the scope configuration panel. 1. Select **Include / Exclude Resources** to open the input fields. 1. To add a resource to a list, type in the full path to include / exclude in the top field and select **+** to add it to the list. 1. To remove a resource from a list, find the resource from the list, and select the *x* icon on the resource row. Note When creating exclusion lists, excludes take precedence over includes. ## Excluding Paths by Regex for AWS S3 Buckets **AWS Path Structure in File Access Manager** File Access Manager uses a path name in the following structure: - **Path Structure** - `Root/[OU]/[Account]/[Bucket Path]/[Folder]/[Filename]` - **Component structure** - `Root/[OU]/[OU2]/[Account name](#[Account ID])/s3.[region].[bucket name]/[folder]/[file name]` - **Example** - `Root/Example-OU/Example-Account(#420269343516)/s3.north-east-17.HR3InputDataBucket/Prospects/CVs/SueSmithPM.Docx` Where: - `Root` - All paths start with "Root/" - `OU` - The organizational unit. This could be empty, or include a sting of one or more OUs, according to the BR hierarchical structure. - `Account` - Since account names are not unique under an organization, this string includes the account ID and the account name: `[Account name](#[Account ID])` - `Bucket Path` - The bucket section of the path starts with "s3." and includes the region: `s3.[region].[bucket]` **Set filters of paths to exclude in the crawl process for an application using regex** 1. Open the edit screen of the required application. - Go to **Admin > Applications**. - Scroll through the list, or use the filter to find the application. - Select the edit icon on the line of the application. 1. Select **Next** until you reach the **Crawler & Permissions Collection** settings page.\ The actual entry fields vary according to the application type. 1. Select **Exclude Paths by Regex** to open the configuration panel. 1. Type in the paths to exclude by Regex, See regex examples in the section below. Since the system does not collect BRs that match this Regex, it also does not analyze them for permissions. ## Crawler Regex Exclusion Examples - AWS S3 Buckets The following are examples of crawler Regex exclusions: **Exclude all drives which start with one or more user names** | Example | Regex | | ---------------------------------- | --------------------------------------------------------------------------- | | Starting with John.Doe | `^Users\/John\.Doe@.*` | | Starting with John.Doe or Jane.Doe | `^Users\/(John Jane)\.Doe@.*` Personal/admin3@501.sailpointtechnologies.com | **Include ONLY drives which start with one or more user names** | Example | Regex | | ---------------------------------- | ----------------------------------- | | Starting with John.Doe | `^(?!Users\/John\.Doe@.*).*` | | Starting with John.Doe or Jane.Doe | `^(?!Users\/(John Jane)\.Doe@.*).*` | **Narrow down the selection** | Example | Regex | | ---------------------------------------------------------------- | ---------------------------------------- | | Include ONLY the C$ drive shares: `\\server_name\*C$` | `^(?!\\\\server_name\\*C*\$($ \\.*)).*` | | Include ONLY one folder under a share: `\\server\share\folderA*` | \`^(?!\\\\server_name\\share$($ | | Include ONLY all administrative shares | `^(?!\\\\server_name\\[a-zA-Z]\$($ )).*` | Notes - To write a backslash or a Dollar sign, add a backslash before it as an escape character. - To add a condition in a single command, use a pipe character “|” . ## Excluding Top Level Resources Use the top level exclusion screen to select top level roots to exclude from the crawl. This setting is done per application. **Exclude top level resources from the crawl process** 1. Open the application screen **Admin > Applications**. 1. Find the application to configure and select the drop down menu on the application line. Select **Exclude Top Level Resources** to open the configuration panel. 1. Run Task - The Run Task button triggers a task that runs a short detection scan to detect the current top level resources. - Before running the task for the first time, the message above this button is:\ "Note: Run task to detect the top-level resources" - If the top level resource list has changed in the application while you are on this screen, select this button to retrieve the updated structure. - Once triggered, you can see the task status in **Settings > Task Management > Tasks**. Note This will only work if the user has access to the task page - When the task has completed, select **Refresh** to update the page with the list of top level resources. 1. Select the top level resource list, and select top level resources to exclude. 1. Select **Save** to save the change. 1. To refresh the list of top level resources, run the task again. Running the task will not clear the list of top level resources to exclude. ## Special Consideration for Long File Paths in Crawl If you need to support long file paths above 4,000 characters for the crawl, set the flag `excludeVeryLongResourcePaths` in the Permission Collection Engine App.config file to true. By default this value will be commented out and set to false. This key ensures, when enabled, that paths longer than 4000 characters are excluded from the applications’ resource discovery (Crawl), to avoid issues while storing them in the SQLServer database. When enabled, business resources with full paths longer than 4000 characters, and everything included in the hierarchical structure below them, will be excluded from the crawl, and will not be collected by File Access Manager. This scenario is extremely rare. Note You should not enable exclusion of long paths, unless you experience an issue. - **Background** - File Access Manager uses a hashing mechanism to create a unique identifier for each business resource stored in the File Access Manager database. The hashing mechanism in SQLServer versions 2014 and earlier, is unable to process (hash) values with 4,000 or more characters. - Though resources with paths of 4000 characters or longer are extremely rare, File Access Manager is designed to handle that limitation. - **Identifying the Problem** - When using an SQL Server database version 2014 and ealier. - The following error message in the Permission Collection Engine log file:\ `System.Data.SqlClient.SqlException (0x80131904): String or binary data would be truncated.` - In all other cases, this feature should not be enabled. - **Setting the Long Resource Path Key** - The Permission Collection Engine App.config file is `RoleAnalyticsServiceHost.exe.config`, and can be found in the folder:\ `%SailPoint_Home%\FileAccessManager\[Permission Collection instance]\` - Search for the key `excludeVeryLongResourcePaths` and correct it as described above. # Connector Overview File Access Manager connects to the CTERA master gateway through CIFS and analyzes the share and NTFS permissions on all the folders. Note There is no option to install Activity Monitoring since it is not supported for CTERA in the current release. ## Capabilities This connector enables you to use File Access Manager to access and analyze data stored in CTERA and do the following: - Analyze the structure of your stored data. - Monitor user activity in the resources. - Classify the data being stored. - Verify user permissions on the resources, and compare them against requirements. - Manage access fulfillment - automated granting and revoking of access - according to rules set in File Access Manager. - Identity collector – collect IAM users, groups and roles and the connections between them. See the File Access Manager documentation for a full description. ## Supported Versions - Portal 6.0.512.2 - Gateway: 6.0.537 ## CTERA Installation Flow Overview To install the CTERA connector: 1. Configure all the prerequisites. 1. Add a new CTERA application in the Business Website. 1. Install the relevant services: - Activity Monitor - This is the activity collection engine, used by all connectors that support activity monitoring. - Permissions Collector - If you are using EC2 login, the collector should be installed on the EC2 instance. - Data Classification Collector. Important Installing the permissions collector and data classification services is optional and should only be installed by someone with a full understanding of File Access Manager deployment architecture. The File Access Manager Administrator Guide has additional information on the architecture. # Collecting Data Stored in an External Application ## Terminology - **Connector** - The collection of features, components and capabilities that comprise File Access Manager support for an endpoint. - **Collector** - The “Agent” component or service in a Data Classification and or Permission Collection architecture. - **Engine** - The core service counterpart of this architecture. - **Identity Collector** - A logical component used to fetch identities from an identity store and holds the configuration, settings for that identity store, and the relations between these identities. The identity collector has no “physical” manifest. The actual work is done by the Collector Synchronizer. ## Configuring Data Collection and Analysis The list below describes the high level installation process required to collect and analyze data from an external application. Most of these should already be set up in your File Access Manager installation. See the server Installation guide for further details. - **Install a Data Classification central engine** - One or more central engines, installed using the server installer. - **Install a Permission Collection central engine** - One or more central engines, installed using the server installer. - **Create an Application in File Access Manager** - From the Business Website. The application is linked to central engines listed above. - **Add an Activity Monitor** - To collect activities for this application - run the Collector Installation Manager and add an application under Activity Monitoring. ## Installing Permission Collectors and / or Data Classification Collector (optional) Optionally, you can install collectors that will run on a separate server and take some of the work from the central PC and DC engines (where supported). When installing a collector, you attach it to an engine. If no collectors are installed, the central services act as both the engine and the collector. To install a collector, you must have the RabbitMQ service installed for communication between the central engines and the collectors. RabbitMQ is installed. Notes - Some cloud connectors ignore collectors connected to the central engine (Box, Dropbox, OneDrive, SharePointOnline, Exchange Online, GoogleDrive). In these applications the task will be done entirely by the engine, and not relegated to its collectors. - For further details, see section **Application > Central Service > Collector Relations** in the File Access Manager Administrator Guide. # CTERA Connector Prerequisites ## Configure a Master gateway The File Access Manager connector is installed on the Master Gateway. Before installing the connector, ask CTERA to configure a Master Gateway for your installation. ## CTERA User Permissions The user configured in the Application configuration wizard should fit the following profile: - A member of the local Administrators group in the CTERA master gateway. - This user can be a local or Active Directory user. - Share Read permissions to all shares on the file server - NTFS Read permission to all files and folders ## Communications Requirements | Requirement | Source | Destination | Port | | --------------------------------- | ----------------------------------------------------- | -------------------- | ------------------- | | File Access ManagerMessage Broker | Permissions Collector / Data Classification Collector | RabbitMQ | 5671 | | File Access Manager Access | Permissions Collector / Data Classification server | CTERA Master Gateway | CIFS/SMB (139, 445) | ## Software Requirements File Access Manager requires the latest ASP.NET Core 8.0.x Hosting Bundle. This bundle consists of .NET Runtime and ASP .NET Core Runtime. You can download the latest 8.0.x Hosting Bundle version from [here](https://dotnet.microsoft.com/en-us/download/dotnet/8.0). # Installing Services: Collector Installation The Collector Installation Manager is part of the File Access Manager installation package. This tool is used to install the activity monitor, permission collector, and data classification collector. 1. Run the **Collector Installation Manager** as an Administrator. The installation files are in the installation package under the folder Collectors. The Collector Installation Manager window displays. 1. Enter the credentials to connect to File Access Manager. - ServerName/IP should be pointed to the Agent Configuration Manager service server. - A File Access Manager user with Collector Manager permission (permission to install collectors). For Active Directory authentication, use the format domain\\username. 1. Select **Next**. The Service Configuration window displays. 1. If you are installing the Permission Collector, select the Central Permission Collector to which to connect this service, and select **Add**. 1. If you are installing the Data Classification, select the Central Classification Collector to which to connect this service, and select **Add**. 1. Select **Next**. The Installation Folder window displays. Note If this is the first time you are installing collectors on this machine, you will be prompted to select an installation folder, in which all future collectors will also be installed. 1. Browse and select the location of the target folder for installation. 1. Browse and select the location of the folder for system logs. 1. Select **Next**. 1. The system begins installing the selected components. 1. Select **Finish**. The Finish button is displayed after all the selected components have been installed. Note The File Access Manager Administrator Guide provides more information on the collector services. # Verifying the CTERA Connector Installation ## Installed Services Verify that the services installed for the connector are available and active. Using windows Service manager, or other tool, look for the File Access Manager services, and see that they are running. For example: - File Access Manager Central Data Classification - `` - File Access Manager Central Permissions Collection - `` ## Log Files Check the log files listed below for errors: - `%SAILPOINT_HOME_LOGS%\ FilesMiniFilter_ .log` - `%SAILPOINT_HOME_LOGS%\PermissionCollection_.log` - `%SAILPOINT_HOME_LOGS%\DataClassification_.log` ## Permissions Collection 1. Run the Crawler and Permissions Collector tasks (**Settings > Task Management > Scheduled Tasks**) 1. Verify that: - The tasks completed successfully. - Business resources were created in the resource explorer (**Admin > Applications > *[application column]* > Manage Resources**). - Permissions display in the Permission Forensics page (**Forensics > Permissions**). # Adding a CTERA Application In order to integrate with CTERA, we must first create an application entry in File Access Manager. This entry includes the identification, connection details, and other parameters necessary to create the link. To add an application, use the New Application Wizard. 1. Go to to **Admin > Applications**. 1. Select **Add New** to open the wizard. ## Select Wizard Type 1. Select **Standard Application** 1. Select **Next** to open the **General Details** page. ## General Details - **Application Name** - Logical name of the application. - **Description** - Description of the application. - **Tags** - Select tags for the application from the dropdown menu, and / or type a new name, and select **Enter** to create a new tag. The dropdown list of tags filters out matching tags as you type and displays up to 50 tags. Note The **tags** replace the **Logical container** field that was used when creating applications in releases before 8.2. - **Event Manager Server** - This option is available if there are more than one event manager servers configured in the system. Select an event manager from the drop down menu. - **Identity Collector** - Select from the Identity Collector dropdown menu. - You can create identity collectors in the administrative client. **Applications > Configuration > Permissions Management > Identity Collectors**. See section "OOTB Identity Collection" in the Collector Installation ManagerFile Access Manager Administrator Guide for further details. - If adding a new identity collector, select **Refresh** to update the Identity Collector dropdown list. Select **Next**. to open the **Connection Details** page. ## Connection Details Complete the Connection Details fields: - Server Name - The name of the AWS S3 environment. - Domain Name - The user defined in the prerequisites. - User / Password - Credentials of the user defined in the prerequisites. This must be an admin user on the AWS S3 environment. Select **Next**. # Selecting and Scheduling the Data Classification Settings ## Associating an Application with Data Classification Server To associate an application with a data classification service, and set the schedule 1. Open the edit screen of the required application. - Go to **Admin > Applications** - Scroll through the list, or use the filter to find the application. - Select the edit icon on the line of the application. 1. Select **Next** till you reach the **Data Classification** settings page. The actual entry fields vary according to the application type. - **Central Data Classification Service** - Associate the application with a Central Data Classification Service. This service is responsible for running the Data Classification tasks. - If the “Central Data Classification” wasn’t installed during the installation of the server, this field is disabled. - **Disabling Data Classification** - To disable data classification, delete the entry from the central data classification field. - Disabling data classification can also be achieved by setting the scheduler to be inactive (which is the default setting for data classification). - **Create a Schedule** - This option is enabled only if a central data classification service is selected. - See Scheduling a Task. Note See the chapter “Data Classification” in the File Access Manager Administrator Guide for more information Select **Next** or **Finish**. ## Data Privacy A user can associate the application with a Central Data Classification Engine Service. This engine will be responsible for executed Data Privacy tasks. Though using different processes for each, the Data Classification engine service is in charge for both Data Privacy and Data Classification discovery tasks. You may choose the same service for both, or use a different one for each, to run them in parallel. Note The fields on the Data Privacy step are the same as the Data Classification step. # Configuring and Scheduling the Permissions Collection Permissions can be analyzed to determine the application permissions of an out-of-the-box application, provided you have defined an identity store for File Access Manager to use in its analysis, and you have run a crawl for the application. The permission collector is a software component responsible for analyzing the permissions in an application. The Central Permission Collector Service is responsible for running the Permission Collector and Crawler tasks. If the “File Access Manager Central Permission Collector” wasn’t installed during the installation of the server, this configuration setting will be disabled. ## Configuring the Permission Collection 1. Open the edit screen of the required application. - Go to **Admin > Applications**. - Scroll through the list, or use the filter to find the application. - Select the edit icon on the line of the application. 1. Select **Next** until you reach the **Crawler & Permissions Collection** settings page. The actual entry fields vary according to the application type. When entering this page in edit mode, you can navigate between the various configuration windows using the **Next** and **Back** buttons. - **Central Permissions Collection Service** - Select a central permission collection service from the dropdown list. You can create permissions collection services as part of the service installation process. See section "Services Configuration" in the File Access Manager Administrator Guide for further details. - **Skip Identities Sync during Permission Collection** - Skip identity synchronization before running permission collection tasks when the identity collector is common to different connector. Note This option is checked by default. You can now [schedule a task](#scheduling-a-task). ## Scheduling a Task To create a schedule: 1. Select **Create a Schedule**. 1. The system will provide a Schedule Name in the format `{appName} - {type} Scheduler`. Choose to keep or override this suggestion. 1. Select a scheduling frequency from the dropdown list. Schedule Frequency Options - Run After - Create dependency of tasks. The task starts running only upon successful completion of the first task. - Hourly - Set the start time. - Daily - Set the start date and time. - Weekly - Set the day(s) of the week on which to run. - Monthly - Set the day of the month on which to run a task. - Quarterly - Set a monthly schedule with an interval of 3 months. - Half Yearly - Set a monthly schedule with an interval of 6 months. - Yearly - Set a monthly schedule with an interval of 12 months. 1. Fill the Date and Time field with scheduling times. These fields differ depending upon the scheduling frequency selected. 1. Select the **Active** checkbox to activate the schedule. 1. Select **Next**. ## Configuring and Scheduling the Crawler **Set or edit the Crawler configuration and scheduling** 1. Open the edit screen of the required application. - Go to **Admin > Applications**. - Scroll through the list, or use the filter to find the application. - Select the edit icon on the line of the application. 1. Select **Next** until you reach the **Crawler & Permissions Collection** settings page. The actual entry fields vary according to the application type. **Create a Schedule** - Select to open the [schedule](#scheduling-a-task) panel. ## Setting the Crawl Scope There are several options to set the crawl scope: - Setting explicit list of resources to include and / or exclude from the scan. - Creating a regex to define resources to exclude. ## Including and Excluding Paths by List To set the paths to include or exclude in the crawl process for an application: 1. Open the edit screen of the required application. - Go to **Admin > Applications**. - Scroll through the list, or use the filter to find the application. - Select the edit icon on the line of the application. 1. Select **Next** until you reach the **Crawler & Permissions Collection** settings page.\ The actual entry fields vary according to the application type. 1. Scroll down to the **Crawl configuration** settings. 1. Select **Advanced Crawl Scope Configuration** to open the scope configuration panel. 1. Select **Include / Exclude Resources** to open the input fields. 1. To add a resource to a list, type in the full path to include / exclude in the top field and select **+** to add it to the list. 1. To remove a resource from a list, find the resource from the list, and select the *x* icon on the resource row. Note When creating exclusion lists, excludes take precedence over includes. ## Excluding Paths by Regex Set filters of paths to exclude in the crawl process for an application using regex: 1. Open the edit screen of the required application. - Go to **Admin > Applications**. - Scroll through the list, or use the filter to find the application. - Select the edit icon on the line of the application. 1. Select **Next** until you reach the **Crawler & Permissions Collection** settings page.\ The actual entry fields vary according to the application type. 1. Select **Exclude Paths by Regex** to open the configuration panel. 1. Type in the paths to exclude by Regex. See regex examples in the section below. Since the system does not collect BRs that match this Regex, it also does not analyze them for permissions. ## Crawler Regex Exclusion Examples The following are examples of crawler Regex exclusions: **Exclude all drives which start with one or more share names** | Example | Regex | | ------------------------------------------------------------------------- | ----------------------------- | | Starting with `\\server_name\shareName` | `\\\\server_name\\shareName$` | | Starting with `\\server_name\shareName` or `\\server_name\OtherShareName` | \`\\\\server_name\\(shareName | **Include ONLY shares that start with one or more share names** | Example | Regex | | ------------------------------------------------------------------------- | ---------------------------------- | | Starting with `\\server_name\shareName` | \`^(?!\\\\server_name\\shareName($ | | Starting with `\\server_name\shareName` or `\\server_name\OtherShareName` | \`^(?!\\\\server_name\\(shareName | **Narrow down the selection:** | Example | Regex | | --------------------------------------------------------------- | ---------------------------------- | | Include ONLY the C$ drive shares: `\\server_name\C$` | \`^(?!\\\\server_name\\C$($ | | Include ONLY one folder under a share: `\\server\share\folderA` | \`^(?!\\\\server_name\\share$($ | | Include ONLY all administrative shares | \`^(?!\\\\server_name\\[a-zA-Z]$($ | Notes - To write a backslash or a Dollar sign, add a backslash before it as an escape character. - To add a condition in a single command, use a pipe character “|”. ## Excluding Top Level Resources Use the top level exclusion screen to select top level roots to exclude from the crawl. This setting is done per application. **Exclude top level resources from the crawl process** 1. Open the application screen **Admin > Applications**. 1. Find the application to configure and select the drop down menu on the application line. Select **Exclude Top Level Resources** to open the configuration panel. 1. Run Task - The Run Task button triggers a task that runs a short detection scan to detect the current top level resources. - Before running the task for the first time, the message above this button is:\ "Note: Run task to detect the top-level resources" - If the top level resource list has changed in the application while you are on this screen, select this button to retrieve the updated structure. - Once triggered, you can see the task status in **Settings > Task Management > Tasks**. Note This will only work if the user has access to the task page - When the task has completed, select **Refresh** to update the page with the list of top level resources. 1. Select the top level resource list, and select top level resources to exclude. 1. Select **Save** to save the change. 1. To refresh the list of top level resources, run the task again. Running the task will not clear the list of top level resources to exclude. ## Special Consideration for Long File Paths in Crawl If you need to support long file paths above 4,000 characters for the crawl, set the flag `excludeVeryLongResourcePaths` in the Permission Collection Engine App.config file to true. By default this value will be commented out and set to false. This key ensures, when enabled, that paths longer than 4000 characters are excluded from the applications’ resource discovery (Crawl), to avoid issues while storing them in the SQLServer database. When enabled, business resources with full paths longer than 4000 characters, and everything included in the hierarchical structure below them, will be excluded from the crawl, and will not be collected by File Access Manager. This scenario is extremely rare. Note You should not enable exclusion of long paths, unless you experience an issue. - **Background** - File Access Manager uses a hashing mechanism to create a unique identifier for each business resource stored in the File Access Manager database. The hashing mechanism in SQLServer versions 2014 and earlier, is unable to process (hash) values with 4,000 or more characters. - Though resources with paths of 4000 characters or longer are extremely rare, File Access Manager is designed to handle that limitation. - **Identifying the Problem** - When using an SQL Server database version 2014 and ealier. - The following error message in the Permission Collection Engine log file:\ `System.Data.SqlClient.SqlException (0x80131904): String or binary data would be truncated.` - In all other cases, this feature should not be enabled. - **Setting the Long Resource Path Key** - The Permission Collection Engine App.config file is `RoleAnalyticsServiceHost.exe.config`, and can be found in the folder:\ `%SailPoint_Home%\FileAccessManager\[Permission Collection instance]\` - Search for the key `excludeVeryLongResourcePaths` and correct it as described above. # Connector Overview - File Access Manager Connector for Dropbox for Business uses the Dropbox Business API for event monitoring, identity, and permissions collection. - The Dropbox Business and Core APIs uses the OAuth 2.0 authorization protocol to authenticate and authorize API requests. - SecurityIQ for Dropbox Connector is a registered Dropbox App, which requires a short authorization process to use the Dropbox Business API during the definition of the Dropbox application. - After the initial authorization process, File Access Manager handles the OAuth token management automatically and refreshes the token if needed. ## Capabilities This connector enables you to use File Access Manager to access and analyze data stored in DropBox and do the following: - Analyze the structure of your stored data. - Monitor user activity in the resources. - Classify the data being stored. - Verify user permissions on the resources, and compare them against requirements. - Manage access fulfillment - automated granting and revoking of access, according to rules set in File Access Manager. - Identity collector – collect IAM users, groups and roles and the connections between them. See the File Access Manager documentation for a full description. ## DropBox Connector Installation Flow Overview To install the DropBox connector: 1. Configure all the prerequisites. 1. Add a new DropBox application in the File Access Manager website. 1. Install the relevant services: - Activity Monitor Note DropBox currently does not support the Cloud-Ready architecture for permissions collection and data classification. Permission collection and data classification tasks will run on the central engine services associated with the application, regardless of whether these services have one or more collectors associated with the central engine. ## Permissions Collection Operation Principles Dropbox Permissions Collection task uses Dropbox Content API to retrieve information from the DropBox application. File Access Manager creates a Dropbox Identity Collector automatically at the end of the **Add New Application** wizard, which collects the Users and Groups from Dropbox. ## Monitored Activities Monitored events are as defined in the [Dropbox Business API specification](https://www.dropbox.com/developers-v1/business/docs#log-get-events). Note This published event list is not comprehensive. Due to Dropbox API being under migration to v2, the documentation currently available on the website is incomplete. File Access Manager supports all event types. Some events are excluded by default. To modify which event types are excluded, edit the `excludedEventTypes` value in the `WBX.DropboxBAMHost.dll.config` file. # Collecting Data Stored in an External Application ## Terminology - **Connector** - The collection of features, components and capabilities that comprise File Access Manager support for an endpoint. - **Collector** - The “Agent” component or service in a Data Classification and or Permission Collection architecture. - **Engine** - The core service counterpart of this architecture. - **Identity Collector** - A logical component used to fetch identities from an identity store and holds the configuration, settings for that identity store, and the relations between these identities. The identity collector has no “physical” manifest. The actual work is done by the Collector Synchronizer. ## Configuring Data Collection and Analysis The list below describes the high level installation process required to collect and analyze data from an external application. Most of these should already be set up in your File Access Manager installation. See the server Installation guide for further details. - **Install a Data Classification central engine** - One or more central engines, installed using the server installer. - **Install a Permission Collection central engine** - One or more central engines, installed using the server installer. - **Create an Application in File Access Manager** - From the Business Website. The application is linked to central engines listed above. - **Add an Activity Monitor** - To collect activities for this application - run the Collector Installation Manager and add an application under Activity Monitoring. # DropBox Connector Prerequisites ## DropBox User Permissions During the OAuth authorization process, a Dropbox for Business Team DropAdmin user must grant the SailPoint SecurityIQ DropBox Application access to the data on Box. ## Communications Requirements | Requirement | Source | Destination | Port | | ------------------------------------------ | ----------------------------------------- | -------------------------- | ------------------------------------ | | File Access Manager Database Access | Permissions Collector/Data Classification | File Access Manager DB | According to specific DB definitions | | File Access Manager Access | Activity Monitor | File Access ManagerServers | 8000-8008 | | Permissions Collection/Data Classification | Permissions Collector/Data Classification | Dropbox API | https | | Activity Monitoring | Activity Monitor | Dropbox API | https | ## Software Requirements File Access Manager requires the latest ASP.NET Core 8.0.x Hosting Bundle. This bundle consists of .NET Runtime and ASP .NET Core Runtime. You can download the latest 8.0.x Hosting Bundle version from [here](https://dotnet.microsoft.com/en-us/download/dotnet/8.0). # Installing Services: Activity Monitor and Collectors The Collector Installation Manager is part of the File Access Manager installation package. This tool is used to install the activity monitor, permission collector, and data classification collector. 1. Run the **Collector Installation Manager** as an Administrator. The installation files are in the installation package under the folder Collectors. The Collector Installation Manager window displays. 1. Enter the credentials to connect to File Access Manager. - ServerName/IP should be pointed to the Agent Configuration Manager service server. - A File Access Manager user with Collector Manager permission (permission to install collectors). For Active Directory authentication, use the format domain\\username. 1. Select **Next**. The Service Configuration window displays. 1. If you are installing the Activity Monitor, select the application, and select **Add**. 1. When installing a SharePoint Activity Monitor, you will be prompted for service account credentials. This service account will be used by the Activity Monitor service to run the service and authenticate against the SharePoint IIS servers to fetch the logs (“Log on as”). Make sure the service account provided has local administrator privileges on the local server (hosting the Activity Monitor service) and can access the activity logs on the IIS servers. 1. If you are installing the Permission Collector, select the Central Permission Collector to which to connect this service, and select **Add**. 1. If you are installing the Data Classification, select the Central Classification Collector to which to connect this service, and select **Add**. 1. Select **Next**. The Installation Folder window displays. Note If this is the first time you are installing collectors on this machine, you will be prompted to select an installation folder, in which all future collectors will also be installed. 1. Browse and select the location of the target folder for installation. 1. Browse and select the location of the folder for system logs. 1. Select **Next**. 1. The system begins installing the selected components. 1. Select **Finish**. The Finish button is displayed after all the selected components have been installed. Note The File Access Manager Administrator Guide provides more information on the collector services. # Verifying the DropBox Connector Installation ## Installed Services Verify that the services installed for the connector are available and active. Using windows Service manager, or other tool, look for the File Access Manager services, and see that they are running. For example: - File Access Manager Central Activity Monitor - `` - File Access Manager Central Permissions Collection - `` - File Access Manager Central Data Classification - `` - File Access Manager Watchdog- `` ## Log Files Check the log files listed below for errors: - `%SAILPOINT_HOME_LOGS%\ FilesMiniFilter_ .log` - `%SAILPOINT_HOME_LOGS%\PermissionCollection_.log` - `%SAILPOINT_HOME_LOGS%\DataClassification_.log` - `%SAILPOINT_HOME_LOGS%\DROPBOX-.log` ## Monitored Activities 1. Simulate activities on DropBox. 1. Wait a minute (approximately). 1. Verify that the activities display in the File Access Manager website under **Forensics > Activities**. ## Permissions Collection 1. Run the Crawler and Permissions Collector tasks (**Settings > Task Management > Scheduled Tasks**) 1. Verify that: - The tasks completed successfully. - Business resources were created in the resource explorer (**Admin > Applications > *[application column]* > Manage Resources**). - Permissions display in the Permission Forensics page (**Forensics > Permissions**). # Adding a DropBox Application In order to integrate with DropBox, we must first create an application entry in File Access Manager. This entry includes the identification, connection details, and other parameters necessary to create the link. To add an application, use the New Application Wizard. 1. Go to **Admin > Applications**. 1. Select **Add New** to open the wizard. ## Select Wizard Type 1. Select **Standard Application** 1. Slect **Next** to open the **General Details** page. ## General Details - **Application Type** - DropBox - **Application Name** - Logical name of the application - **Description** - Description of the application - **Tags** - Select tags for the application from the dropdown menu, and / or type a new name, and select **Enter** to create a new tag. The dropdown list of tags filters out matching tags as you type and displays up to 50 tags. Note The **tags** replace the **Logical container** field that was used when creating applications in releases before 8.2. - **Event Manager Server** - This option is available if there are more than one event manager servers configured in the system. Select an event manager from the drop down menu. Select **Next** to open the **Connection Details** page. ## Connection Details Complete the Connection Details fields: - Authorization Page - Select this link to open the DropBox Consent window shown below. - On the DropBox consent window, log in with a Team Admin user name. - You are redirected to the File Access Manager Cloud Application Authorization page with the authorization code. - This code has a timeout of about a minute, so copy the authorization code into the proper field in the application configuration page. - Authorization Code - The result of the authorization process. Select **Next**. # Configuring Activity Monitoring ## Configuring Activity Monitoring Process Frequency - **Polling Interval (sec)** - Activity fetching interval [in seconds]. Default is set to 60 seconds, - **Report Interval (sec)** - Activity Monitor Health reporting interval [in seconds]. Default is set yo 60 seconds. - **Local Buffer Size (MB)** - Local buffer size for activities [in MB]. Default is set to 200MB. - This cyclic buffer is used to store activities on the Application Monitor’s machine in case of network errors that prevent the activities from being sent. - **Activity Data Retention Period** - When selecting the Clear Activity Data option, a user is able to provide a time frame (1 to 100) in either months or years for all activity to be retained. Once that time period is met, all data will be removed. - A user can also select to backup the data before it is deleted by selecting the Backup Events Before Clearing option. Notes - By default, this feature is disabled. - The Backup Before Clearing Option will only be enabled if the backup option is set during the system installation. If a user has not selected the backup option during the installation nor provided a backup path, this option will not be enabled. ## Configuring Data Enrichment Connectors The Data Enrichment Connectors (DEC) configuration enables us to select data enrichment sources. These can be used to add information from other sources about identities. An enrichment source could be a local HR database that is used to combine users' job descriptions or departments to the information stored in the identity store. - Select the data enrichment connectors to enrich monitored activities from the Available DECs text box. - Use the **>** or **>>** arrows to move the selected DECs to the Current DECs text box. - The user can select multiple DECs. Simply select each desired DEC. - You can create a new DEC in the Administrative Client, **Applications > Configuration > ActivityMonitoring > DataEnrichmentConnectors**. - After creating a new DEC, select **Refresh** to refresh the dropdown list. The chapter Connectors of the File Access Manager Administrator Guide provides more information on Data Enrichment Connectors, including what they are, how to configure them, and how they fit in the Activity Flow. # Selecting and Scheduling the Data Classification Settings ## Associating an Application with Data Classification Server To associate an application with a data classification service, and set the schedule 1. Open the edit screen of the required application. - Go to **Admin > Applications** - Scroll through the list, or use the filter to find the application. - Select the edit icon on the line of the application. 1. Select **Next** till you reach the **Data Classification** settings page. The actual entry fields vary according to the application type. - **Central Data Classification Service** - Associate the application with a Central Data Classification Service. This service is responsible for running the Data Classification tasks. - If the “Central Data Classification” wasn’t installed during the installation of the server, this field is disabled. - **Disabling Data Classification** - To disable data classification, delete the entry from the central data classification field. - Disabling data classification can also be achieved by setting the scheduler to be inactive (which is the default setting for data classification). - **Create a Schedule** - This option is enabled only if a central data classification service is selected. - See Scheduling a Task. Note See the chapter “Data Classification” in the File Access Manager Administrator Guide for more information Select **Next** or **Finish**. ## Data Privacy A user can associate the application with a Central Data Classification Engine Service. This engine will be responsible for executed Data Privacy tasks. Though using different processes for each, the Data Classification engine service is in charge for both Data Privacy and Data Classification discovery tasks. You may choose the same service for both, or use a different one for each, to run them in parallel. Note The fields on the Data Privacy step are the same as the Data Classification step. # Configuring and Scheduling the Permissions Collection Permissions can be analyzed to determine the application permissions of an out-of-the-box application, provided you have defined an identity store for File Access Manager to use in its analysis, and you have run a crawl for the application. The permission collector is a software component responsible for analyzing the permissions in an application. The Central Permission Collector Service is responsible for running the Permission Collector and Crawler tasks. If the “File Access Manager Central Permission Collector” wasn’t installed during the installation of the server, this configuration setting will be disabled. ## Configuring the Permission Collection 1. Open the edit screen of the required application. - Go to **Admin > Applications**. - Scroll through the list, or use the filter to find the application. - Select the edit icon on the line of the application. 1. Select **Next** until you reach the **Crawler & Permissions Collection** settings page. The actual entry fields vary according to the application type. When entering this page in edit mode, you can navigate between the various configuration windows using the **Next** and **Back** buttons. - **Central Permissions Collection Service** - Select a central permission collection service from the dropdown list. You can create permissions collection services as part of the service installation process. See section "Services Configuration" in the File Access Manager Administrator Guide for further details. - **Skip Identities Sync during Permission Collection** - Skip identity synchronization before running permission collection tasks when the identity collector is common to different connector. Note This option is checked by default. You can now [schedule a task](#scheduling-a-task). ## Scheduling a Task To create a schedule: 1. Select **Create a Schedule**. 1. The system will provide a Schedule Name in the format `{appName} - {type} Scheduler`. Choose to keep or override this suggestion. 1. Select a scheduling frequency from the dropdown list. Schedule Frequency Options - Run After - Create dependency of tasks. The task starts running only upon successful completion of the first task. - Hourly - Set the start time. - Daily - Set the start date and time. - Weekly - Set the day(s) of the week on which to run. - Monthly - Set the day of the month on which to run a task. - Quarterly - Set a monthly schedule with an interval of 3 months. - Half Yearly - Set a monthly schedule with an interval of 6 months. - Yearly - Set a monthly schedule with an interval of 12 months. 1. Fill the Date and Time field with scheduling times. These fields differ depending upon the scheduling frequency selected. 1. Select the **Active** checkbox to activate the schedule. 1. Select **Next**. ## Configuring and Scheduling the Crawler **Set or edit the Crawler configuration and scheduling** 1. Open the edit screen of the required application. - Go to **Admin > Applications**. - Scroll through the list, or use the filter to find the application. - Select the edit icon on the line of the application. 1. Select **Next** until you reach the **Crawler & Permissions Collection** settings page. The actual entry fields vary according to the application type. **Calculate Resource Size** - Determine when, or at what frequency, File Access Manager calculates the resources' size.\ Select one of the following: - Never - Always - Second crawl and on (This is the default) **Create a Schedule** - Select to open the [schedule](#scheduling-a-task) panel. ## Setting the Crawl Scope There are several options to set the crawl scope: - Setting explicit list of resources to include and / or exclude from the scan. - Creating a regex to define resources to exclude. ## Including and Excluding Paths by List To set the paths to include or exclude in the crawl process for an application: 1. Open the edit screen of the required application. - Go to **Admin > Applications**. - Scroll through the list, or use the filter to find the application. - Select the edit icon on the line of the application. 1. Select **Next** until you reach the **Crawler & Permissions Collection** settings page.\ The actual entry fields vary according to the application type. 1. Scroll down to the **Crawl configuration** settings. 1. Select **Advanced Crawl Scope Configuration** to open the scope configuration panel. 1. Select **Include / Exclude Resources** to open the input fields. 1. To add a resource to a list, type in the full path to include / exclude in the top field and select **+** to add it to the list. 1. To remove a resource from a list, find the resource from the list, and select the *x* icon on the resource row. Note When creating exclusion lists, excludes take precedence over includes. ## Excluding Paths by Regex Set filters of paths to exclude in the crawl process for an application using regex: 1. Open the edit screen of the required application. - Go to **Admin > Applications**. - Scroll through the list, or use the filter to find the application. - Select the edit icon on the line of the application. 1. Select **Next** until you reach the **Crawler & Permissions Collection** settings page.\ The actual entry fields vary according to the application type. 1. Select **Exclude Paths by Regex** to open the configuration panel. 1. Type in the paths to exclude by Regex. See regex examples in the section below. Since the system does not collect BRs that match this Regex, it also does not analyze them for permissions. ## Crawler Regex Exclusion Examples The following are examples of crawler Regex exclusions: **Exclude all drives which start with one or more user names** | Example | Regex | | ---------------------------------- | ----------------------------- | | Starting with John.Doe | `^Team Members\/John\.Doe@.*` | | Starting with John.Doe or Jane.Doe | \`^Team Members/(John | **Include ONLY drives which start with one or more user names** | Example | Regex | | ---------------------------------- | ----------------------------------- | | Starting with John.Doe | `^(?!Team Members\/John\.Doe@.*).*` | | Starting with John.Doe or Jane.Doe | \`^(?!Team Members/(John | **Narrow down the selection** | Example | Regex | | --------------------------------------------------------------- | ---------------------------------- | | Include ONLY the C$ drive shares: `\\server_name\*C$` | \`^(?!\\\\server_name\\C$($ | | Include ONLY one folder under a share: `\\server\share\folderA` | \`^(?!\\\\server_name\\share$($ | | Include ONLY all administrative shares | \`^(?!\\\\server_name\\[a-zA-Z]$($ | Notes - To write a backslash or a Dollar sign, add a backslash before it as an escape character. - To add a condition in a single command, use a pipe character “|” . ## Excluding Top Level Resources Use the top level exclusion screen to select top level roots to exclude from the crawl. This setting is done per application. **Exclude top level resources from the crawl process** 1. Open the application screen **Admin > Applications**. 1. Find the application to configure and select the drop down menu on the application line. Select **Exclude Top Level Resources** to open the configuration panel. 1. Run Task - The Run Task button triggers a task that runs a short detection scan to detect the current top level resources. - Before running the task for the first time, the message above this button is:\ "Note: Run task to detect the top-level resources" - If the top level resource list has changed in the application while you are on this screen, select this button to retrieve the updated structure. - Once triggered, you can see the task status in **Settings > Task Management > Tasks**. Note This will only work if the user has access to the task page - When the task has completed, select **Refresh** to update the page with the list of top level resources. 1. Select the top level resource list, and select top level resources to exclude. 1. Select **Save** to save the change. 1. To refresh the list of top level resources, run the task again. Running the task will not clear the list of top level resources to exclude. ## Special Consideration for Long File Paths in Crawl If you need to support long file paths above 4,000 characters for the crawl, set the flag `excludeVeryLongResourcePaths` in the Permission Collection Engine App.config file to true. By default this value will be commented out and set to false. This key ensures, when enabled, that paths longer than 4000 characters are excluded from the applications’ resource discovery (Crawl), to avoid issues while storing them in the SQLServer database. When enabled, business resources with full paths longer than 4000 characters, and everything included in the hierarchical structure below them, will be excluded from the crawl, and will not be collected by File Access Manager. This scenario is extremely rare. Note You should not enable exclusion of long paths, unless you experience an issue. - **Background** - File Access Manager uses a hashing mechanism to create a unique identifier for each business resource stored in the File Access Manager database. The hashing mechanism in SQLServer versions 2014 and earlier, is unable to process (hash) values with 4,000 or more characters. - Though resources with paths of 4000 characters or longer are extremely rare, File Access Manager is designed to handle that limitation. - **Identifying the Problem** - When using an SQL Server database version 2014 and ealier. - The following error message in the Permission Collection Engine log file:\ `System.Data.SqlClient.SqlException (0x80131904): String or binary data would be truncated.` - In all other cases, this feature should not be enabled. - **Setting the Long Resource Path Key** - The Permission Collection Engine App.config file is `RoleAnalyticsServiceHost.exe.config`, and can be found in the folder:\ `%SailPoint_Home%\FileAccessManager\[Permission Collection instance]\` - Search for the key `excludeVeryLongResourcePaths` and correct it as described above. # Connector Overview File Access Manager Connector for Google Drive uses the following Google APIs: - Google Drive Activities API and Google Reports API for event monitoring - Google Drive API for resource crawling and permissions collection - Google Admin SDK (Directory API) for domain identities (users, groups, and so on) Google APIs are accessed via a Service Account, defined within the scope of the customer’s Google Apps Domain. The Service Account has Domain-wide delegation permission so that it can impersonate domain users and access their Google Drive activities and data. ## Capabilities This connector enables you to use File Access Manager to access and analyze data stored in Google Drive and do the following: - Analyze the structure of your stored data. - Monitor user activity in the resources. - Classify the data being stored. - Verify user permissions on the resources, and compare them against requirements. - Manage access fulfillment - automated granting and revoking of access - according to rules set in File Access Manager. - Identity collector – collect IAM users, groups and roles and the connections between them. See the File Access Manager documentation for a full description. ## Google Drive Connector Installation Flow Overview To install the Google Drive connector: 1. Configure all the prerequisites. 1. Add a new Google Drive application in the File Access Manager website. 1. Install the relevant services: - Activity Monitor Note Google Drive currently does not support the Cloud-Ready architecture for permissions collection and data classification. Permission collection and data classification tasks will run on the central engine services associated with the application, regardless of whether these services have one or more collectors associated with the central engine. ## How is Google Drive Mapping Converted to a Business Resources Tree? - Google Drive represents files and folders in a graph (a.k.a. map) data structure so that every node may have multiple parent and children nodes. In a tree structure, however, every node can have only one parent. For example, a folder shared by two users actually has two different parents – one in each of the user’s personal drives. - To maintain a recognizable structure for Google Drive resources, File Access Manager displays business resources in a tree, exactly as they are arranged from the user’s perspective. - When users share folders, flattening the graph structure into a tree results in duplicate resources, which are maintained to keep the structure recognizable. - If external users (external to the company’s Google Apps domain) share folders with domain users, a separate “External” tree root represents those resources. - If shared drives exist in the domain and have members assigned to them, a separate "Shared Drives" tree root represents those resources. - The following is a sample schematic of the File Access Manager Google Drive resource tree: - External - [private@gmail.com](mailto:private@gmail.com) - sharedFolder1 - Shared Drives - Shared Drive 1 - sharedDriveFolder1 - sharedDriveFolder2 - Users - [u1@my-company.com](mailto:u1@my-company.com) - Folder1 - Folder2 - [u2@my-company.com](mailto:u2@my-company.com) - [u3@my-company.com](mailto:u3@my-company.com) ## Monitored Activities Monitored Administrator audit events (Google Domain events) include: - User Events and group events (USER_SETTINGS and GROUP_SETTINGS, respectively) ## Permissions Collection Operation Principles The File Access Manager Google Drive Permissions Collection task uses Google Drive API to retrieve information From Google Drive. File Access Manager automatically creates a Google Drive Identity Collector (when the “Add New Application” wizard finishes) which collects the users and groups from the Google Apps Domain. # Collecting Data Stored in an External Application ## Terminology - **Connector** - The collection of features, components and capabilities that comprise File Access Manager support for an endpoint. - **Collector** - The “Agent” component or service in a Data Classification and or Permission Collection architecture. - **Engine** - The core service counterpart of this architecture. - **Identity Collector** - A logical component used to fetch identities from an identity store and holds the configuration, settings for that identity store, and the relations between these identities. The identity collector has no “physical” manifest. The actual work is done by the Collector Synchronizer. ## Configuring Data Collection and Analysis The list below describes the high level installation process required to collect and analyze data from an external application. Most of these should already be set up in your File Access Manager installation. See the server Installation guide for further details. - **Install a Data Classification central engine** - One or more central engines, installed using the server installer. - **Install a Permission Collection central engine** - One or more central engines, installed using the server installer. - **Create an Application in File Access Manager** - From the Business Website. The application is linked to central engines listed above. - **Add an Activity Monitor** - To collect activities for this application - run the Collector Installation Manager and add an application under Activity Monitoring. # Prerequisites Make sure your system fits the descriptions below before starting the installation. ## Software Requirements File Access Manager requires the latest ASP.NET Core 8.0.x Hosting Bundle. This bundle consists of .NET Runtime and ASP .NET Core Runtime. You can download the latest 8.0.x Hosting Bundle version from [here](https://dotnet.microsoft.com/en-us/download/dotnet/8.0). ## Permissions To enable File Access Manager to interact with Google Apps, the high level steps are: 1. Enable Google SDKs (Google Drive API, Drive Activity API, Admin SDK API). 1. Create a service account and assign it domain-wide delegation. 1. Delegate domain-wide authority to the service account. This is required to capture activities. ### Enabling Google SDKs (Google Drive API, Drive Activity API, Admin SDK API) **Creating a project:** 1. Go to your Google Apps developer console: 1. Make sure that you are using an administrator account for your Google Apps domain. 1. Select **Project** drop down from top bar (next to Google API logo), select **New Project**. 1. Name the project (e.g., “FAM”) and select **Create**. 1. Wait for the project to be created and then select **Select Project** from the top right notification bar. 1. Using the previous drop-down selector, ensure the new project is selected, otherwise you may default to the previous project. **Enabling Google APIs:** 1. Top left, select three lines > APIs & services. 1. In the new project select **+Enable APIs** from the top bar. 1. Using the Search box, find and enable the following APIs: - Google Drive API - Drive Activity API - Admin SDK API ### Creating a Service Account and Assigning it Domain-wide Delegation 1. On the top left (menu button) select **APIs & Services > Credentials**. Note This is an important step, failure to do so will mean you will create Credentials just for the last API you were in. 1. Select **Create Credentials**. 1. Select **Service account**. 1. Enter in a name for the new service account in "Service account name" (e.g. "svc_fam"). Note The user, domain, and service account name are all case sensitive. 1. Select **Create** then **Done**. 1. Verify that the new account is listed within **Credentials**, under the **Service Accounts** heading. 1. Select on newly created account, or select the Edit icon. 1. Select the **Show Domain-wide Delegation** drop down menu. 1. Select **Enable G Suite Domain-wide Delegation**. Note If you get a message ‘To change domain wide delegation, a product name for the OAuth consent screen must be configured….’, follow the prompts and create the Consent as instructed. 1. Select **Add Key > Create new key**. 1. Select **P12** under **Key type**. 1. Select **Project Owner** as the role for this service account. 1. Select **Create**. 1. A certificate file *.p12* is then downloaded to your computer, this file is required when creating the Google Drive application in Adding a Google Drive Application in File Access Manager. 1. A popup window appears showing the password to the *.p12* file. Save this password for future use within the *Add New Application Wizard*. Note This popup is displayed only once. Copy the password, or you will have to define a new service account 1. Copy the svc account email address `@-123.iam.gserviceaccount.com`. This will be needed in the authorizing the service account step. 1. Select **Show Domain-wide delegation** and then **Enable G Suite Domain wide delegation**. 1. Assign a Product Name as prompted (eg FAM). 1. Copy the Unique ID number (Client ID). This file will be needed in the authorizing the service account step. 1. Select **Save**. ### Delegate Domain-wide Authority to the Service Account. This is required in order to capture activities. 1. Go to Google administrative console at: . 1. Select **Security**. If it is not listed, select the **More controls** button at the bottom of the screen. 1. Select **API Controls**. 1. Manage Domain Wide Delegation. 1. Select **Add new**. 1. Under **Client ID**, paste the Unique ID (this is the same as the Client ID) of the service account you created in the previous step. 1. Under **Oath scopes (comma-delimited)**, paste the following in its entirety: , , , , , , 1. Select **Authorize**. ## Limiting File Access Manager Permissions During the Application setup, you must provide a Domain Admin User for File Access Manager to collect data on the Google Drive domain. You can provide the Super Admin, or create a dedicated File Access Manager Google account with fewer permissions. The File Access Manager Google account requires the following permissions: - On the desired OU (Organizational Unit) level - Organizational Units > Read - Users > Read - Domain-wide - Groups > Read - Reports Note the following regarding crawling, permissions collections, and activities: - Crawling - The resource tree contains only OU users and folders for which a File Access Manager user has permissions. - Permissions Collection - File Access Manager only analyzes resources for permissions under scoped OUs. - Since groups are defined on a domain-wide basis, rather than by OU, File Access Manager collects all domain groups. - If users from OUs (for which a File Access Manager user lacks permission) have permissions on resources under the analyzed OU, those users are considered File Access Manager External Accounts, since File Access Manager cannot collect information on those users. - Activities - File Access Manager only collects activities for users for which a File Access Manager user has permissions. - File Access Manager collects administrator activities (such as changing users or passwords) on a domain-wide basis, rather than by user/OU. - Data Classification - File Access Manager only indexes and classifies resources collected during a crawl (only resources to which a File Access Manager user has permissions). To create, and grant permissions to a File Access Manager Google Administrator account perform the following steps: 1. Sign in to the Google Administrator console (admin.google.com) using the Super Admin account (or any account that can create and grant Administrator roles and create users). 1. Select **Users**. Note If you cannot see Users, select the More Controls bar at the bottom of the screen. 1. Choose an OU on which to create a File Access Manager account by hovering over the plus (+) sign at the bottom right corner of the screen. 1. Select **Add User.** 1. Enter a name and primary email address and password for the user. Ensure you note down the password for future reference (for example, IdentityIQfam_reader). 1. Select **Create**. 1. Select **Admin Roles** on the Google Admin console. Note To see the Admin Roles, select the More Controls bar at the bottom of the screen. 1. Select **Create a New Role**. This will be the OU targeted role. 1. Enter a role name and description (for example, File Access Manager OU Reader). 1. Select **Create**. 1. Check the following checkboxes under the **Privileges tab > Admin Console Privileges**: - Organizational Units > Read - Users > Read 1. Select **Save**. 1. Select the newly created role, and select **Assign Admins** under the Admins tab. 1. Select the desired OU from the drop-down list and enter the name of the File Access Manager account. 1. Select **Confirm Assignment**. Note The role applies to the OU and all its descendants. You can assign the role to the same user on another OU later. 1. Select **Create a New Role**. This will be a domain-wide role. 1. Enter a role name and description (for example, File Access Manager Domain Reader). 1. Select **Create**. 1. Check the Reports checkbox under the **Privileges tab > Admin Console Privileges**. 1. Check the **Groups > Read** checkbox under the **Privileges tab > Admin API Privileges**. 1. Select **Save**. 1. Select the newly created role, and select **Assign Admins** under the Admins tab. 1. Enter the File Access Manager account. 1. Select **Confirm Assignment**. ## Communications Requirements | Requirement | Source | Destination | Port | | ---------------------------------------------------- | ---------------------------------------------------- | --------------------------- | --------- | | File Access Manager Message Broker | Permission Collector / Data Classification Collector | RabbitMQ | 5671 | | File Access Manager Access | Activity Monitor | File Access Manager Servers | 8000-8008 | | Permissions Collector /Data Classification Collector | Permissions Collector/Data Classification | Google APIs | https | | Activity Monitoring | Activity Monitor | Google APIs | https | # Installing Services: Activity Monitor and Collectors The Collector Installation Manager is part of the File Access Manager installation package. This tool is used to install the activity monitor, permission collector, and data classification collector. 1. Run the **Collector Installation Manager** as an Administrator. The installation files are in the installation package under the folder Collectors. The Collector Installation Manager window displays. 1. Enter the credentials to connect to File Access Manager. - ServerName/IP should be pointed to the Agent Configuration Manager service server. - A File Access Manager user with Collector Manager permission (permission to install collectors). For Active Directory authentication, use the format domain\\username. 1. Select **Next**. The Service Configuration window displays. 1. If you are installing the Activity Monitor, select the application, and select **Add**. 1. When installing a SharePoint Activity Monitor, you will be prompted for service account credentials. This service account will be used by the Activity Monitor service to run the service and authenticate against the SharePoint IIS servers to fetch the logs (“Log on as”). Make sure the service account provided has local administrator privileges on the local server (hosting the Activity Monitor service) and can access the activity logs on the IIS servers. 1. If you are installing the Permission Collector, select the Central Permission Collector to which to connect this service, and select **Add**. 1. If you are installing the Data Classification, select the Central Classification Collector to which to connect this service, and select **Add**. 1. Select **Next**. The Installation Folder window displays. Note If this is the first time you are installing collectors on this machine, you will be prompted to select an installation folder, in which all future collectors will also be installed. 1. Browse and select the location of the target folder for installation. 1. Browse and select the location of the folder for system logs. 1. Select **Next**. 1. The system begins installing the selected components. 1. Select **Finish**. The Finish button is displayed after all the selected components have been installed. Note The File Access Manager Administrator Guide provides more information on the collector services. # Verifying the Google Drive Connector Installation ## Installed Services Verify that the services installed for the connector are available and active. Using windows Service manager, or other tool, look for the File Access Manager services, and see that they are running. For example: - File Access Manager Central Permissions Collection - File Access Manager Central Data Classification - File Access Manager Central Activity Monitor ## Log Files Check the log files listed below for errors: - `%SAILPOINT_HOME_LOGS%\ FilesMiniFilter_ .log` - `%SAILPOINT_HOME_LOGS%\PermissionCollection_.log` - `%SAILPOINT_HOME_LOGS%\DataClassification_.log` - `%SAILPOINT_HOME_LOGS%\GDrive-.log` - On the server which contains the central permissions collection service `PermissionsCollection_[Service Name]` - If a collector exists, then you can check the collector log `PermissionsCollection_[Centeral Service Name] Collector [Running Number]` ## Monitored Activities 1. Simulate activities on Box. 1. Wait a minute (approximately). 1. Verify that the activities display in the File Access Manager website under **Forensics > Activities**. ## Permissions Collection 1. Run the Crawler and Permissions Collector tasks (**Settings > Task Management > Scheduled Tasks**) 1. Verify that: - The tasks completed successfully. - Business resources were created in the resource explorer (**Admin > Applications > *[application column]* > Manage Resources**). - Permissions display in the Permission Forensics page (**Forensics > Permissions**). # Adding a Google Drive Application In order to integrate with Google Drive, we must first create an application entry in File Access Manager. This entry includes the identification, connection details, and other parameters necessary to create the link. To add an application, use the New Application Wizard. 1. Go to to **Admin > Applications**. 1. Select **Add New** to open the wizard. ## Select Wizard Type 1. Select **Standard Application** 1. Select **Next** to open the **General Details** page. ## General Details - **Application Type** - Google Drive - **Application Name** - Logical name of the application - **Description** - Description of the application - **Tags** - Select tags for the application from the dropdown menu, and / or type a new name, and select **Enter** to create a new tag. The dropdown list of tags filters out matching tags as you type and displays up to 50 tags. Note The **tags** replace the **Logical container** field that was used when creating applications in releases before 8.2. - **Event Manager Server** - This option is available if there are more than one event manager servers configured in the system. Select an event manager from the drop down menu. Select **Next**. to open the **Connection Details** page. ## Connection Details - Domain Admin User - The full user name of an admin user in your Google domain. Enter the username as a UPN: `User@Domain.com`. Note The user, domain, and service account name are all case sensitive. - Domain Name - Your Google primary domain name. - Service Account - The full name of service account created in the [permissions](https://documentation.sailpoint.com/fam-connectors/help/cloud/google-drive/google_drive_prereqs.html) section of this guide e.g.: `@-123.iam.gserviceaccount.com` - Certificate File - The certificate file created during the Prerequisites section of this guide. Upload a certificate by dragging it onto the certificate field, or clicking to open a file manager dialogue. - Certificate Password - The password for the certificate file created in the Prerequisites section of this guide. Note When editing this application, if a new certificate is uploaded, then the former password cannot be used. The user has to provide a new password. Select **Next**. # Configuring Activity Monitoring ## Configuring Activity Monitoring Process Frequency - **Polling Interval (sec)** - Activity fetching interval [in seconds]. Default is set to 60 seconds, - **Report Interval (sec)** - Activity Monitor Health reporting interval [in seconds]. Default is set yo 60 seconds. - **Local Buffer Size (MB)** - Local buffer size for activities [in MB]. Default is set to 200MB. - This cyclic buffer is used to store activities on the Application Monitor’s machine in case of network errors that prevent the activities from being sent. - **Activity Data Retention Period** - When selecting the Clear Activity Data option, a user is able to provide a time frame (1 to 100) in either months or years for all activity to be retained. Once that time period is met, all data will be removed. - A user can also select to backup the data before it is deleted by selecting the Backup Events Before Clearing option. Notes - By default, this feature is disabled. - The Backup Before Clearing Option will only be enabled if the backup option is set during the system installation. If a user has not selected the backup option during the installation nor provided a backup path, this option will not be enabled. ## Configuring Data Enrichment Connectors The Data Enrichment Connectors (DEC) configuration enables us to select data enrichment sources. These can be used to add information from other sources about identities. An enrichment source could be a local HR database that is used to combine users' job descriptions or departments to the information stored in the identity store. - Select the data enrichment connectors to enrich monitored activities from the Available DECs text box. - Use the **>** or **>>** arrows to move the selected DECs to the Current DECs text box. - The user can select multiple DECs. Simply select each desired DEC. - You can create a new DEC in the Administrative Client, **Applications > Configuration > ActivityMonitoring > DataEnrichmentConnectors**. - After creating a new DEC, select **Refresh** to refresh the dropdown list. The chapter Connectors of the File Access Manager Administrator Guide provides more information on Data Enrichment Connectors, including what they are, how to configure them, and how they fit in the Activity Flow. # Selecting and Scheduling the Data Classification Settings ## Associating an Application with Data Classification Server To associate an application with a data classification service, and set the schedule 1. Open the edit screen of the required application. - Go to **Admin > Applications** - Scroll through the list, or use the filter to find the application. - Select the edit icon on the line of the application. 1. Select **Next** till you reach the **Data Classification** settings page. The actual entry fields vary according to the application type. - **Central Data Classification Service** - Associate the application with a Central Data Classification Service. This service is responsible for running the Data Classification tasks. - If the “Central Data Classification” wasn’t installed during the installation of the server, this field is disabled. - **Disabling Data Classification** - To disable data classification, delete the entry from the central data classification field. - Disabling data classification can also be achieved by setting the scheduler to be inactive (which is the default setting for data classification). - **Create a Schedule** - This option is enabled only if a central data classification service is selected. - See Scheduling a Task. Note See the chapter “Data Classification” in the File Access Manager Administrator Guide for more information Select **Next** or **Finish**. ## Data Privacy A user can associate the application with a Central Data Classification Engine Service. This engine will be responsible for executed Data Privacy tasks. Though using different processes for each, the Data Classification engine service is in charge for both Data Privacy and Data Classification discovery tasks. You may choose the same service for both, or use a different one for each, to run them in parallel. Note The fields on the Data Privacy step are the same as the Data Classification step. # Configuring and Scheduling the Permissions Collection Permissions can be analyzed to determine the application permissions of an out-of-the-box application, provided you have defined an identity store for File Access Manager to use in its analysis, and you have run a crawl for the application. The permission collector is a software component responsible for analyzing the permissions in an application. The Central Permission Collector Service is responsible for running the Permission Collector and Crawler tasks. If the “File Access Manager Central Permission Collector” wasn’t installed during the installation of the server, this configuration setting will be disabled. ## Configuring the Permission Collection 1. Open the edit screen of the required application. - Go to **Admin > Applications**. - Scroll through the list, or use the filter to find the application. - Select the edit icon on the line of the application. 1. Select **Next** until you reach the **Crawler & Permissions Collection** settings page. The actual entry fields vary according to the application type. When entering this page in edit mode, you can navigate between the various configuration windows using the **Next** and **Back** buttons. - **Central Permissions Collection Service** - Select a central permission collection service from the dropdown list. You can create permissions collection services as part of the service installation process. See section "Services Configuration" in the File Access Manager Administrator Guide for further details. - **Skip Identities Sync during Permission Collection** - Skip identity synchronization before running permission collection tasks when the identity collector is common to different connector. Note This option is checked by default. You can now [schedule a task](#scheduling-a-task). ## Scheduling a Task To create a schedule: 1. Select **Create a Schedule**. 1. The system will provide a Schedule Name in the format `{appName} - {type} Scheduler`. Choose to keep or override this suggestion. 1. Select a scheduling frequency from the dropdown list. Schedule Frequency Options - Run After - Create dependency of tasks. The task starts running only upon successful completion of the first task. - Hourly - Set the start time. - Daily - Set the start date and time. - Weekly - Set the day(s) of the week on which to run. - Monthly - Set the day of the month on which to run a task. - Quarterly - Set a monthly schedule with an interval of 3 months. - Half Yearly - Set a monthly schedule with an interval of 6 months. - Yearly - Set a monthly schedule with an interval of 12 months. 1. Fill the Date and Time field with scheduling times. These fields differ depending upon the scheduling frequency selected. 1. Select the **Active** checkbox to activate the schedule. 1. Select **Next**. ## Configuring and Scheduling the Crawler **Set or edit the Crawler configuration and scheduling** 1. Open the edit screen of the required application. - Go to **Admin > Applications**. - Scroll through the list, or use the filter to find the application. - Select the edit icon on the line of the application. 1. Select **Next** until you reach the **Crawler & Permissions Collection** settings page. The actual entry fields vary according to the application type. **Calculate Resource Size** - Determine when, or at what frequency, File Access Manager calculates the resources' size.\ Select one of the following: - Never - Always - Second crawl and on (This is the default) **Create a Schedule** - Select to open the [schedule](#scheduling-a-task) panel. ## Setting the Crawl Scope There are several options to set the crawl scope: - Setting explicit list of resources to include and / or exclude from the scan. - Creating a regex to define resources to exclude. ## Including and Excluding Paths by List To set the paths to include or exclude in the crawl process for an application: 1. Open the edit screen of the required application. - Go to **Admin > Applications**. - Scroll through the list, or use the filter to find the application. - Select the edit icon on the line of the application. 1. Select **Next** until you reach the **Crawler & Permissions Collection** settings page.\ The actual entry fields vary according to the application type. 1. Scroll down to the **Crawl configuration** settings. 1. Select **Advanced Crawl Scope Configuration** to open the scope configuration panel. 1. Select **Include / Exclude Resources** to open the input fields. 1. To add a resource to a list, type in the full path to include / exclude in the top field and select **+** to add it to the list. 1. To remove a resource from a list, find the resource from the list, and select the *x* icon on the resource row. Note When creating exclusion lists, excludes take precedence over includes. ## Excluding Paths by Regex Set filters of paths to exclude in the crawl process for an application using regex: 1. Open the edit screen of the required application. - Go to **Admin > Applications**. - Scroll through the list, or use the filter to find the application. - Select the edit icon on the line of the application. 1. Select **Next** until you reach the **Crawler & Permissions Collection** settings page.\ The actual entry fields vary according to the application type. 1. Select **Exclude Paths by Regex** to open the configuration panel. 1. Type in the paths to exclude by Regex. See regex examples in the section below. Since the system does not collect BRs that match this Regex, it also does not analyze them for permissions. ## Crawler Regex Exclusion Examples The following are examples of crawler Regex exclusions: **Exclude all drives which start with one or more user names** | Example | Regex | | ---------------------------------- | ---------------------- | | Starting with John.Doe | `^Users\/John\.Doe@.*` | | Starting with John.Doe or Jane.Doe | \`^Users/(John | **Exclude users specific drives** | Example | Regex | | ------------------------------------------------ | ---------------------------------- | | Exclude bin and debug drives under Service drive | \`^Users/John.Doe@.\*/Service/(bin | **Include ONLY drives which start with one or more user names** | Example | Regex | | ------------------------------------ | ----------------------------------------- | | Starting with John.Doe | `^(?!Users\/John\.Doe@.*).*` | | Starting with John.Doe or Jane.Doe | \`^(?!Users/(John | | Include ONLY Service drive resources | \`^(?!Users/John.Doe@my_oranization.com($ | ## Excluding Top Level Resources Use the top level exclusion screen to select top level roots to exclude from the crawl. This setting is done per application. **Exclude top level resources from the crawl process** 1. Open the application screen **Admin > Applications**. 1. Find the application to configure and select the drop down menu on the application line. Select **Exclude Top Level Resources** to open the configuration panel. 1. Run Task - The Run Task button triggers a task that runs a short detection scan to detect the current top level resources. - Before running the task for the first time, the message above this button is:\ "Note: Run task to detect the top-level resources" - If the top level resource list has changed in the application while you are on this screen, select this button to retrieve the updated structure. - Once triggered, you can see the task status in **Settings > Task Management > Tasks**. Note This will only work if the user has access to the task page - When the task has completed, select **Refresh** to update the page with the list of top level resources. 1. Select the top level resource list, and select top level resources to exclude. 1. Select **Save** to save the change. 1. To refresh the list of top level resources, run the task again. Running the task will not clear the list of top level resources to exclude. ## Special Consideration for Long File Paths in Crawl If you need to support long file paths above 4,000 characters for the crawl, set the flag `excludeVeryLongResourcePaths` in the Permission Collection Engine App.config file to true. By default this value will be commented out and set to false. This key ensures, when enabled, that paths longer than 4000 characters are excluded from the applications’ resource discovery (Crawl), to avoid issues while storing them in the SQLServer database. When enabled, business resources with full paths longer than 4000 characters, and everything included in the hierarchical structure below them, will be excluded from the crawl, and will not be collected by File Access Manager. This scenario is extremely rare. Note You should not enable exclusion of long paths, unless you experience an issue. - **Background** - File Access Manager uses a hashing mechanism to create a unique identifier for each business resource stored in the File Access Manager database. The hashing mechanism in SQLServer versions 2014 and earlier, is unable to process (hash) values with 4,000 or more characters. - Though resources with paths of 4000 characters or longer are extremely rare, File Access Manager is designed to handle that limitation. - **Identifying the Problem** - When using an SQL Server database version 2014 and ealier. - The following error message in the Permission Collection Engine log file:\ `System.Data.SqlClient.SqlException (0x80131904): String or binary data would be truncated.` - In all other cases, this feature should not be enabled. - **Setting the Long Resource Path Key** - The Permission Collection Engine App.config file is `RoleAnalyticsServiceHost.exe.config`, and can be found in the folder:\ `%SailPoint_Home%\FileAccessManager\[Permission Collection instance]\` - Search for the key `excludeVeryLongResourcePaths` and correct it as described above. # Other Connectors The following are File Access Manager supported connectors: - IdentityIQ Enrichment # Connector Overview The File Access Manager is an independent application installed on the IdentityIQ platform. This Data Enrichment Connector connects to the IdentityIQ application, which is also installed on the IdentityIQ platform. The IdentityIQ Enrichment connector retrieves complementary identity information regarding an Active Directory user, if that user created activities in a monitored application connected to the enrichment connector. File Access Manager uses an IdentityIQ API to connect to the IdentityIQ application and platform. File Access Manager uses this API to search for an Active Directory account and retrieve that account’s identity information. ## Supported Versions This connector supports IdentityIQ versions 7.1 and up. ## Setup Procedures The main setup procedures are: 1. Set up the IdentityIQ Active Directory application(s). 1. Assign a user to connect to File Access Manager. 1. Set up the enrichment connector in File Access Manager. # Enrichment Connector Setup 1. On the **File Access Manager Administrative Client**, navigate to **Applications > Configuration > Activity Monitoring > Data Enrichment Connectors**. 1. Select **New**. 1. Select **Type**: `IdentityIQ`. Complete the following IdentityIQ Enrichment connector fields as follows: - **Name**: The connector’s logical name. - **Context Root**: The IdentityIQ context root is part of the IdentityIQ address. The default context root when installing IdentityIQ is `IdentityIQ`, as in the URL: `http://localhost:8080/IdentityIQ`.\ The context root can be changed from the default value during the IdentityIQ installation stage. If so, type in the updated value. - **Server**: The IdentityIQ server name. - **Port**: The IdentityIQ port. - **Is SSL**: Select if IdentityIQ uses SSL. - **User/Password**: The IdentityIQ credentials (from the account in Section "IdentityIQ User for File Access Manager"). - **IdentityIQ Account Name Attribute**: The Account Mapping attribute name (from the **File Access Manager Account Name** mapping created in the **Setting Account Mappings** section).\ If the names are the same as those in this guide, the attribute will be `siqAccountName`. - **IdentityIQ User Principal Name Attribute**: Type the Principal Name Mapping attribute name, as defined in the **File Access Manager Principal Name** mapping created in the **Setting Account Mappings** section.\ If the names are the same as those in this guide, the attribute will be `siqPrincipalName`. - **Report Interval**: Set the connector Health reporting interval (in seconds). 1. Select **Manage Attributes**. This screen displays the attributes that can be fetched from the IdentityIQ Enrichment connector. Some are predefined attributes, while others are custom attributes (defined in IdentityIQ Identity Mappings). The predefined attributes displayed the first time this screen is shown are: - `userName` - `capabilities` - `displayName` - `isManager` - `active` - `email` Note Other attributes will be displayed after the predefined attributes, with the same Name and Display Name, and will be unmarked by default. Each marked attribute will be fetched from IdentityIQ and stored in each File Access Manager activity.\ Mark an attribute to add it, or unmark an attribute to remove it. Important Predefined attributes cannot be unmarked. You can edit the display name of any attribute by selecting it and typing a new **Display Name**. 1. Select **Save** after editing the attributes. 1. Select **Save** (again) to save the connector. # Prerequisites Make sure your system fits the descriptions below before starting the installation. ## Active Directory Application Setup 1. Create an Active Directory application in IdentityIQ if one does not already exist 1. Navigate to Application Configuration > Domain Configuration, and fill in the “NetBIOS Name” column for each domain. ## Setting Account Mappings 1. Navigate to **Global Settings > Account Mappings**. 1. Create a new attribute by selecting **Add New Attribute**. 1. Set the following values: - **Attribute Name** (with the same character case): `siqAccountName` - **Display Name**: `File Access ManagerAccount Name` 1. Select **Add Source** to add a new source. 1. Select **Global Rule**. 1. Select the ellipsis button (…) to the right of the **Rule** field. 1. Set the following values: - **Rule Name**: `SIQ Account Name` - **Source code**: ```text import sailpoint.object.Application; import sailpoint.object.Link; import sailpoint.tools.Util; import java.util.List; value = null; if (link != null) { Application app = link.getApplication(); if (app != null && app.type.equalsIgnoreCase("Active Directory - Direct")) { String msDSPrincipalName = link.getAttribute("msDS-PrincipalName"); if (Util.isNotNullOrEmpty(msDSPrincipalName) && msDSPrincipalName.contains("\\") ) { value = msDSPrincipalName; } else { String sAMAccountName = link.getAttribute("sAMAccountName"); String distinguishedName = link.getAttribute("distinguishedName"); List settings = app.getAttributeValue("domainSettings"); if (settings != null && Util.isNotNullOrEmpty(sAMAccountName) && Util.isNotNullOrEmpty(distinguishedName)) { distinguishedName = distinguishedName.toLowerCase(); String userDomainDN = distinguishedName.substring(distinguishedName.indexOf(",dc=") + 1); for (Map settingObj : Util.iterate(settings)) { if (!Util.isEmpty(settingObj)) { String domainNetBIOSName = Util.getString(settingObj, "domainNetBiosName"); String domainDN = Util.getString(settingObj, "domainDN"); if (Util.isNotNullOrEmpty(domainNetBIOSName) && Util.isNotNullOrEmpty(domainDN) && userDomainDN.equalsIgnoreCase(domainDN)) { value = domainNetBIOSName + "\\" + sAMAccountName; } } } } } } } return value; ``` 1. Select **Save**. 1. Select **SIQ Account Name** from the Rules selection. 1. Select **Add**. 1. Select **Save**. 1. Create a new attribute by selecting **Add New Attribute**. 1. Set the following values: - **Attribute Name** (with the same character case): `siqPrincipalName` - **Display Name**: `File Access Manager Principal Name` 1. Select **Add Source** to add a new source. 1. Set the following values: - **Application**: The Active Directory application name - **Attribute**: `userPrincipalName` 1. Select **Add**. 1. Select **Save**. Note To force IdentityIQ account mappings to be updated, run the Active Directory Account Aggregation task with the option **Disable optimization of unchanged accounts** checked. ## IdentityIQ User for File Access Manager File Access Manager connects to IdentityIQ, using the basic authentication mechanism to retrieve data from IdentityIQ. Basic authentication requires a user name and a password. Assign an IdentityIQ user (with SCIM Executor capability) to File Access Manager so that the user has access to, and can retrieve data from,IdentityIQ. # NAS File Storage The following are File Access Manager supported connectors: - CIFS - DFS - EMC-Celerra - EMC-Isilon - EMC-Unity CIFS - HDS - NetApp # CIFS Connector Overview A CIFS server is an EMC component that corresponds to a file server (\\cifs_server_name). You can configure a CIFS server on a physical Data Mover or on a VDM. Typically, the CIFS servers are configured on a VDM. Every CIFS server requires an Application definition in File Access Manager. The CIFS connector enables crawling, permissions collection (without local users and local groups) and data classification but does not provide activity monitoring. Note File Access Manager provides dedicated specified connectors for common application types. You should check for a specific connector, if we provide it, before trying to install a generic connector. Refer to the section on Business Resource Structure in the File Access Manager Administrator Guide for a full list of supported application types. ## Supported Versions Any CIFS compliant file server. ## Capabilities This connector enables you to use File Access Manager to access and analyze data stored in CIFS and do the following: - Analyze the structure of your stored data. - Monitor user activity in the resources. - Classify the data being stored. - Verify user permissions on the resources, and compare them against requirements. - Manage access fulfillment - automated granting and revoking of access - according to rules set in File Access Manager. - Identity collector – collect IAM users, groups and roles and the connections between them. Refer to the File Access Manager documentation for a full description. ## CIFS Installation Flow Overview **To install the CIFS connector:** 1. Configure all the prerequisites. 1. Add a new CIFS application in the Business Website. 1. Install the relevant services: - Activity Monitor - This is the activity collection engine, used by all connectors that support activity monitoring. - Permissions Collector If you are using EC2 login, the collector should be installed on the EC2 instance. - Data Classification Collector Important Installing the permissions collector and data classification services is optional and should only be installed by someone with a full understanding of File Access Manager deployment architecture. The File Access Manager Administrator Guide has additional information on the architecture. # Collecting Data Stored in an External Application ## Terminology: - **Connector** - The collection of features, components and capabilities that comprise File Access Manager support for an endpoint. - **Collector** - The “Agent” component or service in a Data Classification and or Permission Collection architecture. - **Engine** - The core service counterpart of this architecture. - **Identity Collector** - A logical component used to fetch identities from an identity store and holds the configuration, settings for that identity store, and the relations between these identities. The identity collector has no “physical” manifest. The actual work is done by the Collector Synchronizer. The list below describes the high level installation process required to collect and analyze data from an external application. Most of these should already be set up in your File Access Manager installation. Refer to the server Installation guide for further details. - **Install a Data Classification central engine** - One or more central engines, installed using the server installer - **Install a Permission Collection central engine** - One or more central engines, installed using the server installer - **Create an Application in File Access Manager** - From the Business Website. The application is linked to central engines listed above. - **Add an Activity Monitor** - To collect activities for this application - run the Collector Installation Manager and add an application under Activity Monitoring. ## Adding Collectors **Install Permission Collectors and / or Data Classification Collector (optional)** - Optionally, you can install collectors that will run on a separate server and take some of the work from the central PC and DC engines (Where supported). When installing a collector, you attach it to an engine. If no collectors are installed, the central services act as both the engine and the collector. To install a collector, you must have the **RabbitMQ** service installed for communication between the central engines and the collectors. RabbitMQ is installed Note Some cloud connectors ignore collectors connected to the central engine. (Box, Dropbox, OneDrive, SharePointOnline, Exchange Online, GoogleDrive) . In these applications the task will be done entirely by the engine, and not relegated to its collectors. Note For further details, refer to the **Application > Central Service > Collector Relations** section in the File Access Manager Administrator Guide. # Installing Services: Collector Installation 1. Run the **Collector Installation Manager** as an Administrator. The installation files are in the installation package under the folder Collectors. The Collector Installation Manager window displays. 1. Enter the credentials to connect to File Access Manager. - ServerName/IP should be pointed to the Agent Configuration Manager service server. - A File Access Manager user with Collector Manager permission (permission to install collectors). For Active Directory authentication, use the format domain\\username. 1. Select **Next** to open the **Service Configuration** window. 1. If you are installing the Permission Collector, select the Central Permission Collector to which to connect this service. Select **Add**. 1. If you are installing the Data Classification, select the Central Classification Collector to which to connect this service. Select **Add**. 1. Select *Next*. The Installation Folder window displays. 1. If this is the first time you are installing collectors on this machine, you will be prompted to select an installation folder. All future collectors will be installed in this folder. 1. Browse and select the location of the target folder for installation. 1. Browse and select the location of the folder for system logs. 1. Select **Next**. The system begins installing the selected components. 1. Select **Finish**. The Finish button is displayed after all the selected components have been installed. Note The File Access Manager Administrator Guide provides more information on the collector services. # Prerequisites Make sure your system fits the descriptions below before starting the installation. ## Software Requirements File Access Manager requires the latest ASP.NET Core 8.0.x Hosting Bundle. This bundle consists of .NET Runtime and ASP .NET Core Runtime. You can download the latest 8.0.x Hosting Bundle version from [here](https://dotnet.microsoft.com/en-us/download/dotnet/8.0). ## CIFS User Permissions File Access Manager requires different permissions, based on the tasks that require those permissions. The user configured in the Application Configuration Wizard must have the following permissions for each task: - **Crawling** - A user with Shared Read access, who has permissions to enumerate all shares on the CIFS server. A user with File Read access, with permissions to read file attributes. Typically, in most systems, this would be a member of the local Backup Operators group on the CIFS server. - **Permission Collection** - A user with Shared Read access, who has permissions to enumerate all shares on the CIFS server. A user with permissions for enumeration of CIFS share-level permissions. Typically, in most systems, this would be a member of the local Backup Operators group on the CIFS server. - **Data Classification** - A user with Shared Read access, who has permissions to enumerate all shares on the CIFS server. A user with File Read access, with permissions to read the file contents. Typically, in most systems, this would be a member of the local Backup Operators group on the CIFS server. ## CIFS Connector Communications Requirements | **Requirement** | **Source** | **Destination** | **Port** | | ---------------------------------------------------- | ----------------------------------------------------- | ---------------- | ------------------- | | File Access Manager Message Broker | Permissions Collector / Data Classification Collector | RabbitMQ | 5671 | | Permissions Collector & Data Classification Analysis | Permissions Collector / Data Classification Server | Monitored server | CIFS/SMB (139, 445) | # Verifying the CIFS Connector Installation ## Installed Services Verify that the services installed for the connector are available and active. Using windows Service manager, or other tool, look for the File Access Manager services, and verify whether they are running. For example: - File Access Manager Central Permissions Collection - `` service is running. - File Access Manager Central Data Classification - `` service is running. ## Log Files Check the log files listed below for errors - `“%SAILPOINT_HOME_LOGS%\ FilesMiniFilter_ .log"` - `“%SAILPOINT_HOME_LOGS%\PermissionCollection_.log"` - `“%SAILPOINT_HOME_LOGS%\DataClassification_.log"` ## Permissions Collection 1. Run the Crawler and Permissions Collector tasks on the **Settings > Task Management > Scheduled Tasks** page. 1. Verify that: - The tasks completed successfully. - Business resources were created in the resource explorer from the **Admin > Applications > [application column] > Manage Resources** page. - Permissions display in the Permission Forensics page at **Forensics > Permissions**. # Adding a CIFS Application In order to integrate with CIFS, we must first create an application entry in File Access Manager. This entry includes the identification, connection details, and other parameters necessary to create the link. To add an application, use the New Application Wizard. 1. Navigate to **Admin** > **Applications**. 1. Select **Add New** to open the New Application Wizard. 1. Select **Standard Application** for the wizard type. 1. Select **Next** to open the **General Details** page. ## General Details - **Application Type** - CIFS - **Application Name** - Logical name of the application - **Description** - Description of the application - **Tags** - Select tags for the application from the dropdown menu, and / or type a new name, and select **Enter** to create a new tag. The dropdown list of tags filters out matching tags as you type and displays up to 50 tags. Note The tags replace the Logical container field that was used when creating applications in releases before 8.2. - **Event Manager Server** - This option is available if there are more than one event manager servers configured in the system. Select an event manager from the drop down menu. - **Identity Collector** - Select from the Identity Collector dropdown menu. - You can create identity collectors in the administrative client on the **Applications > Configuration > Permissions Management > Identity Collectors** page. Refer to the OOTB Identity Collection section in the Collector Installation Manager File Access Manager Administrator Guide for further details. - If adding a new identity collector, select the **Refresh** button to update the Identity Collector dropdown list. Select **Next** to open the **Connection Details** page. ## Connection Details - **Server Name** - The name of the CIFS server to which users connect - **Domain Name** - The user defined in the prerequisites - **Username / Password** - Credentials of the the user defined in the prerequisites Select **Next**. # Selecting and Scheduling the Data Classification Settings **To associate an application with a data classification service, and set the schedule:** 1. Go to **Admin > Applications** to open the **Edit** page of the required application. 1. Scroll through the list, or use the filter to find the application 1. Select the **edit** icon on the line of the application 1. Select **Next** until you reach the **Data Classification** settings page. The actual entry fields vary according to the application type **Central Data Classification Service** - Associate the application with a Central Data Classification Service. This service is responsible for running the Data Classification tasks. If the “Central Data Classification” wasn’t installed during the installation of the server, this field is disabled. **Disabling Data Classification** - To disable data classification, delete the entry from the central data classification field. Disabling data classification can also be achieved by setting the scheduler to be inactive (which is the default setting for data classification). **Create a Schedule** - This option is enabled only if a central data classification service is selected. Refer to [Scheduling a Task](https://documentation.sailpoint.com/fam-connectors/help/nas/cifs/add/perm_coll.html#scheduling-a-task). Note Refer to the Data Classification chapter in the File Access Manager Administrator Guide for more information. Select **Next** or **Finish**. ## Data Privacy A user can associate the application with a Central Data Classification Engine Service. This engine will be responsible for executed Data Privacy tasks. Though using different processes for each, the Data Classification engine service is in charge for both Data Privacy and Data Classification discovery tasks. You may choose the same service for both, or use a different one for each, to run them in parallel. Note The fields on the Data Privacy step are the same as the Data Classification step. # Configuring and Scheduling the Permissions Collection Permissions can be analyzed to determine the application permissions of an out-of-the-box application, provided you have defined an identity store for File Access Manager to use in its analysis, and you have run a crawl for the application. The permission collector is a software component responsible for analyzing the permissions in an application. The Central Permission Collector Service is responsible for running the Permission Collector and Crawler tasks. If the “File Access Manager Central Permission Collector” wasn’t installed during the installation of the server, this configuration setting will be disabled. **To configure the Permission Collection:** 1. Go to **Admin > Applications** to open the **Edit** page of the required application. 1. Scroll through the list, or use the filter to find the application. 1. Select the **edit** icon on the line of the application. 1. Select **Next** until you reach the **Crawler & Permissions Collection** settings page. The actual entry fields vary according to the application type. 1. When entering this page in edit mode, you can navigate between the various configuration windows using the **Next** and **Back** buttons. **Central Permissions Collection Service** - Select a central permission collection service from the dropdown list. You can create permissions collection services as part of the service installation process. Refer to the Services Configuration section in the File Access Manager Administrator Guide for further details. **Skip Identities Sync during Permission Collection** - Skip identity synchronization before running permission collection tasks when the identity collector is common to different connector. Note This option is checked by default. You can now [schedule a task](#scheduling-a-task). ## Scheduling a Task To create a schedule: 1. Select **Create a Schedule**. 1. The system will provide a Schedule Name in the format `{appName} - {type} Scheduler`. Choose to keep or override this suggestion. 1. Select a scheduling frequency from the dropdown list. Schedule Frequency Options - Run After - Create dependency of tasks. The task starts running only upon successful completion of the first task. - Hourly - Set the start time. - Daily - Set the start date and time. - Weekly - Set the day(s) of the week on which to run. - Monthly - Set the day of the month on which to run a task. - Quarterly - Set a monthly schedule with an interval of 3 months. - Half Yearly - Set a monthly schedule with an interval of 6 months. - Yearly - Set a monthly schedule with an interval of 12 months. 1. Fill the Date and Time field with scheduling times. These fields differ depending upon the scheduling frequency selected. 1. Select the **Active** checkbox to activate the schedule. 1. Select **Next**. ### Configuring and Scheduling the Crawler **To set or edit the Crawler configuration and scheduling:** 1. Go to **Admin > Applications** to open the **Edit** page of the required application. 1. Scroll through the list, or use the filter to find the application. 1. Select the **edit** icon on the line of the application. 1. Select **Next** until you reach the **Crawler & Permissions Collection** settings page. The actual entry fields vary according to the application type. **Calculate Resource Size** - Determine when, or at what frequency, File Access Manager calculates the resources' size. Select one of the following: - Never - Always - Second crawl and on (This is the default) **Create a Schedule** - Select to open the schedule panel. Refer to [Scheduling a Task](#scheduling-a-task). ### Setting the Crawl Scope There are several options to set the crawl scope: - Setting explicit list of resources to include and / or exclude from the scan. - Creating a regex to define resources to exclude. ### Including and Excluding Paths by List **To set the paths to include or exclude in the crawl process for an application:** 1. Go to **Admin > Applications** to open the **Edit** page of the required application. 1. Scroll through the list, or use the filter to find the application. 1. Select the **edit** icon on the line of the application. 1. Select **Next** until you reach the **Crawler & Permissions Collection** settings page. The actual entry fields vary according to the application type. 1. Scroll down to the Crawl configuration settings. 1. Select **Advanced Crawl Scope Configuration** to open the scope configuration panel. 1. Select **Include / Exclude Resources** to open the input fields. 1. To add a resource to a list, type in the full path to include / exclude in the top field and select the **+** icon to add it to the list. 1. To remove a resource from a list, find the resource from the list, and select the **x** icon on the resource row. Note When creating exclusion lists, excludes take precedence over includes. ### Excluding Paths by Regex **To set filters of paths to exclude in the crawl process for an application using regex:** 1. Go to **Admin > Applications** to open the **Edit** page of the required application. 1. Scroll through the list, or use the filter to find the application. 1. Select the **edit** icon on the line of the application. 1. Select **Next** until you reach the **Crawler & Permissions Collection** settings page. The actual entry fields vary according to the application type. 1. Select **Exclude Paths by Regex** to open the configuration panel. 1. Type in the paths to exclude by Regex. Refer to the regex examples in the section below. Since the system does not collect BRs that match this Regex, it also does not analyze them for permissions. ### Crawler Regex Exclusion Example The following are examples of crawler Regex exclusions: #### Exclude all shares which start with one or more shares names | **Example** | **Regex** | | ------------------------------------------------------------------------- | ----------------------------- | | Starting with `\\server_name\shareName` | `\\\\server_name\\shareName$` | | Starting with `\\server_name\shareName` or `\\server_name\OtherShareName` | \`\\\\server_name\\(shareName | #### Include ONLY shares which start with one or more shares names | **Example** | **Regex** | | ------------------------------------------------------------------------- | ---------------------------------- | | Starting with `\\server_name\shareName` | \`^(?!\\\\server_name\\shareName($ | | Starting with `\\server_name\shareName` or `\\server_name\OtherShareName` | \`^(?!\\\\server_name\\(shareName | #### Narrow down the selection | **Example** | **Regex** | | --------------------------------------------------------------- | ---------------------------------- | | Include ONLY the C$ drive shares: `\\server_name\C$` | \`^(?!\\\\server_name\\C$($ | | Include ONLY one folder under a share: `\\server\share\folderA` | \`^(?!\\\\server_name\\share$($ | | Include ONLY all administrative shares | \`^(?!\\\\server_name\\[a-zA-Z]$($ | Note - To write a backslash or a Dollar sign, add a backslash before it as an escape character. - To add a condition in a single command, use a pipe character “|” . ### Excluding Top Level Resources Use the top level exclusion screen to select top level roots to exclude from the crawl. This setting is done per application. **To exclude top level resources from the crawl process:** 1. Go to **Admin > Applications** to open the **Application** page. 1. Find the application to configure and select the drop down menu on the application line. Select **Exclude Top Level Resources** to open the configuration panel. 1. Select **Run Task**. The Run Task button triggers a task that runs a short detection scan to detect the current top level resources. Before running the task for the first time, the following message displays above this button: **Note: Run task to detect the top-level resources**. If the top level resource list has changed in the application while yo u are on this screen, select this button to retrieve the updated structure. Once triggered, you can view the task status on the **Settings > Task Management > Tasks** page. Note This will only work if the user has access to the task page When the task has completed, select **Refresh** to update the page with the list of top level resources. 1. Select the top level resource list, and select top level resources to exclude. 1. Select **Save** to save the change. 1. To refresh the list of top level resources, run the task again. Running the task will not clear the list of top level resources to exclude. ### Special Consideration for Long File Paths in Crawl If you need to support long file paths above 4,000 characters for the crawl, set the `excludeVeryLongResourcePaths` flag in the Permission Collection Engine App.config file to `true`. By default this value will be commented out and set to `false`. This key ensures, when enabled, that paths longer than 4000 characters are excluded from the applications’ resource discovery (Crawl), to avoid issues while storing them in the SQLServer database. When enabled, business resources with full paths longer than 4000 characters, and everything included in the hierarchical structure below them, will be excluded from the crawl, and will not be collected by File Access Manager. This scenario is extremely rare. Note You should not enable exclusion of long paths, unless you experience an issue. - **Background** - File Access Manager uses a hashing mechanism to create a unique identifier for each business resource stored in the File Access Manager database. The hashing mechanism in SQLServer versions 2014 and earlier, is unable to process (hash) values with 4,000 or more characters. Though resources with paths of 4000 characters or longer are extremely rare, File Access Manager is designed to handle that limitation. - **Identifying the Problem** - When using an SQL Server database version 2014 and earlier. The following error message in the Permission Collection Engine log file: `System.Data.SqlClient.SqlException (0x80131904): String or binary data would be truncated.` In all other cases, this feature should not be enabled. - **Setting the Long Resource Path Key** - The Permission Collection Engine App.config file is `RoleAnalyticsServiceHost.exe.config`, and can be found in the following folder: %SailPoint_Home%\\FileAccessManager[Permission Collection instance]\\ Search for the key `excludeVeryLongResourcePaths` and correct it as described above. # HDS Connector Overview ## Connector Operation Principles - File Access Manager Windows DFS application differs from other File Access Manager connectors in that it does not actively monitor activities, collect permissions, or classify data. Instead, it acts as a logical representation of multiple physical applications. It fetches data by mapping DFS logical shares to their corresponding physical target applications shares. - The crawler service creates mapping between DFS applications and physical applications. Note Windows DFS applications only supports domain-based DFS namespaces. Note An application must be configured in File Access Manager for each DFS domain. ## Terminology DFS (Distributed File System) refers to a virtual arrangement of distributed Microsoft servers as a single resources tree. Refer to the [DFS Namespace Overview](https://docs.microsoft.com/en-us/windows-server/storage/dfs-namespaces/dfs-overview) for more information. - **DFS Namespace** - A virtual view of shared folders on servers provided by DFS. A DFS namespace consists of a root and many links and targets. The namespace starts with a root that maps to one or more root targets. Below the root are links that map to their own targets. - **Domain-based DFS namespace** - A DFS namespace whose configuration information is stored in Active Directory. - **DFS Link (folder with targets)** - A component in a DFS path that lies below the root and maps to one or more link targets. - **DFS Link Target (folder target)** - The mapping destination of a link. A link target can be any UNC path, such as a shared folder or another DFS path. ## Monitored Activities Any activities on shares that are targets of DFS links are “tagged” with an additional field with the logical DFS path and an indication that they are DFS-related. This allows activities to be queried via a DFS application and business resources and to have its DFS logical path displayed. Any activity type monitored by a physical application, mapped to the DFS application, can also be displayed via the DFS application. ## Permissions Collection and Data Classification DFS are logical resources that only point to the physical folders in which actual data are located. Windows DFS applications do not have Permissions Collection nor Data Classification services. To display permissions and data classification results, DFS applications redirect their link folders to their mapped targets and display the results collected by their physical applications. ## DFS Link Targets Priority Some DFS links may point to multiple physical shares that are assumed to be replicated. If so, File Access Manager selects prioritized results from one or more physical shares, which is different for each of the following scenarios: - **Activities** - When a link has multiple targets, all physical target resources are queried for activities, since activities are not necessarily replicated consistently across shares. - **Permissions** - When a link has multiple targets, the target with the most recent File Access Manager permission analysis is selected. - **Data Classification** - When a link has multiple targets, the target with the most recent File Access Manager Data Classification analysis is selected. ## Manual Matching of Unknown Target Host Names During a DFS Crawl, the Crawler tries to match target host names to the host names of existing applications in the File Access Manager database. When the Crawler is unable to match specific hosts, it attempts to match hosts via DNS lookups, and to find valid matching alias names (for example, a host name displayed as an IP address). If a search cannot find host names or cannot match host name aliases to an existing host in the File Access Manager database, it is possible to configure matching hosts manually. 1. Create an \*.xml file with the following structure: `` `` `AlternateHostA` `172.66.12.12` `` In the example above, “hostA” is a host name of a link target to be matched manually. “AlternateHostA” is the host name to which “hostA” will be matched. Note “AlternateHostA” should be a host name of an existing application in File Access Manager. 1. Add the following key to the DFS Permissions Collector’s service **app.config.** `""` 1. Replace `C:\myMappings.xml` with the path that points to the configuration file. 1. Restart the DFS Permissions Collector service. ## Capabilities This connector enables you to use File Access Manager to access and analyze data stored in DFS and do the following: - Analyze the structure of your stored data. - Monitor user activity in the resources. - Classify the data being stored. - Verify user permissions on the resources, and compare them against requirements. - Manage access fulfillment - automated granting and revoking of access - according to rules set in File Access Manager. - Identity collector – collect IAM users, groups and roles and the connections between them. Refer to the File Access Manager documentation for a full description. ## DFS Installation Flow Overview **To install the DFS connector:** 1. Configure all the prerequisites. 1. Add a new DFS application in the Business Website. 1. Install the relevant services: - Activity Monitor - This is the activity collection engine, used by all connectors that support activity monitoring. - Permissions Collector If you are using EC2 login, the collector should be installed on the EC2 instance. - Data Classification Collector Important Installing the permissions collector and data classification services is optional and should only be installed by someone with a full understanding of File Access Manager deployment architecture. The File Access Manager Administrator Guide has additional information on the architecture. # Collecting Data Stored in an External Application ## Connector / Collector terminology: - **Connector** - The collection of features, components and capabilities that comprise File Access Manager support for an endpoint. - **Collector** - The “Agent” component or service in a Data Classification and or Permission Collection architecture. - **Engine** - The core service counterpart of this architecture. - **Identity Collector** - A logical component used to fetch identities from an identity store and holds the configuration, settings for that identity store, and the relations between these identities. The identity collector It has no “physical” manifest. The actual work is done by the Collector Synchronizer. The list below describes the high level installation process required to collect and analyze data from an external application. Most of these should already be set up in your File Access Manager installation. Refer to the server Installation guide for further details. - **Install a Data Classification central engine** - One or more central engines, installed using the server installer - **Install a Permission Collection central engine** - One or more central engines, installed using the server installer - **Create an Application in File Access Manager** - In the File Access Manager website, (Admin > Applications). The application is linked to central engines listed above. ## Crawler Responsibilities The crawler works with native API calls that communicate with the domain controller and the DFS namespace servers. The crawler: - Creates the DFS resources tree - Creates mapping between the DFS links resources and physical applications resources. - The crawler can only map DFS links to physical shares in the File Access Manager database. Therefore, before the DFS crawler runs, the shares in the physical applications must have already been found. If a physical share is not found for a DFS link, the crawler will issue an “unfound target” warning in the task details. # Installing Services: Collector Installation Run the **Collector Installation Manager** as an Administrator. 1. The installation files are in the installation package under the folder Collectors. The Collector Installation Manager window displays. 1. Enter the credentials to connect to File Access Manager. - ServerName/IP should be pointed to the Agent Configuration Manager service server. - A File Access Manager user with Collector Manager permission (permission to install collectors). For Active Directory authentication, use the format domain\\username. 1. Select **Next** to open the **Service Configuration** window. 1. If you are installing the Permission Collector, select the Central Permission Collector to which to connect this service. Select **Add**. 1. If you are installing the Data Classification, select the Central Classification Collector to which to connect this service. Select **Add**. 1. Select **Next**. The Installation Folder window displays. Note If this is the first time you are installing collectors on this machine, you will be prompted to select an installation folder. All future collectors will be installed in this folder. 1. Browse and select the location of the target folder for installation. 1. Browse and select the location of the folder for system logs. 1. Select **Next**. The system begins installing the selected components. 1. Select **Finish**. The Finish button is displayed after all the selected components have been installed. Note The File Access Manager Administrator Guide provides more information on the collector services. # Prerequisites Make sure your system fits the descriptions below before starting the installation. ## Software Requirements File Access Manager requires the latest ASP.NET Core 8.0.x Hosting Bundle. This bundle consists of .NET Runtime and ASP .NET Core Runtime. You can download the latest 8.0.x Hosting Bundle version from [here](https://dotnet.microsoft.com/en-us/download/dotnet/8.0). ## Permissions When the Crawler service runs on a server, which is part of the domain that hosts the domain-based DFS namespaces, neither a user nor a password configuration is required. If the server is not part of the DFS domain, then the following requirements must be met: - The server must be able to resolve the DFS domain. - The Crawler service must be configured with a standard domain user on that DFS domain in order to gain access using impersonation. ## Communications Requirements | **Requirement** | **Source** | **Destination** | **Port** | | ----------------------------------- | --------------------- | ---------------------------- | ------------------------------- | | Database Access | Permissions Collector | File Access Manager database | Per the specific DB definitions | | LDAP for authenticating | | | 389 | | RPC | | | 135 + Dynamic ports range | | Required for collecting DFS details | | | 139, 445 | | DNS | | | 53 (UDP and TCP) | # Troubleshooting Check the issues below for common problems and suggested ways of handling them. ## Manual Matching of Unknown Target Host Names During a DFS Crawl, the Crawler tries to match target host names to the host names of existing applications in the File Access Manager database. When the Crawler is unable to match specific hosts, it attempts to match hosts via DNS lookups, and to find valid matching alias names (for example, a host name displayed as an IP address). If a search cannot find host names or cannot match host name aliases to an existing host in the File Access Manager database, it is possible to configure matching hosts manually. **To manually configure matching hosts, perform the following steps:** 1. Create an \*.xml file with the following structure: `` `` `AlternateHostA` `172.66.12.12` `` In the above example, “hostA” is a host name of a link target to be matched manually. “AlternateHostA” is the host name to which “hostA” will be matched. Note “AlternateHostA” should be a host name of an existing application in File Access Manager. 1. Add the following key to the DFS Permissions Collector’s service “app.config”. `""` 1. Replace "C:\\myMappings.xml" with the path that points to the configuration file. 1. Restart the DFS Permissions Collector service. ## Activities not Displayed in the Website If activities are not shown in the Business Website: - Verify that all prerequisites were set. - Check if the shares on the physical applications have activities. - If the physical shares do not have activities, this indicates that the monitor on the physical application is not working properly. Please refer to the relevant physical application Connector Troubleshooting guide. If the shares on the physical applications have activities, but the DFS shares do not have activities, this indicates that the Windows DFS crawler did not map the DFS shares to physical application shares properly. # Verifying the DFS Connector Installation ## Crawler 1. Run the Crawler task on the **Settings > Task Management > Scheduled Tasks** page. 1. Verify that: 1. The tasks completed successfully. 1. Business resources were created in the resource explorer on the **Admin > Applications > [application column] > Manage Resources** page. 1. DFS is mapped to physical resources. ## Monitored Activities 1. Assure that activities are received for the physical application, mapped to the DFS share. 1. Run the Crawler task, and verify that the DFS resource explorer has the DFS share and folder to be used for the activity simulations. 1. Simulate activities on physical DFS shares. 1. Wait a for approximately one minute. 1. Query activities in the File Access Manager website by selecting the DFS application ``. 1. Verify that the activities display in the web Client. Note The activity details should contain a **Logical Paths** field with the DFS logical paths. ## Permissions Collection 1. Run a Permissions Collector task on a physical application with DFS target shares. 1. Verify the following: - The task completed successfully. - Permissions display in the Permissions Forensics window for the physical DFS target shares. - Permissions display in the Permissions Forensics window for the DFS links which points to the above physical target shares ## Data Classification 1. Run a Data Classification task on a physical application with DFS target shares. 1. Verify that: - The task completed successfully. - Data Classification results display in the File Access Manager website Data Classification Forensics window for the physical DFS target shares. - Data Classification results display in the File Access Manager website Data Classification Forensics window for the DFS links that point to the above physical target shares. # Adding a DFS Application In order to integrate with DFS, we must first create an application entry in File Access Manager. This entry includes the identification, connection details, and other parameters necessary to create the link. To add an application, use the New Application Wizard. 1. Navigate to **Admin** > **Applications**. 1. Select **Add New** to open the New Application Wizard. 1. Select **Standard Application** for the wizard type. 1. Select **Next** to open the **General Details** page. ## General Details - **Application Type** - Windows DFS - **Application Name** - Logical name of the application - **Description** - Description of the application - **Tags** - Select tags for the application from the dropdown menu, and / or type a new name, and select **Enter** to create a new tag. The dropdown list of tags filters out matching tags as you type and displays up to 50 tags. Note The tags replace the Logical container field that was used when creating applications in releases before 8.2 - **Event Manager Server** - This option is available if there are more than one event manager servers configured in the system. Select an event manager from the drop down menu. Select **Next** to open the **Connection Details** page. ## Connection Details Complete the Connection Details fields: - **Domain Name** - The user defined in the prerequisites - **Username** - The user defined in the prerequisites - **Password** - The user defined in the prerequisites The Windows DFS application supports only crawling, therefore, the scheduling tab will only contain the crawler scheduling window. # Configuring and Scheduling the Permissions Collection ## Configuring and Scheduling the Crawler **To set or edit the Crawler configuration and scheduling:** 1. Go to **Admin > Applications** to open the **Edit** page of the required application. 1. Scroll through the list, or use the filter to find the application. 1. Select the **edit** icon on the line of the application. 1. Select Next until you reach the **Crawler & Permissions Collection** settings page. The actual entry fields vary according to the application type. You can now [schedule a task](#scheduling-a-task). ## Scheduling a Task To create a schedule: 1. Select **Create a Schedule**. 1. The system will provide a Schedule Name in the format `{appName} - {type} Scheduler`. Choose to keep or override this suggestion. 1. Select a scheduling frequency from the dropdown list. Schedule Frequency Options - Run After - Create dependency of tasks. The task starts running only upon successful completion of the first task. - Hourly - Set the start time. - Daily - Set the start date and time. - Weekly - Set the day(s) of the week on which to run. - Monthly - Set the day of the month on which to run a task. - Quarterly - Set a monthly schedule with an interval of 3 months. - Half Yearly - Set a monthly schedule with an interval of 6 months. - Yearly - Set a monthly schedule with an interval of 12 months. 1. Fill the Date and Time field with scheduling times. These fields differ depending upon the scheduling frequency selected. 1. Select the **Active** checkbox to activate the schedule. 1. Select **Next**. ## Setting the Crawl Scope There are several options to set the crawl scope: - Setting explicit list of resources to include and / or exclude from the scan. - Creating a regex to define resources to exclude. ## Including and Excluding Paths by List **To set the paths to include or exclude in the crawl process for an application:** 1. Go to **Admin > Applications** to open the **Edit** page of the required application. 1. Scroll through the list, or use the filter to find the application. 1. Select the **edit** icon on the line of the application. 1. Select **Next** until you reach the **Crawler & Permissions Collection** settings page. The actual entry fields vary according to the application type. 1. Scroll down to the Crawl configuration settings. 1. Select **Advanced Crawl Scope Configuration** to open the scope configuration panel. 1. Select **Include / Exclude Resources** to open the input fields. 1. To add a resource to a list, type in the full path to include / exclude in the top field and select the **+** icon to add it to the list. 1. To remove a resource from a list, find the resource from the list, and select the **x** icon on the resource row. Note When creating exclusion lists, excludes take precedence over includes. ## Excluding Paths by Regex **To set filters of paths to exclude in the crawl process for an application using regex:** 1. Go to **Admin > Applications** to open the **Edit** page of the required application. 1. Scroll through the list, or use the filter to find the application. 1. Select the **edit** icon on the line of the application. 1. Select **Next** until you reach the **Crawler & Permissions Collection** settings page. The actual entry fields vary according to the application type. 1. Select **Exclude Paths by Regex** to open the configuration panel. 1. Type in the paths to exclude by Regex. Refer to the regex examples in the section below. Since the system does not collect BRs that match this Regex, it also does not analyze them for permissions. ## Crawler Regex Exclusion Example The following are examples of crawler Regex exclusions: ### Exclude all shares which start with one or more shares names | **Example** | **Regex** | | ----------------------------------------------------------------------------------------------------- | ----------------------------------------- | | Starting with `\\[domain_name]\[namespace]\shareName` | `^\\\\domain_name\\namespace\\shareName$` | | Real Example: Exclude myShare share Path: `\\myDomain\myNamespace\myShare` | `^\\\\myDomain\\myNamespace\\myShare$` | | Starting with `\\[domain_name]\[namespace]\shareName` or `\\[domain_name]\[namespace]\OtherShareName` | \`^\\\\domain_name\\namespace\\(shareName | ### Include ONLY shares which start with one or more shares names | **Example** | **Regex** | | ------------------------------------------------------------------------- | --------------------------------- | | Starting with `\\[domain_name]\[namespace]\shareName` | \`^(?!\\\\domain_name($ | | Real Examples: Include only myShare share Path: \`^(?!\\\\myDomain($ | \\myNamespace($ | | Starting with `\\server_name\shareName` or `\\server_name\OtherShareName` | \`^(?!\\\\server_name\\(shareName | ## Excluding Top Level Resources Use the top level exclusion screen to select top level roots to exclude from the crawl. This setting is done per application. **To exclude top level resources from the crawl process:** 1. Go to **Admin > Applications** to open the **Application** page. 1. Find the application to configure and select the drop down menu on the application line. Select **Exclude Top Level Resources** to open the configuration panel. 1. Select **Run Task**. The Run Task button triggers a task that runs a short detection scan to detect the current top level resources. Before running the task for the first time, the following message displays above this button: **Note: Run task to detect the top-level resources**. If the top level resource list has changed in the application while yo u are on this screen, select this button to retrieve the updated structure. Once triggered, you can view the task status on the **Settings > Task Management > Tasks** page. Note This will only work if the user has access to the task page. When the task has completed, select **Refresh** to update the page with the list of top level resources. 1. Select the top level resource list, and select top level resources to exclude. 1. Select **Save** to save the change. 1. To refresh the list of top level resources, run the task again. Running the task will not clear the list of top level resources to exclude. ## Special Consideration for Long File Paths in Crawl If you need to support long file paths above 4,000 characters for the crawl, set the `excludeVeryLongResourcePaths` flag in the Permission Collection Engine App.config file to `true`. By default this value will be commented out and set to `false`. This key ensures, when enabled, that paths longer than 4000 characters are excluded from the applications’ resource discovery (Crawl), to avoid issues while storing them in the SQLServer database. When enabled, business resources with full paths longer than 4000 characters, and everything included in the hierarchical structure below them, will be excluded from the crawl, and will not be collected by File Access Manager. This scenario is extremely rare. Note You should not enable exclusion of long paths, unless you experience an issue. - **Background** - File Access Manager uses a hashing mechanism to create a unique identifier for each business resource stored in the File Access Manager database. The hashing mechanism in SQLServer versions 2014 and earlier, is unable to process (hash) values with 4,000 or more characters. Though resources with paths of 4000 characters or longer are extremely rare, File Access Manager is designed to handle that limitation. - **Identifying the Problem** - When using an SQL Server database version 2014 and earlier. The following error message in the Permission Collection Engine log file: `System.Data.SqlClient.SqlException (0x80131904): String or binary data would be truncated.` In all other cases, this feature should not be enabled. - **Setting the Long Resource Path Key** - The Permission Collection Engine App.config file is `RoleAnalyticsServiceHost.exe.config`, and can be found in the following folder: %SailPoint_Home%\\FileAccessManager[Permission Collection instance]\\ Search for the key `excludeVeryLongResourcePaths` and correct it as described above. # EMC-Celerra Connector Overview ## Capabilities This connector enables you to use File Access Manager to access and analyze data stored in EMC-Celerra and do the following: - Analyze the structure of your stored data. - Monitor user activity in the resources. - Classify the data being stored. - Verify user permissions on the resources, and compare them against requirements. - Manage access fulfillment - automated granting and revoking of access - according to rules set in File Access Manager. - Identity collector – collect IAM users, groups and roles and the connections between them. Refer to the File Access Manager documentation for a full description. ## Connector Overview For more information and a deep technical understanding of the EMC architecture and CEE, refer to [EMC CEE version 7.0 using the Common Event Enabler for Windows](https://www.emc.com/collateral/TechnicalDocument/docu48055.pdf). - **Physical & Virtual Data Mover** - A physical data mover can host multiple virtual data movers (VDMs). Celerra/VNX architecture is based on physical components named data movers. Warning Audit facility (CEPA) is single for each physical data mover, and must be configured separately for each physical data mover. - **CIFS Server** - A CIFS server is an EMC component that corresponds to a file server (\\cifs_server_name). You can configure a CIFS server on a physical Data Mover or on a VDM. Typically, the CIFS servers are configured on a VDM. Every CIFS server requires an Application definition in File Access Manager. - **CIFS Servers Aliases** - An alias is a synonym name of the CIFS server. It is defined in the CIFS server itself and is visible in the EMC Unisphere. Every CIFS server can have one or more aliases. All the activities are always saved in File Access Manager with the real name of the filer. The filer name configured in the application must be the real name only. - A DNS alias is not an EMC alias. Warning You must configure the aliases in the application configuration as well. Failure to do so results in losing the events of users accessing the aliases. - **NFS Exports** - An NFS export is an EMC component that can be associated with any existing network interface to expose a UNIX-style NFS file server. Every NFS network interface that exposes NFS exports requires an Application definition in File Access Manager. - **CEE** - A CEE service is the EMC gateway for communicating and receiving events notifications from the data movers. - All data movers send notifications on CIFS/NFS events to the CEE service. The service in the data mover responsible for sending the events to the CEE is called CEPA (Celerra Event Publishing Connector). - There is an n:n relation between the CEPA service running on the data mover and the CEE service: - Every CEE can communicate with multiple data movers. - Every CEPA service on a data mover can communicate with multiple CEE servers (for high availability and load sharing). - **CEPA and Virtual Data Movers** - For CEE to work, you need to have a CIFS server configured on the physical Data Mover. This is the global CIFS server or the default CIFS server on the physical Data Mover. - **CEE & Activity Monitor** - Every Activity Monitor can communicate with one or more CEE servers. Every CEE service can be configured to work with a multiple Activity Monitor services. - **Activity Monitor** - Each Activity Monitor in File Access Manager corresponds to a single CIFS server. - The first Activity Monitor installed on a physical server creates the Activity Monitor service. Subsequent Activity Monitors installed will not create additional Activity Monitor services. - Every Activity Monitor that is installed adds a bamconfig.xml file under the Activity Monitor to add itself to the same service. Warning The first installed Activity Monitor must be the last Activity Monitor uninstalled. If you uninstall the first Activity Monitor before uninstalling the other installed Activity Monitors, those Activity Monitors will not work, and it will not be possible to uninstall them. ### Permissions Collection Operation Principle - CIFS Shares - File Access Manager connects using EMC administrative shares and analyzes folder permissions. Local groups and users are collected from the CIFS server during the permissions collection process. - NFS Exports - File Access Manager connects using standard NFSv3 access to analyze UNIX-style folder permissions. A NIS Identity Collector is used to resolve UIDs/GIDs permissions discovered during the permissions collection process. ### Monitored Activities The following activities are monitored by the EMC-Celerra connector: - **Create File** - A new file was created. - **Create Folder** - A new folder was created. - **Create from Move** - A “Create Folder” event generates this event on the newly created folder. - **Create from Rename** - A “Rename Folder” event generates this event on the newly created folder. - **Delete File** - A file was deleted. - **Delete Folder** - A folder was deleted. - **Move File** - A file was moved. - **Move Folder** - A folder was moved. - **Permission Change File** - A file’s permissions were changed. - **Permission Change Folder** - A folder’s permissions were changed. - **Read File** - A file was read. - **Rename File** - A file was renamed. - **Rename Folder** - A folder was renamed. - **Write File** - A file was modified. ### Sample Architecture In the schema below, the first physical Data Mover is configured to send events to CEE 1 & 2. CEE 1 & 2 are configured to send event notifications to the Activity Monitor. The second physical Data Mover is configured to send events to CEE 2 & 3. CEE 2 & 3 are configured to send event notifications to the Activity Monitor. - CIFS Server 1 - CIFS Server 2 - NFS Export 1 The Activity Monitor monitors using CEE 2 & 3: - CIFS Server 4 - CIFS Server 5 - NFS Export 2 ## EMC-Celerra Installation Flow Overview **To install the EMC-Celerra connector:** 1. Configure all the prerequisites. 1. Add a new EMC-Celerra application in the Business Website. 1. Install the relevant services: - Activity Monitor - This is the activity collection engine, used by all connectors that support activity monitoring. - Permissions Collector If you are using EC2 login, the collector should be installed on the EC2 instance. - Data Classification Collector Important Installing the permissions collector and data classification services is optional and should only be installed by someone with a full understanding of File Access Manager deployment architecture. The File Access Manager Administrator Guide has additional information on the architecture. # Collecting Data Stored in an External Application ## Terminology - **Connector** - The collection of features, components and capabilities that comprise File Access Manager support for an endpoint. - **Collector** - The “Agent” component or service in a Data Classification and or Permission Collection architecture. - **Engine** - The core service counterpart of this architecture. - **Identity Collector** - A logical component used to fetch identities from an identity store and holds the configuration, settings for that identity store, and the relations between these identities. The identity collector has no “physical” manifest. The actual work is done by the Collector Synchronizer. The list below describes the high level installation process required to collect and analyze data from an external application. Most of these should already be set up in your File Access Manager installation. Refer to the server Installation guide for further details. - **Install a Data Classification central engine** - One or more central engines, installed using the server installer - **Install a Permission Collection central engine** - One or more central engines, installed using the server installer - **Create an Application in File Access Manager** - From the Business Website. The application is linked to central engines listed above. - **Add an Activity Monitor** - To collect activities for this application, run the Collector Installation Manager and add an application under Activity Monitoring. ### Adding Collectors - **Install Permission Collectors and / or Data Classification Collector (optional)** - Optionally, you can install collectors that will run on a separate server and take some of the work from the central PC and DC engines (Where supported). When installing a collector, you attach it to an engine. If no collectors are installed, the central services act as both the engine and the collector. To install a collector, you must have the **RabbitMQ** service installed for communication between the central engines and the collectors. RabbitMQ is installed Note Some cloud connectors ignore collectors connected to the central engine. (Box, Dropbox, OneDrive, SharePointOnline, Exchange Online, GoogleDrive) . In these applications the task will be done entirely by the engine, and not relegated to its collectors. Note For more information, refer to the **Application > Central Service > Collector Relations** section in the File Access Manager Administrator Guide. # Installing Activity Monitor and Collectors Services The Collector Installation Manager is part of the File Access Manager installation package. This tool is used to install the activity monitor, permission collector, and data classification collector. 1. Run the **Collector Installation Manager** as an Administrator. The installation files are in the installation package under the folder Collectors. The Collector Installation Manager window displays. 1. Enter the credentials to connect to File Access Manager. - ServerName/IP should be pointed to the Agent Configuration Manager service server. - A File Access Manager user with Collector Manager permission (permission to install collectors). For Active Directory authentication, use the format domain\\username. 1. Select **Next**. The Service Configuration window displays. 1. If you are installing the Activity Monitor, select the application, and then select **Add**. 1. When installing a SharePoint Activity Monitor, you will be prompted for service account credentials. This service account will be used by the Activity Monitor service to run the service and authenticate against the SharePoint IIS servers to fetch the logs (“Log on as”). Make sure the service account provided has local administrator privileges on the local server (hosting the Activity Monitor service) and can access the activity logs on the IIS servers. 1. If you are installing the Permission Collector, select the Central Permission Collector to which to connect this service, and then select **Add**. 1. If you are installing the Data Classification, select the Central Classification Collector to which to connect this service, and then select **Add**. 1. Select **Next**. The Installation Folder window displays. Note If this is the first time you are installing collectors on this machine, you will be prompted to select an installation folder, in which all future collectors will also be installed. 1. Browse and select the location of the target folder for installation. 1. Browse and select the location of the folder for system logs. 1. Select **Next**. The system begins installing the selected components. 1. Select **Finish**. The Finish button is displayed after all the selected components have been installed. Note The File Access Manager Administrator Guide provides more information on the collector services. # Prerequisites Make sure your system fits the descriptions below before starting the installation. ## Software Requirements File Access Manager requires the latest ASP.NET Core 8.0.x Hosting Bundle. This bundle consists of .NET Runtime and ASP .NET Core Runtime. You can download the latest 8.0.x Hosting Bundle version from [here](https://dotnet.microsoft.com/en-us/download/dotnet/8.0). ## PreSoftware Requirements **EMC CAVA/CEE** - Version 4.9.3 and above. ## Configuring the CEE Service ### Connecting to a Remote CEE For enterprises with an existing central CEE infrastructure, where the Activity Monitor will be installed on a different server than the CEE service: 1. On every CEE server, open the registry and perform the following changes: `[HKLM\Software\EMC\CEE\CEPP\Audit\Configuration]` `Endpoint=whitebox@` `Enabled=1` Note If multiple monitor servers exist, the list should look like: whitebox@ip, whitebox@ip, ... 1. Restart the EMC CEE service. ### Connecting to a Local CEE (No Central Infrastructure) When installing the CEE service and the Activity Monitor service on the same server: 1. Install CEE Pack on the monitor server. The CEE service must be installed on a server in the same domain as the physical data mover CEE server, otherwise the communication between the data mover and the CEE service will fail. 1. Open the registry and perform the following changes: `[HKLM\Software\EMC\CEE\CEPP\Audit\Configuration]` `Endpoint=whitebox` `Enabled=1` 1. Set the logon user for the services to a user according to the Required Permissions section. 1. Restart EMC CEE service. ### Enabling CEPA on the Data Mover 1. The CEPA configuration is separate and must be done for each physical data mover. 1. If you have multiple virtual data movers with CIFS servers, the CEPA configuration must be on the physical data mover (usually server_2 data mover when there is a single physical data mover). 1. If the configuration file (cepp.conf) does not exist, create a new one. 1. Log in to the system with your administrative username (nasadmin) and password. 1. Use a text editor to create a new, blank file called cepp.conf file in the home folder with the following content: `ft level=[0/1] location= size=` `pool name=sepapool \` `servers=|| \` `preevents= \ postevents=OpenFileRead|CreateFile|FileWrite|FileRead|CreateDir|DeleteFile|DeleteDir|CloseModified|RenameFile|RenameDir|SetAclFile|SetAclDir|SetSecFile|SetSecDir\` `posterrevents= \` `option=ignore \` `reqtimeout=500 \` `retrytimeout=50` Note The ft level parameter sets the fault tolerance level assigned. Valid values are 0-3, where: 0 = continue and tolerate lost events (default) 1 = continue and use a persistence file as a circular event buffer for lost events 2 = continue and use a persistence file as a circular event buffer for lost events until the buffer is filled and then stop CIFS 3 = upon heartbeat loss of connectivity, stop CIFS It is recommended that this value be set to 1. If you kept the recommended value, fill in the `` and `` parameters, where: - **location** - Directory where the persistence buffer file resides relative to the root of a file system. If a location is not specified, the default location is the root of the file system. - **size** - Maximum size of the persistence buffer file, in MB. The default is 1 MB and the range is 1 MB to 100 MB. It is recommended to set it at 100MB It is important to verify that all CEE FQDN server names are resolved and reachable from the data mover. You can also fill in the IP address of the server instead of FQDN. 1. Copy the newly created file to the data mover: `server_file -put cepp.conf cepp.conf` If cepp.conf exists, verify that the postevents parameter has the required values. 1. For NFS run the following command: `server_mount -o ceppcifs,ceppnfs /` ### Synchronize with Domain Watch and Start the Service `server_date server_# -timesvc start ntp ` ### Start the CEPA Service on the Data Mover `server_cepp -service –start` ## Permissions File Access Manager requires different permissions, based on the tasks and data collected. The user configured in the Application configuration wizard must have the following permissions: ### CIFS Access - **Activity Monitoring** - Requires a domain user with administrative privileges on the local machine on which the CEE service is installed. - **Crawling** - Requires a user who is a member of the local Backup Operators group on the virtual CIFS server. Requires a user with Share Read access to all the shares on the virtual CIFS server. - **Permission Collection** - Requires a user with Shared Read access to all CIFS shares on the virtual CIFS server. Requires a user who is a member of the local Backup Operators group on the virtual CIFS server. Requires a user who is a member of the local Administrators group on the virtual CIFS server to be able to read share permissions and local users and groups. - **Data Classification** - Requires a user with Share Read access to all CIFS shares on the virtual CIFS server. Requires a user who is a member of the local Backup Operators group on the virtual CIFS server. ### NFS Access - **Activity Monitoring** - Requires a domain user with administrative privileges on the local machine on which the CEE service is installed. - **Crawling** - Requires a user with permission to mount all NFS exports on the virtual NFS server. Requires a user with (a) read permission for all files and (b) execute permission for all directories on the virtual NFS server. - **Permission Collection** - Requires a user with permission to mount all NFS exports on the virtual NFS server. Requires a user with (a) read permission for all files and (b) execute permission for all directories on the virtual NFS server. - **Data Classification** - Requires a user with permission to mount all NFS exports on the virtual NFS server. Requires a user with (a) read permission for all files and (b) execute permission for all directories on the virtual NFS server. ## Communications Requirements | **Requirement** | **Source** | **Destination** | **Port** | | ------------------------------------------------- | ------------------------------------------------------------------- | ------------------------------- | ------------------- | | File Access Manager Internal Access | Application | File Access Manager servers | 8000-8008 | | File Access Manager Message Broker | Permissions Collector / Data Classification Collector | RabbitMQ | 5671 | | EMC CEE | EMC Data Mover | CEE Service | RPC (135 + Dynamic) | | CEPA Events Push | CEE Service | File Access Manager Application | RPC (135 + Dynamic) | | CIFS - Permissions Analysis & Data Classification | Permissions Collection service and / or Data Classification service | CIFS file server | SMB | | NFS - Permissions Analysis & Data Classification | Permissions Collection service | NFS file server | NFSv3 | # Troubleshooting Check the issues below for common problems and suggested ways of handling them. ## Activities not Collected by the Activity Monitor If activities are not collected by the Activity Monitor, we need to track the status of the components, starting from the data mover to the Activity Monitor service. Log in to the data mover with your administrative user, and follow the suggestions below: - Verify the CEPA facility status on the data mover. Use the command: `server_cepp -service –status` `Output:` `server_2 : CEPP Started` - If the CEPA isn't listed as "Started": Start it with the following command: `server_cepp -service –start` - Display information about the CEPA service. Use the following command: `server_2 : CEPP Started` `server_cepp -pool -info` `Output:` `server_2 :` `pool_name = sepapool` `server_required = yes` `access_checks_ignored = 0` `req_timeout = 5000 ms` `retry_timeout = 25000 ms` `pre_events =` `post_events =`\ `OpenFileRead,CreateFile,FileWrite,FileRead,CreateDir,DeleteFile,DeleteDir,CloseModified,RenameFile,enameDir,SetAclFile,SetAclDir,SetSecFile,SetSecDir` `post_err_events =` `CEPP Servers:` `ip = [ip address of the CEE server], state = ONLINE, status = ONLINE` - Make sure the post events correspond to the definitions described in the prerequisites section. - If the state and status are not both ONLINE: - There might be a problem with the connection to the CEE service, or with the connection between the CEE service and the Activity Monitor service. - The CEPA facility is delicate to communication errors and in some cases the CEE does not recover from a communication failure. - Make sure all the prerequisites were set. - Make sure the CEE service is running with a domain user who is an administrator on the CEE service server. - Make sure the CEE service and the physical data mover CIFS server are joined to the same active directory domain. - Make sure the CEPA ip address listed in the output of the command above matches the IP address of the server running the CEE service. - Make sure there is no firewall between the data mover and the server running the CEE service. - Make sure the windows firewall is off on the server running the CEE service. - Try restarting the services. - Stop the CEPA facility with the following command: `Server_cepp -service -stop` - Stop the EMC CEE service on the CEE server and the Activity Monitor service.. - Start the CEPA facility. - Start the EMC CEE service, wait for 60 seconds. - Start the Activity Monitor service. - Wait for 60 seconds, and issue the command `server_cepp -pool –info` again. ## State and Status ONLINE, but no Events are Shown If the state and status are both ONLINE, but no events are shown, check the event counters, in the data mover, using the following command: `server_cepp -pool –stats` `Output:` `server_2 :` `pool_name = pool1` `Event Name Requests Min(us) Max(us) Average(us)` `OpenFileWrite 2 659 758 709` `CloseModified 2 604 635 620` `Total Requests = 4` `Min(us) = 604` `Max(us) = 758` `Average(us) = 664` Look at the count of the different events. Issue the command a few more times and verify that the counters increase. Those counters represent the total number of requests for all the CIFS server in all the virtual data movers. If the counters do not increase, it might be that no users are working on the CIFS server at the moment. ## Counters Increase but No Events are Collected If the counters increase, but no events are collected: 1. Check the statistics log file of the Activity Monitor to verify whether events are received by the Activity Monitor. 1. If no events are received by the Activity Monitor, validate the Application configuration: - Make sure the CIFS server name is properly configured in the Application filer name field. This value must be the actual name of the CIFS server name, and not the FQDN or one of the aliases. - If the CIFS server has aliases defined to it (validate that in the EMC management), make sure these aliases are defined under the aliases in the Application configuration. # Verifying the EMC Celerra Connector Installation ## Installed Services Verify that the services installed for the connector are available and active. Using windows Service manager, or other tool, look for the File Access Manager services, and verify that they are running. For example: - File Access Manager Central Activity Monitor - ``. - File Access Manager Permissions Collection - ``. - File Access Manager Data Classification - `` . ## Log Files Check the log files listed below for errors: - `“%SAILPOINT_HOME_LOGS%\ FilesMiniFilter_ .log"` - `“%SAILPOINT_HOME_LOGS%\PermissionCollection_.log"` - `“%SAILPOINT_HOME_LOGS%\DataClassification_.log"` - `“%SAILPOINT_HOME_LOGS%\EMCCelerra-.log"` ## Verifying Monitored Activities 1. Simulate activities on the CIFS/NFS server. 1. Wait approximately one minute. 1. Verify that the activities display in the File Access Manager website under **Forensics > Activities**. ## Permissions Collection 1. Run the Crawler and Permissions Collector tasks in the business website. 1. Verify that: - The tasks completed successfully. - Business resources were created on the BRs tree. - Permissions display in the Permission Forensics window. # Adding an EMC-Celerra Application In order to integrate with EMC-Celerra, we must first create an application entry in File Access Manager. This entry includes the identification, connection details, and other parameters necessary to create the link. To add an application, use the New Application Wizard. 1. Navigate to **Admin** > **Applications**. 1. Select **Add New** to open the New Application Wizard. 1. Select **Standard Application** for the wizard type. 1. Select **Next** to open the **General Details** page. ## General Details - **Application Type** - Select NetApp Type: - EMC Celerra – CIFS - EMC Celerra – NFS - **Application Name** - Logical name of the application. - **Description** - Description of the application. - **Tags** - Select tags for the application from the dropdown menu, and / or type a new name, and select **Enter** to create a new tag. The dropdown list of tags filters out matching tags as you type and displays up to 50 tags. Note The tags replace the Logical container field that was used when creating applications in releases before 8.2. - **Event Manager Server** - This option is available if there are more than one event manager servers configured in the system. - Select an event manager from the drop down menu. - **Identity Collector** - Select from the Identity Collector dropdown menu. - You can create identity collectors in the administrative client on the **Applications > Configuration > Permissions Management > Identity Collectors** page. Refer to the OOTB Identity Collection section in the Collector Installation Manager File Access Manager Administrator Guide for further details. - If adding a new identity collector, select the **Refresh** button to update the Identity Collector dropdown list. - **Identity Collectors** - EMC Celerra CIFS – Choose an active Directory identity collector - EMC Celerra NFS – Choose a Network Information Service (NIS) identity collector Select **Next** to open the **Connection Details** page. ## Connection Details ### CIFS Connection Details - **Host Name** - The real name used when connecting to the CIFS server - **Domain Name, Username, & Password** - Credentials for the user defined in the prerequisites - **Aliases** - Aliases defined in the EMC for the CIFS server - Type in an alias, and select the **+** icon to add it to the list. - Select the **delete** icon on any item to remove it from the list. ### NFS Connection Details - **Host Name** - The network address, typically the IP address, of the interface on which the NFS exports are exposed - **Username** - An NIS username, or root, to use when connecting to the NFS file server - **Group Name** - An NIS group name, or root, to use when connecting to the NFS file server - **Aliases (optional)** - Network aliases for the NFS server - Type in an alias, and select the **+** icon to add it to the list. - Select the **delete** icon on any item to remove it from the list. # Enabling Access Fulfillment for an Application Access fulfillment is enabled per application in the application setting screen for applications that support fulfillment. Refer to the compatibility table in Compass for the full list. **To enable Access Fulfillment for an application:** 1. Go to **Admin > Applications** to open the **Configuration** page of the required application. 1. Scroll through the list, or use the filter to find the application. 1. Select the **edit** icon on the line of the application. 1. Select **Next** until you reach the **Access Fulfillment** settings page. The setting pages and entry fields vary according to the application type. 1. For non-normalized resources, you can select **Enable Access Fulfillment for Revoking Explicit Permissions**. Refer to Access Fulfillment for Removal of Explicit Permissions. 1. Select **Enable Access Fulfillment for Normalized Groups**. - **Identity Collector** - Fulfillment requires an identity collector in order to run. If you did not select an identity collector in the **General Details** configuration page, you can select one from the drop down list now. If there is no identity collector defined for this application, or if you want to use a different identity collector than the ones in the dropdown list, you can create a new identity collector in the Administrative Client at **Applications > Configuration > Permissions Management > Identity Collectors**. Refer to Create/Edit an Active Directory Identity Collector for more details on creating an identity collector. - **Managed Group OU (DN)** - The organizational unit in which the managed permission groups will be created. Make sure that the chosen identity collector’s user has permissions to create groups under this location (e.g. OU=FileAccessManagerManaged, DC=SailPoint, DC=COM) - **OU** - Organizational Unit - **DN** - Distinguished Name. - **How to Handle ‘List Folder Contents’ Permissions** - Create and manage a dedicated permissions group for it. This is the default value. - Revoke these permissions - Not relevant for SharePoint - **How to Handle Inexact Permissions Matches** - During the normalization process, the application has to decide what to do with permissions that do not match the normalized permissions: - Fail the normalization process - Elevate to the nearest permission match - Revoke the permission 1. Open the **Advanced Settings** panel for additional settings: - **Group Cache Sync Interval(sec)** - This setting will add a pause to the process of setting normalize permissions on the resource. This will allow the endpoint's local AD groups cache to sync the newly created managed groups. - The default Is 0 - signifying the process will not pause by default. - **Use Template Permission Group** - Template groups are created per application and added as a template to every managed resource. These groups are not managed by File Access Manager, and are usually used to ensure that users who need application-wide access such as backup or archiving users have access. - Select for each permission group whether File Access Manager should create a group or whether to use an existing group, for the following groups: - List Folder Contents - Read & Execute - Modify - Full Control - If you select **Use an Existing Group**, select the required group to use from the dropdown list. - Once an application is enabled for access fulfillment, you can set specific resources to be normalized using the **Manage Normalized Resources** page. # Configuring Activity Monitoring **To configure the activity monitoring polling parameters:** 1. Go to **Admin > Applications** to open the **Edit** page of the required application. 1. Scroll through the list, or use the filter to find the application. 1. Select the **edit** icon on the line of the application. 1. Select **Next** until you reach the **Activity Configurations & Decs** settings page. **Polling Interval (sec)** - Activity fetching interval [in seconds]). Default is set to 60 seconds, **Report Interval (sec)** - Activity Monitor Health reporting interval [in seconds]). Default is set yo 60 seconds. **Local Buffer Size (MB)** - Local buffer size for activities [ in MB]). Default is set to 200MB. This cyclic buffer is used to store activities on the Application Monitor’s machine in case of network errors that prevent the activities from being sent. **Activity Data Retention Period** - When selecting the Clear Activity Data option, a user is able to provide a time frame (1 to 100) in either months or years for all activity to be retained. Once that time period is met, all data will be removed. Note By default, this feature is disabled. A user can also select to backup the data before it is deleted by selecting the Backup Events Before Clearing option. Note The Backup Before Clearing Option will only be enabled if the backup option is set during the system installation. If a user has not selected the backup option during the installation nor provided a backup path, this option will not be enabled. ## Configuring Data Enrichment Connectors The Data Enrichment Connectors (DEC) configuration enables us to select data enrichment sources. These can be used to add information from other sources about identities. An enrichment source could be a local HR database that is used to combine users' job descriptions or departments to the information stored in the identity store. 1. Select the data enrichment connectors to enrich monitored activities from the **Available DECs** text box. 1. Use the **>** or **>>** arrows to move the selected DECs to the **Current DECs** text box. The user can select multiple DECs. Simply select each desired DEC. 1. You can create a new DEC in the Administrative Client on the **Applications > Configuration > ActivityMonitoring > Data Enrichment Connectors** page. 1. After creating a new DEC, select **Refresh** to refresh the dropdown list. The Connectors chapter of the File Access Manager Administrator Guide provides more information on Data Enrichment Connectors, including what they are, how to configure them, and how they fit in the Activity Flow. ## Monitoring Exclusions **To add an exclusion:** 1. Select the dropdown list. 1. Type in an exclusion (file extension, user, folder, etc. as relevant.) 1. Select the **+** icon to add this item to the list. 1. After completing the list, select **Next** or **Cancel** to close the panel. **To edit or remove an exclusion from the list:** 1. Select the dropdown list. 1. On the extension to edit or remove, select the **delete** or **edit** icon. 1. Select **Next** or **Cancel** to close the panel. 1. Select **Clear Selection** to clear the entire list. **Excluded File Extensions** - List of file extensions that are not monitored, e.g., `txt`, `exe`. Enter one value at a time as described above. **Exclude Folders** - List of folders that are not monitored, e.g., `\\servername\share1\\folder1`. Enter one value at a time as described above. **Exclude Users** - List of users whose activities are not monitored, e.g., `user1`, `domain\user2`, `user3@domain.com`. Enter one value at a time as described above. Important The user format to be used depends on how the activity is logged by the endpoint. If you are not sure which of the user formats above to use, either specify all of them, or leave the list empty for now, go to the **Forensics > Activities** screen in the File Access Manager Website after some activities flow in to view how the user is depicted in them and use that depiction in the exclusion list. ### When an activity from a new resource is detected:(Modes of Storing Activities) - **Full Auto-Learning Mode** – Will audit everything (every action) on every resource. - **Semi Auto-Learning Mode** – Will monitor activities on resources nested under the top-level resources that are marked for Monitoring. This operation mode will also allow the user to select what type of activities are being monitored. ## Monitored Actions The user has the ability set monitored actions within Manage Resources. 1. Go to **Admin > Applications**. 1. Under the **Actions** column, select the **ellipsis** icon on the desired application. 1. Select **Manage Resources**. The Manage Resources will display with all resources listed. 1. Select **Manage Monitored Actions**. 1. Toggle **Enable Activity Monitoring for this Resource Hierarchy**. The user can now select the type of actions they want monitored. Note All actions are automatically selected initially. 1. Select **Next**. # Selecting and Scheduling the Data Classification Settings **To associate an application with a data classification service, and set the schedule:** 1. Go to **Admin > Applications** to open the **Edit** page of the required application. 1. Scroll through the list, or use the filter to find the application. 1. Select the **edit** icon on the line of the application. 1. Select **Next** until you reach the **Data Classification** settings page. The actual entry fields vary according to the application type. **Central Data Classification Service** - Associate the application with a Central Data Classification Service. This service is responsible for running the Data Classification tasks. If the Central Data Classification wasn’t installed during the installation of the server, this field is disabled. **Disabling Data Classification** - To disable data classification, delete the entry from the central data classification field. Disabling data classification can also be achieved by setting the scheduler to be inactive (which is the default setting for data classification). **Create a Schedule** - This option is enabled only if a central data classification service is selected. Refer to [Scheduling a Task](https://documentation.sailpoint.com/fam-connectors/help/nas/emc_celerra/add/perm_coll.html#scheduling-a-task). Note Refer to the Data Classification chapter in the File Access Manager Administrator Guide for more information Select **Next** or **Finish**. ## Data Privacy A user can associate the application with a Central Data Classification Engine Service. This engine will be responsible for executed Data Privacy tasks. Though using different processes for each, the Data Classification engine service is in charge for both Data Privacy and Data Classification discovery tasks. You may choose the same service for both, or use a different one for each, to run them in parallel. Note The fields on the Data Privacy step are the same as the Data Classification step. # Configuring and Scheduling the Permissions Collection Permissions can be analyzed to determine the application permissions of an out-of-the-box application, provided you have defined an identity store for File Access Manager to use in its analysis, and you have run a crawl for the application. The permission collector is a software component responsible for analyzing the permissions in an application. The Central Permission Collector Service is responsible for running the Permission Collector and Crawler tasks. If the “File Access Manager Central Permission Collector” wasn’t installed during the installation of the server, this configuration setting will be disabled. **To configure the Permission Collection:** 1. Go to **Admin > Applications** to open the **Edit** page of the required application. 1. Scroll through the list, or use the filter to find the application. 1. Select the **edit** icon on the line of the application. 1. Select **Next** until you reach the **Crawler & Permissions Collection** settings page. The actual entry fields vary according to the application type. When entering this page in edit mode, you can navigate between the various configuration windows using the **Next** and **Back** buttons. - **Central Permissions Collection Service** - Select a central permission collection service from the dropdown list. You can create permissions collection services as part of the service installation process. Refer to the Services Configuration section in the File Access Manager Administrator Guide for further details. - **Calculate Effective Permissions** - Calculate effective permissions during the permissions collection run. Valid for EMC Celerra-CIFS only. - **Calculate Riskiest Permissions** - Calculates the riskiest permission on a resource – for example, Full Control is riskier than Read permissions if both are on a resource. This option is available when selecting **Calculate Effective Permissions**. Valid for EMC Celerra-CIFS only. - **Skip Identities Sync during Permission Collection** - Skip identity synchronization before running permission collection tasks when the identity collector is common to different connector. Note This option is checked by default. - **Permissions Source** - This option is available when selecting Calculate Effective Permissions. Valid for EMC Celerra-CIFS only. - NTFS, Share, Both. ## Permission Collection Setup Notes for EMC Celerra Note Calculate Effective Permissions is for EMC Celerra CIFS only. You can now [schedule a task](#scheduling-a-task). ## Scheduling a Task To create a schedule: 1. Select **Create a Schedule**. 1. The system will provide a Schedule Name in the format `{appName} - {type} Scheduler`. Choose to keep or override this suggestion. 1. Select a scheduling frequency from the dropdown list. Schedule Frequency Options - Run After - Create dependency of tasks. The task starts running only upon successful completion of the first task. - Hourly - Set the start time. - Daily - Set the start date and time. - Weekly - Set the day(s) of the week on which to run. - Monthly - Set the day of the month on which to run a task. - Quarterly - Set a monthly schedule with an interval of 3 months. - Half Yearly - Set a monthly schedule with an interval of 6 months. - Yearly - Set a monthly schedule with an interval of 12 months. 1. Fill the Date and Time field with scheduling times. These fields differ depending upon the scheduling frequency selected. 1. Select the **Active** checkbox to activate the schedule. 1. Select **Next**. ### Configuring and Scheduling the Crawler **To set or edit the Crawler configuration and scheduling:** 1. Go to **Admin > Applications** to open the **Edit** page of the required application. 1. Scroll through the list, or use the filter to find the application. 1. Select the **edit** icon on the line of the application. 1. Select **Next** until you reach the **Crawler & Permissions Collection** settings page. The actual entry fields vary according to the application type. **Calculate Resource Size** - Determine when, or at what frequency, File Access Manager calculates the resources' size. Select one of the following: - Never - Always - Second crawl and on (This is the default) **Create a Schedule** - Select to open the schedule panel. Refer to [Scheduling a Task](#scheduling-a-task). ### Setting the Crawl Scope There are several options to set the crawl scope: - Setting explicit list of resources to include and / or exclude from the scan. - Creating a regex to define resources to exclude. ### Including and Excluding Paths by List **To set the paths to include or exclude in the crawl process for an application:** 1. Go to **Admin > Applications** to open the **Edit** page of the required application. 1. Scroll through the list, or use the filter to find the application. 1. Select the **edit** icon on the line of the application. 1. Select **Next** until you reach the **Crawler & Permissions Collection** settings page. The actual entry fields vary according to the application type. 1. Scroll down to the Crawl configuration settings. 1. Select **Advanced Crawl Scope Configuration** to open the scope configuration panel. 1. Select **Include / Exclude Resources** to open the input fields. 1. To add a resource to a list, type in the full path to include / exclude in the top field and select the **+** icon to add it to the list. 1. To remove a resource from a list, find the resource from the list, and then select the **x** icon on the resource row. Note When creating exclusion lists, excludes take precedence over includes. ### Excluding Paths by Regex **To set filters of paths to exclude in the crawl process for an application using regex:** 1. Go to **Admin > Applications** to open the **Edit** page of the required application. 1. Scroll through the list, or use the filter to find the application. 1. Select the **edit** icon on the line of the application. 1. Select **Next** until you reach the **Crawler & Permissions Collection** settings page. The actual entry fields vary according to the application type. 1. Select **Exclude Paths by Regex** to open the configuration panel. 1. Type in the paths to exclude by Regex. Refer to the regex examples in the section below. Since the system does not collect BRs that match this Regex, it also does not analyze them for permissions. ### Crawler Regex Exclusion Example The following are examples of crawler Regex exclusions: #### Exclude all shares which start with one or more shares names | **Example** | **Regex** | | -------------------------------------------------------------------------- | ----------------------------- | | Starting with `\\server_name\shareName` | `\\\\server_name\\shareName$` | | SStarting with `\\server_name\shareName` or `\\server_name\OtherShareName` | \`\\\\server_name\\(shareName | #### Include ONLY shares which start with one or more shares names | **Example** | **Regex** | | ------------------------------------------------------------------------- | ---------------------------------- | | Starting with `\\server_name\shareName` | \`^(?!\\\\server_name\\shareName($ | | Starting with `\\server_name\shareName` or `\\server_name\OtherShareName` | \`^(?!\\\\server_name\\(shareName | #### Narrow down the selection | **Example** | **Regex** | | --------------------------------------------------------------- | ---------------------------------- | | Include ONLY the C$ drive shares: `\\server_name\C$` | \`^(?!\\\\server_name\\C$($ | | Include ONLY one folder under a share: `\\server\share\folderA` | \`^(?!\\\\server_name\\share$($ | | Include ONLY all administrative shares | \`^(?!\\\\server_name\\[a-zA-Z]$($ | Note - To write a backslash or a Dollar sign, add a backslash before it as an escape character. - To add a condition in a single command, use a pipe character “|” . ### Excluding Top Level Resources Use the top level exclusion screen to select top level roots to exclude from the crawl. This setting is done per application. **To exclude top level resources from the crawl process:** 1. Go to **Admin > Applications** to open the **Application** page. 1. Find the application to configure and select the drop down menu on the application line. 1. Select **Exclude Top Level Resources** to open the configuration panel. 1. Select **Run Task**. The Run Task button triggers a task that runs a short detection scan to detect the current top level resources. Before running the task for the first time, the following message displays above this button: **Note: Run task to detect the top-level resources**. If the top level resource list has changed in the application while you are on this screen, select this button to retrieve the updated structure. Once triggered, you can view the task status on the **Settings > Task Management > Tasks** page. Note This will only work if the user has access to the task page. 1. When the task has completed, select **Refresh** to update the page with the list of top level resources. 1. Select the top level resource list, and select top level resources to exclude. 1. Select **Save** to save the change. 1. To refresh the list of top level resources, run the task again. Running the task will not clear the list of top level resources to exclude. ### Special Consideration for Long File Paths in Crawl If you need to support long file paths above 4,000 characters for the crawl, set the `excludeVeryLongResourcePaths` flag in the Permission Collection Engine App.config file to `true`. By default this value will be commented out and set to `false`. This key ensures, when enabled, that paths longer than 4000 characters are excluded from the applications’ resource discovery (Crawl), to avoid issues while storing them in the SQLServer database. When enabled, business resources with full paths longer than 4000 characters, and everything included in the hierarchical structure below them, will be excluded from the crawl, and will not be collected by File Access Manager. This scenario is extremely rare. Note You should not enable exclusion of long paths, unless you experience an issue. - **Background** - File Access Manager uses a hashing mechanism to create a unique identifier for each business resource stored in the File Access Manager database. The hashing mechanism in SQLServer versions 2014 and earlier, is unable to process (hash) values with 4,000 or more characters. Though resources with paths of 4000 characters or longer are extremely rare, File Access Manager is designed to handle that limitation. - **Identifying the Problem** - When using an SQL Server database version 2014 and earlier, the following error message in the Permission Collection Engine log file: `System.Data.SqlClient.SqlException (0x80131904): String or binary data would be truncated.` In all other cases, this feature should not be enabled. - **Setting the Long Resource Path Key** - The Permission Collection Engine App.config file is `RoleAnalyticsServiceHost.exe.config`, and can be found in the following folder: %SailPoint_Home%\\FileAccessManager[Permission Collection instance]\\ Search for the key `excludeVeryLongResourcePaths` and correct it as described above. # EMC-Isilon Connector Overview ## Capabilities File Access Manager can connect to EMC Isilon for: - Storage structure analysis. - Checking user permissions. - Data classification. - Performing access fulfillment. Important This connector does not support Isilon NFS. File Access Manager provides full support for multiple-access zones, and full tenant isolation, across all its Isilon connector components. ## Configuring Clusters with Multiple Access Zones There are several methods of configuring File Access Manager to support Isilon clusters containing multiple access zones: - **Separate application per access zone** - This is the recommended configuration. Set up each access zone as a new application in File Access Manager, adding the access zone in the Connection Details page. - **Single application for the entire cluster** - Configure one application for the Isilon cluster, regardless of access zones. - Leave the **Access Zone** field in the application configuration empty. The File Access Manager configuration should mimic the way your organization uses the Isilon cluster and access zones. If you treat the access zones as different file servers - they should be configured as different applications in File Access Manager as well. ## Connector Overview For more information and a deep technical understanding of the EMC architecture and CEE, refer to [EMC CEE version 7.0 using the Common Event Enabler for Windows](https://www.emc.com/collateral/TechnicalDocument/docu48055.pdf). ### CEE - The CEE service is the EMC gateway for auditing. The Isilon OneFS communicates with the CEE service to receive event notifications. ### CEE & Activity Monitor - Every Activity Monitor can communicate with one or more CEE servers. - Every CEE service can be configured to work with a multiple Activity Monitor services. ### Activity Monitor - File Access Manager Connector for EMC Isilon uses EMC CEPA over the Common Event Enabler Framework (CEE, formerly known as CAVA) infrastructure to retrieve audit events from Isilon to access both CIFS files. - Similarly, The connector uses the same CEE/CEPA architecture as the File Access Manager Connector for EMC Celera/VNX. - The Activity Monitor for EMC Isilon can be installed on the same server as other EMC Celera/VNX CIFS/NFS Activity Monitors, and communicate with the same CEE service. - The first Activity Monitor which is installed on a physical server creates the Activity Monitor service. - Unlike other File Access Manager Activity Monitors, all subsequent Activity Monitors will not create additional Activity Monitor services. - Every Activity Monitor that is installed adds a bamconfig.xml file under the Activity Monitor to add itself to the same service. Important The first Activity Monitor installed must be the LAST Activity Monitor uninstalled. If you uninstall the first Activity Monitor before uninstalling the other Activity Monitors, those Activity Monitors will not work, and it will not be possible to uninstall them. Important This connector does not support Isilon NFS. Important All activity monitors for access zones of the same cluster must be installed on the same File Access Manager server. Refer to [Installing Activity Monitors for Access Zones of the Same Cluster](#installing-activity-monitors-for-access-zones-of-the-same-cluster) for more details. ## Permissions Collection Operation Principle - File Access Manager connects to the EMC Isilon OneFS shares and analyzes folders permissions. - File Access Manager utilizes the Isilon OneFS Platform API to gather local users, groups and share permissions. ## Monitored Activities The following activities are monitored by the EMC-Isilon connector: - **Create File** - A new file was created. - **Create Folder** - A new folder was created. - **Create from Move** - A Create Folder event generates this event on the newly created folder. - **Create from Rename** - A Rename Folder event generates this event on the newly created folder. - **Delete File** - A file was deleted. - **Delete Folder** - A folder was deleted. - **Move File** - A file was moved. - **Move Folder** - A folder was moved. - **Permission Change File** - A file’s permissions were changed. - **Permission Change Folder** - A folder’s permissions were changed. - **Read File** - A file was read. - **Rename File** - A file was renamed. - **Rename Folder** - A folder was renamed. - **Write File** - A file was modified. ## Sample Architecture In the schema below, the first physical Data Mover is configured to send events to CEE 1 & 2. CEE 1 & 2 are configured to send event notifications to the Activity Monitor. The second physical Data Mover is configured to send events to CEE 2 & 3. CEE 2 & 3 are configured to send event notifications to the Activity Monitor. - CIFS Server 1 - CIFS Server 2 - NFS Export 1 The Activity Monitor monitors using CEE 2 & 3: - CIFS Server 4 - CIFS Server 5 - NFS Export 2 ## Multiple Access-Zone and Tenant Isolation Support File Access Manager offers tenant isolation and full capabilities for multiple access-zones on Isilon Clusters. With the addition of the activity monitoring and permissions collection capabilities for multiple access-zones within an Isilon cluster and removing the dependency on the administrative (system)-zone-based OneFS API, each access zone within the cluster functions as an independent Isilon application within File Access Manager, with the complete set of File Access Manager capabilities. This mode of access requires knowledge, connectivity and access rights of and to the managed access zone. This allows for a complete delegation of the configuration, administration and monitoring of an Isilon access zone to the tenant owner, and does not require centralized management. Tenant Isolation and management is critically valuable in multi-tenant hosted environments, where such isolation enhances data privacy and autonomous management. The access zone and management API (optional) settings can be configured through the application configuration wizards. With full tenant isolation, and full capability support for multiple access zones on the Isilon cluster, each access zone is treated as a separate entity. ### Installing Activity Monitors for Access Zones of the Same Cluster Due to limitations of the CEPA architecture, all activity monitor services, monitoring access zones of the same cluster, must be installed on the same File Access Manager Server. The File Access Manager Isilon Activity Monitor is a multi-instance service, i.e. a single service serves multiple instances of the activity monitor, e.g., for the different access zones. As a result, only a single service will be created (and appear in the Windows Services list), however, this single service will create activity monitors instances for all the Isilon access zones it is configured to monitor. There is no limitation to the number of clusters that can be monitor by a single File Access Manager service. Although all monitors for access zones of the same cluster must reside on the same File Access Manager server, activity monitors for other clusters and their access zones can also be installed on the same File Access Manager server, provided that sufficient resources are allocated for that machine. We recommend that instances be added gradually, and resources be allocated appropriately to accommodate for the increase in activity volume, as the scope of the monitored environment grows, and more activity monitors are added to the server. ## EMC-Isilon Installation Flow Overview **To install the EMC-Isilon connector:** 1. Configure all the prerequisites. 1. dd a new EMC-Isilon application in the Business Website. 1. Install the relevant services: - Activity Monitor - This is the activity collection engine, used by all connectors that support activity monitoring. - Permissions Collector If you are using EC2 login, the collector should be installed on the EC2 instance. - Data Classification Collector Important Installing the permissions collector and data classification services is optional and should only be installed by someone with a full understanding of File Access Manager deployment architecture. The File Access Manager Administrator Guide has additional information on the architecture. # Collecting Data Stored in an External Application ## Terminology - **Connector** - The collection of features, components and capabilities that comprise File Access Manager support for an endpoint. - **Collector** - The Agent component or service in a Data Classification and or Permission Collection architecture. - **Engine** - The core service counterpart of this architecture. - **Identity Collector** - A logical component used to fetch identities from an identity store and holds the configuration, settings for that identity store, and the relations between these identities. The identity collector has no “physical” manifest. The actual work is done by the Collector Synchronizer. The list below describes the high level installation process required to collect and analyze data from an external application. Most of these should already be set up in your File Access Manager installation. Refer to the server Installation guide for further details. - **Install a Data Classification central engine** - One or more central engines, installed using the server installer - **Install a Permission Collection central engine** - One or more central engines, installed using the server installer - **Create an Application in File Access Manager** - From the Business Website. The application is linked to central engines listed above. - **Add an Activity Monitor** - To collect activities for this application - run the Collector Installation Manager and add an application under Activity Monitoring. ## Adding Collectors - **Install Permission Collectors and / or Data Classification Collector (optional)** - Optionally, you can install collectors that will run on a separate server and take some of the work from the central PC and DC engines (Where supported). When installing a collector, you attach it to an engine. If no collectors are installed, the central services act as both the engine and the collector. To install a collector, you must have the **RabbitMQ** service installed for communication between the central engines and the collectors. RabbitMQ is installed Note Some cloud connectors ignore collectors connected to the central engine. (Box, Dropbox, OneDrive, SharePointOnline, Exchange Online, GoogleDrive) . In these applications the task will be done entirely by the engine, and not relegated to its collectors. Note For further details, Refer to the **Application > Central Service > Collector Relations** section in the File Access Manager Administrator Guide. # Installing Activity Monitor and Collectors Services The Collector Installation Manager is part of the File Access Manager installation package. This tool is used to install the activity monitor, permission collector, and data classification collector. 1. Run the **Collector Installation Manager** as an Administrator. The installation files are in the installation package under the folder Collectors. The Collector Installation Manager window displays. 1. Enter the credentials to connect to File Access Manager. - ServerName/IP should be pointed to the Agent Configuration Manager service server. - A File Access Manager user with Collector Manager permission (permission to install collectors). For Active Directory authentication, use the format domain\\username. 1. Select **Next**. The Service Configuration window displays. 1. If you are installing the Activity Monitor, select the application, and select **Add**. 1. When installing a SharePoint Activity Monitor, you will be prompted for service account credentials. This service account will be used by the Activity Monitor service to run the service and authenticate against the SharePoint IIS servers to fetch the logs (“Log on as”). Make sure the service account provided has local administrator privileges on the local server (hosting the Activity Monitor service) and can access the activity logs on the IIS servers. 1. If you are installing the Permission Collector, select the Central Permission Collector to which to connect this service, and select **Add**. 1. If you are installing the Data Classification, select the Central Classification Collector to which to connect this service, and select **Add**. 1. Select **Next**. The Installation Folder window displays. Note If this is the first time you are installing collectors on this machine, you will be prompted to select an installation folder, in which all future collectors will also be installed. 1. Browse and select the location of the target folder for installation. 1. Browse and select the location of the folder for system logs. 1. Select **Next**. The system begins installing the selected components. 1. Select **Finish**. The Finish button is displayed after all the selected components have been installed. Note The File Access Manager Administrator Guide provides more information on the collector services. # Prerequisites Make sure your system fits the descriptions below before starting the installation. ## Software Requirements File Access Manager requires the latest ASP.NET Core 8.0.x Hosting Bundle. This bundle consists of .NET Runtime and ASP .NET Core Runtime. You can download the latest 8.0.x Hosting Bundle version from [here](https://dotnet.microsoft.com/en-us/download/dotnet/8.0). ## PreSoftwareRequirements ### EMC Isilon OneFS 7.1 and above. ### EMC Common Event Enabler CEE 6.5 and above. ## Configuring the CEE Service ### Connecting to a Remote CEE For enterprises with an existing central CEE infrastructure, where the Activity Monitor will be installed on a different server than the CEE service: 1. On every CEE server, open the registry and perform the following changes: `[HKLM\Software\EMC\CEE\CEPP\Audit\Configuration]` `Endpoint=whitebox@` `Enabled=1` Note If multiple monitor servers exist, the list should look like: whitebox@ip, whitebox@ip, ... 1. Restart the EMC CEE service. ### Connecting to a Local CEE (No Central Infrastructure) When installing the CEE service and the Activity Monitor service on the same server: 1. Install CEE Pack on the monitor server. The CEE service must be installed on a server in the same domain as the physical data mover CEE server, otherwise the communication between the data mover and the CEE service will fail. 1. Open the registry and perform the following changes: `[HKLM\Software\EMC\CEE\CEPP\Audit\Configuration]` `Endpoint=whitebox` `Enabled=1` 1. Set the logon user for the services to a user according to the **Required Permissions** section. 1. Restart EMC CEE service. ## Enabling CEE Using Isilon OneFS WebUI 1. Select **Cluster Management**, then **Auditing**. 1. Select **Enable Protocol Access Auditing**. 1. Add Access Zone(s) you want to audit. **Event Forwarding** - Enter the uniform resource identifier (URI) where the CEE service is installed. The format of the entry is: `http://fully.qualified.domain.name:port/cee` **Port** - The default is 12228. **Storage Cluster Name** - Enter the same Host Name as in the File Access Manager Application configuration wizard. ## Enabling and Configure Auditing Using CLI | **Action** | **Command** | | ------------------------ | ------------------------------------------------------------------ | | Enable auditing | `isi audit settings global modify --protocol-auditing-enabled on` | | Disable auditing | `isi audit settings global modify --protocol-auditing-enabled off` | | Add access zone to audit | `isi audit settings modify --audited-zones ` | | View audit settings | `isi audit settings global view` | ## Auditing Event Configuration Using CLI | **Action** | **Command** | | ---------------------------- | ----------------------------------------------------------------------------------------------------------- | | Enable specific audit events | `isi audit settings modify --audit-success create, rename, delete, read, write, get_security, set_security` | | Enable all audit events | `isi audit settings modify --audit-success all` | To monitor all the activities listed under the Monitored Activates section, enable all audit events. ## Required Permissions File Access Manager requires different permissions, based on the tasks that require those permissions. The user configured in the Application configuration wizard must have the following permissions on the Access Zone: - Share Read permissions to all shares - Full Control permission for each normalized folder - Member of the local Backup Operators group - Member of the local Administrator group - Permissions to access the OneFS Platform API ### Adding Permissions Add required permissions by creating a new role and associating the user with that role in one of the following ways: #### Add Permissions via the Cluster Management Web Interface 1. Log in to the OneFS Cluster Management Web interface and performing the following actions: 1. Select **Access > Membership and Roles**. 1. Select the **Roles** tab. 1. Select the **Create Role** button. 1. Enter a name for the Role (ex. FileAccessManager). 1. Select the **Add a member to this role** button, and add the File Access Manager user which will be used in the Application configuration wizard. 1. Scroll down and select the **Add a privilege to this role** button and add the following Privileges: - ‘Platform API: Log in to the Platform API and WebUI’ – read_only Access - Auth: Configure Identities and authentication sources – read_only Access - Audit: Configure audit capabilities – read_only Access - SMB: configure SMB server – read_only Access **Add Permissions via the Cluster Management Shell** - Run the following commands from the cluster management shell: `isi auth roles create FileAccessManager` `isi auth roles modify FileAccessManager --add-priv-ro=ISI_PRIV_LOGIN_PAPI` `isi auth roles modify FileAccessManager --add-priv-ro=ISI_PRIV_SMB` `isi auth roles modify FileAccessManager --add-priv-ro=ISI_PRIV_AUTH` `isi auth roles modify FileAccessManager --add-priv-ro=ISI_PRIV_AUDIT` `isi auth roles modify FileAccessManager --add-user=’\’` **Add Permissions via built-in roles** - Associate the user with the SystemAdmin and SecurityAdmin built-in roles. `isi auth roles modify SystemAdmin --add-user=’\’` `isi auth roles modify SecurityAdmin --add-user=’\’` #### Add Permissions via the Cluster Management Shell Run the following commands from the cluster management shell: `isi auth roles create FileAccessManager`isi auth roles modify FileAccessManager --add-priv-ro=ISI_PRIV_LOGIN_PAPIisi auth roles modify FileAccessManager --add-priv-ro=ISI_PRIV_SMBisi auth roles modify FileAccessManager --add-priv-ro=ISI_PRIV_AUTHisi auth roles modify FileAccessManager --add-priv-ro=ISI_PRIV_AUDITisi auth roles modify FileAccessManager --add-user=’\\’\` #### Add Permissions via built-in roles Associate the user with the SystemAdmin and SecurityAdmin built-in roles. `isi auth roles modify SystemAdmin --add-user=’\’` `isi auth roles modify SecurityAdmin --add-user=’\’` ### Permissions Required for Each File Access Manager Task The user must have the permissions listed below in order to perform these tasks: - **Crawling** - Share Read permissions to all the shares on the file server. Be a member of the local Backup Operators group on the Access Zone. - **Permission Collection** - Share Read permissions to all the shares on the Access Zone. Be member of the local Backup Operators group on the Access Zone. Be a member of the local Administrators group to read the Share Permissions. Permissions to the OneFS Platform API to read the local Users and Groups. - **Access Fulfillment** - Full Control permission on the normalized folders to be able to set the permissions. - **Data Classification** - Share Read permissions for all the shares on the Access Zone. Be member of the local Backup Operators group on the Access Zone. ## Communications Requirements | **Requirement** | **Source** | **Destination** | **Port** | | -------------------------------------------- | ------------------------------------------------------------------------ | ------------------------------------ | -------------------------------------------------------- | | File Access Manager Internal Access | Application | File Access Manager servers | 8000-8008 | | File Access Manager Message Broker | Permissions Collector / Data Classification Collector / Activity Monitor | RabbitMQ | 5671 | | EMC CEE | EMC Isilon cluster | CEE Service | HTTP in the port defined under the prerequisites section | | OneFS Plaform API | Activity Monitor and Permissions Collector | EMC Isilon | HTTP+HTTPS * 8080 | | CEE Events Push | CEE Service | File Access Manager Activity Monitor | RPC (135 + Dynamic) | | Permissions Collection & Data Classification | Permissions Collection service and / or Data Classification service | EMC Isilon | SMB | Important For OneFS API state, the default port is 8080. The port is set by the administrator, and can be changed. Usually it will be 80, 8080 or 443. If this setting doesn’t work, consult your Isilon administrator. # Troubleshooting Check the issues below for common problems and suggested ways of handling them. ## What if activities are not collected by the Activity Monitor 1. If activities are not collected by the Activity Monitor, the status of the components should be tracked, from the Isilon OneFS to the Activity Monitor service. 1. Log in to the OneFS as an administrative user. 1. Type the following command to display the audit events stored on the Isilon: `isi_audit_viewer -t protocol` Isilon is properly configured for auditing if the command results in a display of events. Check all the CEE and Activity Monitor configurations described above. 1. Run the following command: `isi audit settings view` 1. Verify that the CEE URL is correct, and that the host name configured matches the host name configured in the Application configuration. 1. Verify that the CEE server is accessible in the configured port from the Isilon by pinging it, and running telnet to the configured port. 1. Run the following command: `isi zone zones view [Zone Name]` 1. Make sure the Zone is configured for all event types to be monitored. ### Advanced troubleshooting 1. The file `/var/log/isi_audit_cee.log` on the Isilon contains the internal audit_cee process log. Use the `cat` command to view its contents. 1. If no content is displayed, raise the debugging level of the process by running the following command: `isi_ilog --level debug+ --application isi_audit_cee` 1. To make the process change log levels, make a change to the audit configuration in order to view the log line. The following lines indicate a problem with the CEE connection: - `2014-02-20 12:49:17 vwjaws2-1 isi_audit_cee[65098][0x800d020b0]: DEBUG: deliver_event: No CEE servers available.` - `2014-02-20 12:49:17 vwjaws2-1 isi_audit_cee[65098][0x800d05da0]: DEBUG: heartbeater: available servers: []` 1. When finished, lower the log level to info. 1. If none of the above helps, we can use a tool called **DebugView** (Part of Windows Sysinternals) to help us view debug messages from the CEE: - Download [DebugView](https://technet.microsoft.com/en-us/sysinternals/debugview.aspx). - Extract to an accessible folder on the CEE server. - Run `Dbgview.exe`. # Verifying the EMC Isilon Connector Installation ## Verifying Application Configuration After the configuration of one of the following applications is complete, verify it was properly configured by running the Test Connection task. The Test Connection will run and validate a series of validations to see if the application was configured correctly. ### Common Isilon Validations The following is a list of common validations that run when the test connection is run with a Isilon application. - Server responsiveness - Verifying the ability to list shares - Verifying the ability to read share permissions - Verifying the membership to the Backup Operators group - Verifying access to the OneFS API - Verifying the audit setting are correct on the Isilon server - Verifying the Activity Monitoring event listener is running ## Installed Services Verify that the services installed for the connector are available and active. Using windows Service manager, or other tool, look for the File Access Manager services, and see that they are running. For example: - File Access Manager Central Activity Monitor - ``. - File Access Manager Permissions Collection - ``. - File Access Manager Data Classification - `` . ## Log Files Check the log files listed below for errors: - `“%SAILPOINT_HOME_LOGS%\ FilesMiniFilter_ .log"` - `“%SAILPOINT_HOME_LOGS%\PermissionCollection_.log"` - `“%SAILPOINT_HOME_LOGS%\DataClassification_.log"` - `“%SAILPOINT_HOME_LOGS%\EMCCelerra-.log"` ## Verifying Monitored Activities 1. Simulate activities on the storage system. 1. Wait approximately one minute. 1. Verify that the activities display in the File Access Manager website under **Forensics > Activities**. ## Permissions Collection 1. Run the Crawler and Permissions Collector tasks on the **Settings > Task Management > Scheduled Tasks** page. 1. Verify that: - The tasks completed successfully - Business resources were created in the resource explorer on the **Admin > Applications > [application column] > Manage Resources** page. - Permissions display in the Permission Forensics page at **Forensics > Permissions**. # Adding an EMC-Isilon Application In order to integrate with EMC-Isilon, we must first create an application entry in File Access Manager. This entry includes the identification, connection details, and other parameters necessary to create the link. To add an application, use the New Application Wizard. 1. Navigate to **Admin** > **Applications**. 1. Select **Add New** to open the New Application Wizard. 1. Select **Standard Application** for the wizard type. 1. Select **Next** to open the **General Details** page. ## General Details - **Application Type** - EMC-Isilon - **Application Name** - Logical name of the application. - **Description** - Description of the application. - **Tags** - Select tags for the application from the dropdown menu, and / or type a new name, and select **Enter** to create a new tag. The dropdown list of tags filters out matching tags as you type and displays up to 50 tags. Note The tags replace the Logical container field that was used when creating applications in releases before 8.2. - **Event Manager Server** - This option is available if there are more than one event manager servers configured in the system. Select an event manager from the drop down menu. - **Identity Collector** - Select from the Identity Collector dropdown menu. - You can create identity collectors in the administrative client on the **Applications > Configuration > Permissions Management > Identity Collectors** page. Refer to section OOTB Identity Collection in the Collector Installation Manager File Access Manager Administrator Guide for further details. - If adding a new identity collector, select the **Refresh** button to update the Identity Collector dropdown list. Select **Next** to open the **Connection Details** page. ## Connection Details - **Host Name** - The real name used when connecting to the CIFS server. This will be used by the SMB (CIFS) protocol. - **Domain Name, Username, Password** - Credentials for the user defined in the prerequisites. - **Storage Cluster Name** - The name configured in the Auditing section of the Isilon OneFS Admin Console under the **Cluster Management > Auditing** settings tab. If this is not configured, the name of the Isilon cluster itself, under **Cluster Management > General Settings**. - **Access Zone** - (Optional) Use this field if configuring a separate application per access zone. Refer to [Configuring Clusters with Multiple Access Zones](https://documentation.sailpoint.com/fam-connectors/help/nas/emc_isilon/index.html#configuring-clusters-with-multiple-access-zones) for further details. The name of the access zone as it is configured in the Isilon cluster configuration, in the Access section of the Isilon OneFS Admin Console, under **Access > Access Zones**. - **Use OneFS API** - Select this checkbox to enables / disable access to the OneFS API, and reversely, disable / enable tenant Isolation. OneFS API is located only on the System zone and is used by the permission collection and activity monitor components of the Isilon connector to fetch Share Information as well as local users and roles for each individual access zone. Unchecking this will disable the activity monitor access to the API and the information will be collected solely using the SMB protocol, and access only the managed Access Zone. Access to the Management API is no longer required for activity monitoring, and is skipped by default, using native SMB Access to the managed Access Zone instead. However, you can choose to keep the old configuration and keep access the Management API on the System zone, to retrieve Share and Local Identities information. - **Management IP** - This field specifies the location of the Management API (System access zone). This field accepts IP addresses and / or any resolvable DNS name (FQDN or otherwise). Valid only If access to the OneFS API is enabled, by checking the Use OneFS API checkbox above. - **Aliases** - SmartConnect Zone Aliases used as alternative DNS Names for the CIFS Server. All aliases must be provided to ensure that all activities performed on that server, through all access paths, are monitored by File Access Manager. These are available under the IP Pool Settings, in the Network Configuration section of the Isilon OneFS Admin Console, under the Cluster Management >> Network Configuration tab. 1. Type in an alias, and select the **+** icon to add it to the list. 1. Select the **delete** icon on any item to remove it from the list. # Enabling Access Fulfillment for an Application Access fulfillment is enabled per application in the application setting screen, for applications that support fulfillment Refer to the compatibility table in Compass for the full list. **To enable Access Fulfillment for an application:** 1. Go to **Admin > Applications** to open the **Configuration** page of the required application. 1. Scroll through the list, or use the filter to find the application. 1. Select the **edit** icon on the line of the application. 1. Select **Next** until you reach the **Access Fulfillment** settings page. The setting pages and entry fields vary according to the application type. 1. For non-normalized resources, you can select **Enable Access Fulfillment for Revoking Explicit Permissions**. Refer to Access Fulfillment for Removal of Explicit Permissions. 1. Select **Enable Access Fulfillment for Normalized Groups**. - **Identity Collector** - Fulfillment requires an identity collector in order to run. If you did not select an identity collector in the General Details configuration page, you can select one from the drop down list now. If there is no identity collector defined for this application, or if you want to use a different identity collector than the ones in the dropdown list, you can create a new identity collector in the Administrative Client (Applications > Configuration > Permissions Management > Identity Collectors). Refer to Create/Edit an Active Directory Identity Collector for more details on creating an identity collector. - **Managed Group OU (DN)** - The organizational unit in which the managed permission groups will be created. Make sure that the chosen identity collector’s user has permissions to create groups under this location (e.g. OU=FileAccessManagerManaged, DC=SailPoint, DC=COM) - **OU** - Organizational Unit - **DN** - Distinguished Name. - **How to Handle List Folder Contents Permissions** - Create and manage a dedicated permissions group for it - this is the default value - Revoke these permissions - Not relevant for SharePoint - **How to Handle Inexact Permissions Matches** - During the normalization process, the application has to decide what to do with permissions that do not match the normalized permissions. - Fail the normalization process - Elevate to the nearest permission match - Revoke the permission 1. Open the **Advanced Settings** panel for additional settings: - **Group Cache Sync Interval(sec)** - This setting will add a pause to the process of setting normalize permissions on the resource. This will allow the endpoint's local AD groups cache to sync the newly created managed groups. - The default Is 0 - signifying the process will not pause by default. - **Use Template Permission Group** - Template groups are created per application and added as a template to every managed resource. These groups are not managed by File Access Manager, and are usually used to ensure that users who need application-wide access such as backup or archiving users have access. - Select for each permission group whether File Access Manager should create a group or whether to use an existing group, for the following groups: - List Folder Contents - Read & Execute - Modify - Full Control - If you select **Use an Existing Group**, select the required group to use from the dropdown list. - Once an application is enabled for access fulfillment, you can set specific resources to be normalized using the **Manage Normalized Resources** page. # Configuring Activity Monitoring **To configure the activity monitoring polling parameters:** 1. Go to **Admin > Applications** to open the **Edit** page of the required application. 1. Scroll through the list, or use the filter to find the application. 1. Select the **edit** icon on the line of the application. 1. Select **Next** until you reach the **Activity Configurations & Decs** settings page. **Polling Interval (sec)** - Activity fetching interval [in seconds]). Default is set to 60 seconds, **Report Interval (sec)** - Activity Monitor Health reporting interval [in seconds]). Default is set to 60 seconds. **Local Buffer Size (MB)** - Local buffer size for activities [ in MB]). Default is set to 200MB. This cyclic buffer is used to store activities on the Application Monitor’s machine in case of network errors that prevent the activities from being sent. **Activity Data Retention Period** - When selecting the Clear Activity Data option, a user is able to provide a time frame (1 to 100) in either months or years for all activity to be retained. Once that time period is met, all data will be removed. Note By default, this feature is disabled. A user can also select to backup the data before it is deleted by selecting the Backup Events Before Clearing option. Note The Backup Before Clearing Option will only be enabled if the backup option is set during the system installation. If a user has not selected the backup option during the installation nor provided a backup path, this option will not be enabled. ## Configuring Data Enrichment Connectors The Data Enrichment Connectors (DEC) configuration enables us to select data enrichment sources. These can be used to add information from other sources about identities. An enrichment source could be a local HR database that is used to combine users' job descriptions or departments to the information stored in the identity store. 1. Select the data enrichment connectors to enrich monitored activities from the **Available DECs** text box. 1. Use the **>** or **>>** arrows to move the selected DECs to the **Current DECs** text box. The user can select multiple DECs. Simply select each desired DEC. 1. You can create a new DEC in the Administrative Client on the **Applications > Configuration > Activity Monitoring > Data Enrichment Connectors** page. 1. After creating a new DEC, select **Refresh** to refresh the dropdown list. The chapter Connectors of the File Access Manager Administrator Guide provides more information on Data Enrichment Connectors, including what they are, how to configure them, and how they fit in the Activity Flow. ## Monitoring Exclusions **To add an exclusion:** 1. Select the dropdown list. 1. Type in an exclusion (file extension, user, folder, etc. as relevant). 1. Select the **+** icon to add this item to the list. 1. After completing the list, select **Next** or **Cancel** to close the panel. **To edit or remove an exclusion from the list:** 1. Select the dropdown list. 1. On the extension to edit or remove, select the **delete** or **edit** icon. 1. Select **Next** or **Cancel** to close the panel. 1. Select **Clear Selection** to clear the entire list. **Excluded File Extensions** - List of file extensions that are not monitored, e.g., `txt`, `exe`. Enter one value at a time as described above. **Exclude Folders** - List of folders that are not monitored, e.g., `\\servername\share1\\folder1`. Enter one value at a time as described above. **Exclude Users** - List of users whose activities are not monitored, e.g., `user1`, `domain\user2`, `user3@domain.com`. Enter one value at a time as described above. Important The user format to be used depends on how the activity is logged by the endpoint. If you are not sure which of the user formats above to use, either specify all of them, or leave the list empty for now, go to the **Forensics > Activities** screen in the File Access Manager Website after some activities flow in to view how the user is depicted in them and use that depiction in the exclusion list. ### When an activity from a new resource is detected:(Modes of Storing Activities) - **Full Auto-Learning Mode** – Will audit everything (every action) on every resource. - **Semi Auto-Learning Mode** – Will monitor activities on resources nested under the top-level resources that are marked for Monitoring. This operation mode will also allow the user to select what type of activities are being monitored. ## Monitored Actions The user has the ability set monitored actions within Manage Resources. 1. Go to **Admin > Applications**. 1. Under the **Actions** column, select the **ellipsis** icon on the desired application. 1. Select **Manage Resources**. The Manage Resources will display with all resources listed. 1. Select **Manage Monitored Actions**. 1. Toggle **Enable Activity Monitoring for this Resource Hierarchy**. The user can now select the type of actions they want monitored. Note All actions are automatically selected initially. 1. Select **Next**. # Selecting and Scheduling the Data Classification Settings **To associate an application with a data classification service, and set the schedule:** 1. Go to **Admin > Applications** to open the **Edit** page of the required application. 1. Scroll through the list, or use the filter to find the application. 1. Select the **edit** icon on the line of the application. 1. Select **Next** until you reach the **Data Classification** settings page. The actual entry fields vary according to the application type. **Central Data Classification Service** - Associate the application with a Central Data Classification Service. This service is responsible for running the Data Classification tasks. If the Central Data Classification wasn’t installed during the installation of the server, this field is disabled. **Disabling Data Classification** - To disable data classification, delete the entry from the central data classification field. Disabling data classification can also be achieved by setting the scheduler to be inactive, which is the default setting for data classification. **Create a Schedule** - This option is enabled only if a central data classification service is selected. Refer to [Scheduling a Task](https://documentation.sailpoint.com/fam-connectors/help/nas/emc_isilon/add/perm_coll.html#scheduling-a-task). Note Refer to the Data Classification chapter in the File Access Manager Administrator Guide for more information Select **Next** or **Finish**. ## Data Privacy A user can associate the application with a Central Data Classification Engine Service. This engine will be responsible for executed Data Privacy tasks. Though using different processes for each, the Data Classification engine service is in charge for both Data Privacy and Data Classification discovery tasks. You may choose the same service for both, or use a different one for each, to run them in parallel. Note The fields on the Data Privacy step are the same as the Data Classification step. # Configuring and Scheduling the Permissions Collection Permissions can be analyzed to determine the application permissions of an out-of-the-box application, provided you have defined an identity store for File Access Manager to use in its analysis, and you have run a crawl for the application. The permission collector is a software component responsible for analyzing the permissions in an application. The Central Permission Collector Service is responsible for running the Permission Collector and Crawler tasks. If the “File Access Manager Central Permission Collector” wasn’t installed during the installation of the server, this configuration setting will be disabled. **To configure the Permission Collection:** 1. Go to **Admin > Applications** to open the **Edit** page of the required application. 1. Scroll through the list, or use the filter to find the application. 1. Select the **edit** icon on the line of the application. 1. Select **Next** until you reach the **Crawler & Permissions Collection** settings page. The actual entry fields vary according to the application type. When entering this page in edit mode, you can navigate between the various configuration windows using the **Next** and **Back** buttons. **Central Permissions Collection Service** - Select a central permission collection service from the dropdown list. You can create permissions collection services as part of the service installation process. Refer to the Services Configuration section in the File Access Manager Administrator Guide for further details. **Calculate Effective Permissions** - Calculate effective permissions during the permissions collection run. **Skip Identities Sync during Permission Collection** - Skip identity synchronization before running permission collection tasks when the identity collector is common to different connector. Note This option is checked by default. **Permissions Comments on Isilon for the CIFS server** Note The permissions are managed on the NTFS level, or on the Share Level as when the shares are configured with Full Control to everyone, and all the permissions are defined in the folders, in which case you should select NTFS, which is the default. You can now [schedule a task](#scheduling-a-task). ## Scheduling a Task To create a schedule: 1. Select **Create a Schedule**. 1. The system will provide a Schedule Name in the format `{appName} - {type} Scheduler`. Choose to keep or override this suggestion. 1. Select a scheduling frequency from the dropdown list. Schedule Frequency Options - Run After - Create dependency of tasks. The task starts running only upon successful completion of the first task. - Hourly - Set the start time. - Daily - Set the start date and time. - Weekly - Set the day(s) of the week on which to run. - Monthly - Set the day of the month on which to run a task. - Quarterly - Set a monthly schedule with an interval of 3 months. - Half Yearly - Set a monthly schedule with an interval of 6 months. - Yearly - Set a monthly schedule with an interval of 12 months. 1. Fill the Date and Time field with scheduling times. These fields differ depending upon the scheduling frequency selected. 1. Select the **Active** checkbox to activate the schedule. 1. Select **Next**. ## Configuring and Scheduling the Crawler **To set or edit the Crawler configuration and scheduling:** 1. Go to **Admin > Applications** to open the **Edit** page of the required application. 1. Scroll through the list, or use the filter to find the application. 1. Select the **edit** icon on the line of the application. 1. Select **Next** until you reach the **Crawler & Permissions Collection** settings page. The actual entry fields vary according to the application type. **Calculate Resource Size** - Determine when, or at what frequency, File Access Manager calculates the resources' size. Select one of the following: - Never - Always - Second crawl and on (This is the default) **Create a Schedule** - Select to open the schedule panel. Refer to [Scheduling a Task](#scheduling-a-task). ## Setting the Crawl Scope There are several options to set the crawl scope: - Setting explicit list of resources to include and / or exclude from the scan. - Creating a regex to define resources to exclude. ## Including and Excluding Paths by List **To set the paths to include or exclude in the crawl process for an application:** 1. Go to **Admin > Applications** to open the **Edit** page of the required application. 1. Scroll through the list, or use the filter to find the application. 1. Select the **edit** icon on the line of the application. 1. Select **Next** until you reach the **Crawler & Permissions Collection** settings page. The actual entry fields vary according to the application type. 1. Scroll down to the Crawl configuration settings. 1. Select **Advanced Crawl Scope Configuration** to open the scope configuration panel. 1. Select **Include / Exclude Resources** to open the input fields. 1. To add a resource to a list, type in the full path to include / exclude in the top field and select the **+** icon to add it to the list. 1. To remove a resource from a list, find the resource from the list, and select the **x** icon on the resource row. Note When creating exclusion lists, excludes take precedence over includes. ## Excluding Paths by Regex **To set filters of paths to exclude in the crawl process for an application using regex:** 1. Go to **Admin > Applications** to open the **Edit** page of the required application. 1. Scroll through the list, or use the filter to find the application. 1. Select the **edit** icon on the line of the application. 1. Select **Next** until you reach the **Crawler & Permissions Collection** settings page. The actual entry fields vary according to the application type. 1. Select **Exclude Paths by Regex** to open the configuration panel. 1. Type in the paths to exclude by Regex. Refer to the regex examples in the section below. Since the system does not collect BRs that match this Regex, it also does not analyze them for permissions. ## Crawler Regex Exclusion Example The following are examples of crawler Regex exclusions: ### Exclude all shares which start with one or more shares names | **Example** | **Regex** | | ------------------------------------------------------------------------- | ----------------------------- | | Starting with `\\server_name\shareName` | `\\\\server_name\\shareName$` | | Starting with `\\server_name\shareName` or `\\server_name\OtherShareName` | \`\\\\server_name\\(shareName | ### Include ONLY shares which start with one or more shares names | **Example** | **Regex** | | ------------------------------------------------------------------------- | ---------------------------------- | | Starting with `\\server_name\shareName` | \`^(?!\\\\server_name\\shareName($ | | Starting with `\\server_name\shareName` or `\\server_name\OtherShareName` | \`^(?!\\\\server_name\\(shareName | ### Narrow down the selection | **Example** | **Regex** | | --------------------------------------------------------------- | ---------------------------------- | | Include ONLY the C$ drive shares: `\\server_name\C$` | \`^(?!\\\\server_name\\C$($ | | Include ONLY one folder under a share: `\\server\share\folderA` | \`^(?!\\\\server_name\\share$($ | | Include ONLY all administrative shares | \`^(?!\\\\server_name\\[a-zA-Z]$($ | Note - To write a backslash or a Dollar sign, add a backslash before it as an escape character. - To add a condition in a single command, use a pipe character “|” . ## Excluding Top Level Resources Use the top level exclusion screen to select top level roots to exclude from the crawl. This setting is done per application. **To exclude top level resources from the crawl process:** 1. Go to **Admin > Applications** to open the **Application** screen. 1. Find the application to configure and select the drop down menu on the application line. Select **Exclude Top Level Resources** to open the configuration panel. 1. Select **Run Task**. The Run Task button triggers a task that runs a short detection scan to detect the current top level resources. Before running the task for the first time, the following message displays above this button: **Note: Run task to detect the top-level resources**. If the top level resource list has changed in the application while you are on this screen, select this button to retrieve the updated structure. Once triggered, you can view the task status in **Settings > Task Management > Tasks**. Note This will only work if the user has access to the task page 1. When the task has completed, select **Refresh** to update the page with the list of top level resources. 1. Select the top level resource list, and select top level resources to exclude. 1. Select **Save** to save the change. 1. To refresh the list of top level resources, run the task again. Running the task will not clear the list of top level resources to exclude. ## Special Consideration for Long File Paths in Crawl If you need to support long file paths above 4,000 characters for the crawl, set the `excludeVeryLongResourcePaths` flag in the Permission Collection Engine App.config file to `true`. By default this value will be commented out and set to `false`. This key ensures, when enabled, that paths longer than 4000 characters are excluded from the applications’ resource discovery (Crawl), to avoid issues while storing them in the SQLServer database. When enabled, business resources with full paths longer than 4000 characters, and everything included in the hierarchical structure below them, will be excluded from the crawl, and will not be collected by File Access Manager. This scenario is extremely rare. Note You should not enable exclusion of long paths, unless you experience an issue. - **Background** - File Access Manager uses a hashing mechanism to create a unique identifier for each business resource stored in the File Access Manager database. The hashing mechanism in SQLServer versions 2014 and earlier, is unable to process (hash) values with 4,000 or more characters. Though resources with paths of 4000 characters or longer are extremely rare, File Access Manager is designed to handle that limitation. - **Identifying the Problem** - When using an SQL Server database version 2014 and earlier. The following error message in the Permission Collection Engine log file: `System.Data.SqlClient.SqlException (0x80131904): String or binary data would be truncated.` In all other cases, this feature should not be enabled. - **Setting the Long Resource Path Key** - The Permission Collection Engine App.config file is `RoleAnalyticsServiceHost.exe.config`, and can be found in the following folder: %SailPoint_Home%\\FileAccessManager[Permission Collection instance]\\ Search for the key `excludeVeryLongResourcePaths` and correct it as described above. # EMC-Unity CIFS Connector Overview ## Capabilities This connector enables you to use File Access Manager to access and analyze data stored in EMC-Unity CIFS and do the following: - Analyze the structure of your stored data. - Monitor user activity in the resources. - Classify the data being stored. - Verify user permissions on the resources, and compare them against requirements. - Manage access fulfillment - automated granting and revoking of access - according to rules set in File Access Manager. - Identity collector – collect IAM users, groups and roles and the connections between them. Refer to the File Access Manager documentation for a full description. ### CEE CEE is a software package that allows File Access Manager to receive event notifications from Unity. It consists of two agents: Common Antivirus Agent (CAVA) and Common Event Publishing Agent (CEPA). All NAS servers send notifications on events to the CEPA agent and CEPA sends the events to File Access Manager. ### CEPA and NAS Servers - For CEPA to work, you need to have a SMB server configured on the NAS Server. - A CEPA service can communicate with multiple NAS servers, and a NAS server can communicate with multiple CEPA services. - CEPA servers work in pools, Dell Recommends a minimum of two CEPA servers per pool. - Each NAS server needs to enable publishing events and configure at least one CEPA pool. ### CEE & Activity Monitor Every Activity Monitor can communicate with one or more CEE servers. Every CEE service can be configured to work with a multiple Activity Monitor services. ### Activity Monitor File Access Manager Connector for EMC uses EMC CEPA over the Common Event Enabler Framework (or CEE, formerly known as CAVA) infrastructure for getting audit events from the Unity for CIFS access. The Activity Monitor supports different architectures and can work with either a single or multiple, remote, or local CEE services. ### Permissions Collection File Access Manager connects using EMC administrative shares and analyzes folder permissions. Local groups and users are collected from the CIFS server during the Permission Collection process. ### Supported Versions EMC Dell EMC Unity OE version 4.1 ## EMC-Unity CIFS Installation Flow Overview **To install the EMC-Unity CIFS connector:** 1. Configure all the prerequisites. 1. Add a new EMC-Unity CIFS application in the Business Website. 1. Install the relevant services: - Activity Monitor - This is the activity collection engine, used by all connectors that support activity monitoring. - Permissions Collector If you are using EC2 login, the collector should be installed on the EC2 instance. - Data Classification Collector Important Installing the permissions collector and data classification services is optional and should only be installed by someone with a full understanding of File Access Manager deployment architecture. The File Access Manager Administrator Guide has additional information on the architecture. # Collecting Data Stored in an External Application ## Terminology - **Connector:** - The collection of features, components and capabilities that comprise File Access Manager support for an endpoint. - **Collector:** - The “Agent” component or service in a Data Classification and or Permission Collection architecture. - **Engine:** - The core service counterpart of this architecture. - **Identity Collector:** - A logical component used to fetch identities from an identity store and holds the configuration, settings for that identity store, and the relations between these identities. The identity collector has no “physical” manifest. The actual work is done by the Collector Synchronizer. The list below describes the high level installation process required to collect and analyze data from an external application. Most of these should already be set up in your File Access Manager installation. Refer to the server Installation guide for further details. - **Install a Data Classification central engine** - One or more central engines, installed using the server installer - **Install a Permission Collection central engine** - One or more central engines, installed using the server installer - **Create an Application in File Access Manager** - From the Business Website. The application is linked to central engines listed above. - **Add an Activity Monitor** - To collect activities for this application - run the Collector Installation Manager and add an application under Activity Monitoring. ## Adding Collectors - **Install Permission Collectors and / or Data Classification Collector (optional)** - Optionally, you can install collectors that will run on a separate server and take some of the work from the central PC and DC engines (Where supported). When installing a collector, you attach it to an engine. If no collectors are installed, the central services act as both the engine and the collector. To install a collector, you must have the **RabbitMQ** service installed for communication between the central engines and the collectors. RabbitMQ is installed. Note Some cloud connectors ignore collectors connected to the central engine. (Box, Dropbox, OneDrive, SharePointOnline, Exchange Online, GoogleDrive) . In these applications the task will be done entirely by the engine, and not relegated to its collectors. Note For further details, refer to the **Application > Central Service > Collector Relations** section in the File Access Manager Administrator Guide. # Installing Services: Activity Monitor and Collectors The Collector Installation Manager is part of the File Access Manager installation package. This tool is used to install the activity monitor, permission collector, and data classification collector. 1. Run the **Collector Installation Manager** as an Administrator. The installation files are in the installation package under the folder Collectors. The Collector Installation Manager window displays. 1. Enter the credentials to connect to File Access Manager. - ServerName/IP should be pointed to the Agent Configuration Manager service server. - A File Access Manager user with Collector Manager permission (permission to install collectors). For Active Directory authentication, use the format domain\\username. 1. Select **Next**. The Service Configuration window displays. 1. If you are installing the Activity Monitor, select the application, and select **Add**. 1. When installing a SharePoint Activity Monitor, you will be prompted for service account credentials. This service account will be used by the Activity Monitor service to run the service and authenticate against the SharePoint IIS servers to fetch the logs (“Log on as”). Make sure the service account provided has local administrator privileges on the local server (hosting the Activity Monitor service) and can access the activity logs on the IIS servers. 1. If you are installing the Permission Collector, select the Central Permission Collector to which to connect this service, and select **Add**. 1. If you are installing the Data Classification, select the Central Classification Collector to which to connect this service, and select **Add**. 1. Select **Next**. The Installation Folder window displays. Note If this is the first time you are installing collectors on this machine, you will be prompted to select an installation folder, in which all future collectors will also be installed. 1. Browse and select the location of the target folder for installation. 1. Browse and select the location of the folder for system logs. 1. Select **Next**. The system begins installing the selected components. 1. Select **Finish**. The Finish button is displayed after all the selected components have been installed. Note The File Access Manager Administrator Guide provides more information on the collector services. # Prerequisites Make sure your system fits the descriptions below before starting the installation. ## Software Requirements File Access Manager requires the latest ASP.NET Core 8.0.x Hosting Bundle. This bundle consists of .NET Runtime and ASP .NET Core Runtime. You can download the latest 8.0.x Hosting Bundle version from [here](https://dotnet.microsoft.com/en-us/download/dotnet/8.0). ## Configuring the CEE Service Make sure that CEE is installed on a Windows machine in the domain, and that the log on user for the CEE services is an administrative user in the domain. ### Supported Versions Use the latest version of CEE. ### Remote CEE For enterprises with an existing central CEE infrastructure, where the Activity Monitor will be installed on a different server than the CEE service: 1. On every CEE server, make the following changes in the registry: `[HKLM\Software\EMC\CEE\CEPP\Audit\Configuration]` `Endpoint=whitebox@` `Enabled=1` If multiple monitor servers exist, the list should look like: whitebox@ip, whitebox@ip, ... 1. Restart the EMC CEE service. ### Local CEE (no central infrastructure) When installing the CEE service and the Activity Monitor service on the same server: 1. Install CEE Pack on the monitor server. The CEE service must be installed on a server in the same domain as the NAS server CEE server, otherwise the communication between the NAS server and the CEE service will fail. 1. Make the following changes in the registry: `[HKLM\Software\EMC\CEE\CEPP\Audit\Configuration]` `Endpoint=whitebox` `Enabled=1` 1. Set the logon user for the services to a user according to the “Permissions” section. 1. Restart EMC CEE service. ## Configuring Event Publishing in Unity To enable event publishing on a share, Events publishing must be enabled on its NAS server and its File System as described in the following sections. ### Enabling Event Publishing in the NAS Server 1. Open Unisphere and navigate to the **File** tab in the left pane under Storage. 1. Select the **NAS Servers** tab. For each NAS Server that you wish to enable activities, run the following: 1. Double-click the NAS Server. The Server’s properties appear. 1. Open the **Protection & Events** Tab, and choose **Events Publishing** in the left pane. The Events Publishing details appears. 1. Check **Enable Common Event Publishing**. The New Event Pool window appears to create the first Event Pool. 1. Select **Add**. The Add new server window appears. 1. Fill the Server name of the CEE service and select **Add**. The New Event Pool window will reappear, with the list of servers listed. 1. Select **Add** to add additional servers with CEE service. 1. To configure the post events, select **Configure** next to Post Events. This will open the **Configure PostEvents…** window. 1. Check the following Event Types: - OpenFileRead - CreateFile - CreateDir - DeleteFile - DeleteDir - CloseModified - RenameFile - RenameDir - SetAclFile - SetAclDir 1. Select **OK** to return to the CEPA Properties window. 1. Optionally, rename the Event Pool in the **Name** field. 1. Select **Configure** to return to the NAS Properties window. 1. Select **Close**. ### Enabling Event Publishing in the File System 1. Open Unisphere and navigate to the **File** tab in the left pane under **Storage**. 1. Select the **File Systems** tab. **To enable activities for a file system:** 1. Double-click the File System to open the File System Properties window. 1. Select the **Advanced** tab to open the Advanced Configuration tab. 1. Check **Enable SMB Events publishing** and select **Apply**. ## Permissions File Access Manager requires different permissions, based on the tasks that require those permissions. The user configured in the Application configuration wizard must have the following permissions on the file server: - Share Read permissions to all shares on the file server - Full Control permission for each normalized folder - Member of the local Backup Operators group on the file server - Member of the local Administrators group on the file server ### Why do we need this access? The following detailed explanation describes required permissions by each File Access Manager task: - **Activity Monitoring** - No special permission is required, since the Activity Monitor service runs locally on the monitored service with Local System privileges. - **Crawling** - The user must have Share Read permissions to all the shares on the file server. The user must be a member of the local Backup Operators group on the file server. - **Permission Collection** - The user must have Share Read permissions to all the shares on the server. The user must be member of the local Backup Operators group on the server. The user must be a member of the local Administrators group to read the Share Permissions, and the local Users and Groups of the server. - **Access Fulfillment** - The user must have Full Control permission on the normalized folders to be able to set the permissions. - **Data Classification** - The user must have Share Read permissions for all the shares on the server. The user must be member of the local Backup Operators group on the server. ## Communications Requirements | **Requirement** | **Source** | **Destination** | **Port** | | ---------------------------------------------------- | --------------------------------------------------- | ------------------------------- | ------------------- | | File Access Manager Message Broker | Permissions Collector/Data Classification Collector | RabbitMQ | 5671 | | File Access Manager Access | Activity Monitor | File Access Manager Servers | 8000-8008 | | EMC CEE | EMC NAS server | CEE Server | RPC (135 + Dynamic) | | CEPA Events Push | CEE Server | File Access Manager Application | RPC (135 + Dynamic) | | Permissions Collector & Data Classification Analysis | Permissions Collector/Data Classification Server | Monitored server | CIFS/SMB (139, 445) | # Troubleshooting Check the issues below for common problems and suggested ways of handling them. ## What if Activities are not Collected by the Activity Monitor If activities are not collected by the Activity Monitor, we need to track the status of the components, starting with the Data Mover, an checking to the Activity Monitor service. 1. Login to unisphere. 1. In the left pane, select **File** under Storage, and choose the **NAS Servers** tab. Check for errors in the status of the NAS servers. 1. In right pane, select **Logs** under Events. Check for any relevant error. 1. Verify that all the prerequisites were set. Refer to [Prerequisites](https://documentation.sailpoint.com/fam-connectors/help/nas/emc_unity_cifs/prereqs.html). - The post events were configured correctly in the NAS server configuration. - The CEE service is running with a domain user who is an administrator on the CEE service server. - The CEE service and the NAS server CIFS server are joined to the same active directory domain. - The CEPA IP address listed in the output of the command above matches the address of the server running the CEE service. - There is no firewall between the NAS server and the server running the CEE service. - The windows firewall is off on the server running the CEE service. 1. Stop the Activity Monitor service, wait for 60 seconds. 1. Stop the event publishing in each NAS server. 1. Select **File** under Storage in the left pane. 1. Choose the **NAS Servers** tab. 1. Double-click each NAS server. 1. Choose the **Protection & Events** tab. 1. Select **Events Publishing** in the right pane. 1. Deselect **Enable Common Event Publishing**. 1. Stop the EMC CEE service on the CEE server. 1. Stop the Activity Monitor service. 1. Start the event publishing in each NAS server. 1. Select **File** under Storage in the left pane. 1. Choose the **NAS Servers** tab. 1. Double-click each NAS server. 1. Choose the **Protection & Events** tab. 1. Select **Events Publishing** in the right pane. 1. Check **Enable Common Event Publishing**. 1. Start the Activity Monitor service, and wait for 60 seconds. 1. Start the EMC CEE service, wait for 60 seconds. ## What if the Counters Increase But No Events Are Collected If the counters increase, but no events are collected: 1. Check the statistics log file of the Activity Monitor to verify whether events are received by the Activity Monitor. 1. If no events are received by the Activity Monitor validate the Application configuration: - Make sure the CIFS server name is properly configured in the Application filer name field. This value must be the actual name of the CIFS server name, and not the FQDN or one of the aliases and without trailing slashes. - If the CIFS server has aliases defined to it (validate that in the EMC management), make sure these aliases are defined under the aliases in the Application configuration. # Verifying EMC Unity CIFS Connector Installation ## Installed Services Verify that the services installed for the connector are available and active. Using windows Service manager, or other tool, look for the File Access Manager services, and verify that they are running. For example: - File Access Manager Central Activity Monitor- `` service is running. - File Access Manager Central Data Classification - `` service is running. - File Access Manager Central Permissions Collection - `` service is running. ## Log Files Check the log files listed below for errors: - `“%SAILPOINT_HOME_LOGS%\ FilesMiniFilter_ .log"` - `“%SAILPOINT_HOME_LOGS%\PermissionCollection_.log"` - `“%SAILPOINT_HOME_LOGS%\DataClassification_.log"` - `%SAILPOINT_HOME_LOGS%\EMCCelerra_.log` ## Monitored Activities 1. Simulate activities on the CIFS server. 1. Wait approximately one minute. 1. Verify that the activities display in the File Access Manager website under **Forensics > Activities**. ## Permissions Collection 1. Run the Crawler and Permissions Collector tasks on the **Settings > Task Management > Scheduled Tasks** page. 1. Verify that: - The tasks completed successfully - Business resources were created in the resource explorer on the **Admin > Applications > [application column] > Manage Resources** page. - Permissions display in the Permission Forensics page under **Forensics > Permissions**. # Adding an EMC Unity CIFS Application In order to integrate with EMC-Unity CIFS, we must first create an application entry in File Access Manager. This entry includes the identification, connection details, and other parameters necessary to create the link. To add an application, use the New Application Wizard. 1. Navigate to **Admin** > **Applications**. 1. Select **Add New** to open the New Application Wizard. 1. Select **Standard Application** for the wizard type. 1. Select **Next** to open the **General Details** page. ## General Details - **Application Type** - EMC Celerra-CIFS - **Application Name** - Logical name of the application. - **Description** - Description of the application. - **Tags** - Select tags for the application from the dropdown menu, and / or type a new name, and select **Enter** to create a new tag. The dropdown list of tags filters out matching tags as you type and displays up to 50 tags. Note The tags replace the Logical container field that was used when creating applications in releases before 8.2. - **Event Manager Server** - This option is available if there are more than one event manager servers configured in the system. Select an event manager from the drop down menu. - **Identity Collector** - Select from the Identity Collector dropdown menu. - You can create identity collectors in the administrative client at **Applications > Configuration > Permissions Management > Identity Collectors**. Refer to the OOTB Identity Collection section in the Collector Installation Manager File Access Manager Administrator Guide for further details. - If adding a new identity collector, select the **Refresh** button to update the Identity Collector dropdown list. Select **Next** to open the **Connection Details** page. ## Connection Details Complete the Connection Details fields: - **Host Name** - The host name of SMB Server name of the NAS server. not FQDN, and without trailing slashes. - **Domain Name** - The user defined in the prerequisites. - **Username / Password** - Credentials of the user defined in the prerequisites. - **Aliases** Important The **Alias** field should remain empty for the EMC Unity configuration. Select the **delete** icon on any item to remove it from the list. # Enabling Access Fulfillment for an Application Access fulfillment is enabled per application in the application setting screen, for applications that support fulfillment. Refer to the compatibility table in Compass for the full list. **To enable Access Fulfillment for an application:** 1. Go to **Admin > Applications** to open the **Configuration** page of the required application. 1. Scroll through the list, or use the filter to find the application. 1. Select the **edit** icon on the line of the application. 1. Select **Next** until you reach the Access Fulfillment settings page. The setting pages and entry fields vary according to the application type. 1. For non-normalized resources, you can select **Enable Access Fulfillment for Revoking Explicit Permissions**. Refer to Access Fulfillment for Removal of Explicit Permissions. 1. Select **Enable Access Fulfillment for Normalized Groups**. - **Identity Collector** - Fulfillment requires an identity collector in order to run. If you did not select an identity collector in the General Details configuration page, you can select one from the drop down list now. If there is no identity collector defined for this application, or if you want to use a different identity collector than the ones in the dropdown list, you can create a new identity collector in the Administrative Client at **Applications > Configuration > Permissions Management > Identity Collectors**. Refer to Create/Edit an Active Directory Identity Collector for more details on creating an identity collector. - **Managed Group OU (DN)** - The organizational unit in which the managed permission groups will be created. Make sure that the chosen identity collector’s user has permissions to create groups under this location (e.g. OU=FileAccessManagerManaged, DC=SailPoint, DC=COM) - **OU** - Organizational Unit - **DN** - Distinguished Name. - **How to Handle ‘List Folder Contents’ Permissions** - Create and manage a dedicated permissions group for it - this is the default value - Revoke these permissions - Not relevant for SharePoint **How to Handle Inexact Permissions Matches** - During the normalization process, the application has to decide what to do with permissions that do not match the normalized permissions. ```text - Fail the normalization process - Elevate to the nearest permission match - Revoke the permission ``` 1. Open the **Advanced Settings** panel for additional settings: - **Group Cache Sync Interval(sec)** - This setting will add a pause to the process of setting normalize permissions on the resource. This will allow the endpoint's local AD groups cache to sync the newly created managed groups. - The default Is 0 - signifying the process will not pause by default. - **Use Template Permission Group** - Template groups are created per application and added as a template to every managed resource. These groups are not managed by File Access Manager, and are usually used to ensure that users who need application-wide access such as backup or archiving users have access. - Select for each permission group whether File Access Manager should create a group or whether to use an existing group, for the following groups: - List Folder Contents - Read & Execute - Modify - Full Control - If you select **Use an Existing Group**, select the required group to use from the dropdown list. - Once an application is enabled for access fulfillment, you can set specific resources to be normalized using the Manage Normalized Resources page. # Configuring Activity Monitoring **To configure the activity monitoring polling parameters:** 1. Go to **Admin > Applications** to open the edit screen of the required application. 1. Scroll through the list, or use the filter to find the application. 1. Select the **edit** icon on the line of the application. 1. Select **Next** until you reach the **Activity Configurations & Decs** settings page. **Polling Interval (sec)** - Activity fetching interval [in seconds]). Default is set to 60 seconds, **Report Interval (sec)** - Activity Monitor Health reporting interval [in seconds]). Default is set yo 60 seconds. **Local Buffer Size (MB)** - Local buffer size for activities [ in MB]). Default is set to 200MB. This cyclic buffer is used to store activities on the Application Monitor’s machine in case of network errors that prevent the activities from being sent. **Activity Data Retention Period** - When selecting the Clear Activity Data option, a user is able to provide a time frame (1 to 100) in either months or years for all activity to be retained. Once that time period is met, all data will be removed. Note By default, this feature is disabled. A user can also select to backup the data before it is deleted by selecting the Backup Events Before Clearing option. Note The Backup Before Clearing Option will only be enabled if the backup option is set during the system installation. If a user has not selected the backup option during the installation nor provided a backup path, this option will not be enabled. ## Configuring Data Enrichment Connectors The Data Enrichment Connectors (DEC) configuration enables us to select data enrichment sources. These can be used to add information from other sources about identities. An enrichment source could be a local HR database that is used to combine users' job descriptions or departments to the information stored in the identity store. 1. Select the data enrichment connectors to enrich monitored activities from the **Available DECs** text box. 1. Use the **>** or **>>** arrows to move the selected DECs to the **Current DECs** text box. The user can select multiple DECs. Simply select each desired DEC. 1. You can create a new DEC in the Administrative Client under **Applications > Configuration > Activity Monitoring > Data Enrichment Connectors**. 1. After creating a new DEC, select **Refresh** to refresh the dropdown list. The chapter Connectors of the File Access Manager Administrator Guide provides more information on Data Enrichment Connectors, including what they are, how to configure them, and how they fit in the Activity Flow. ## Monitoring Exclusions **To add an exclusion:** 1. Select the dropdown list. 1. Type in an exclusion (file extension, user, folder, etc. as relevant). 1. Select the **+** icon to add this item to the list. 1. After completing the list, select **Next** or **Cancel** to close the panel. **To edit or remove an exclusion from the list:** 1. Select the dropdown list. 1. On the extension to edit or remove select the **delete** or **edit** icon. 1. Select **Next** or **Cancel** to close the panel. 1. Select **Clear Selection** to clear the entire list. **Excluded File Extensions** - List of file extensions that are not monitored, e.g., `txt`, `exe`. Enter one value at a time as described above. **Exclude Folders** - List of folders that are not monitored, e.g., `\\servername\share1\\folder1`. Enter one value at a time as described above. **Exclude Users** - List of users whose activities are not monitored, e.g., `user1`, `domain\user2`, `user3@domain.com`. Enter one value at a time as described above. Important The user format to be used depends on how the activity is logged by the endpoint. If you are not sure which of the user formats above to use, either specify all of them, or leave the list empty for now, navigate to the **Forensics > Activities** screen in the File Access Manager Website after some activities flow in to view how the user is depicted in them and use that depiction in the exclusion list. ### When an activity from a new resource is detected:(Modes of Storing Activities) - **Full Auto-Learning Mode** – Will audit everything (every action) on every resource. - **Semi Auto-Learning Mode** – Will monitor activities on resources nested under the top-level resources that are marked for Monitoring. This operation mode will also allow the user to select what type of activities are being monitored. ## Monitored Actions The user has the ability set monitored actions within Manage Resources. 1. Go to **Admin > Applications**. 1. Under the **Actions** column, select the **ellipsis** icon on the desired application. 1. Select **Manage Resources**. The Manage Resources will display with all resources listed. 1. Select **Manage Monitored Actions**. 1. Toggle **Enable Activity Monitoring for this Resource Hierarchy**. The user can now select the type of actions they want monitored. Note All actions are automatically selected initially. Select **Next**. # Selecting and Scheduling the Data Classification Settings **To associate an application with a data classification service, and set the schedule:** 1. Go to **Admin > Applications** to open the **Edit** page of the required application. 1. Scroll through the list, or use the filter to find the application. 1. Select the **edit** icon on the line of the application. 1. Select **Next** until you reach the **Data Classification** settings page. The actual entry fields vary according to the application type. **Central Data Classification Service** - Associate the application with a Central Data Classification Service. This service is responsible for running the Data Classification tasks. If the “Central Data Classification” wasn’t installed during the installation of the server, this field is disabled. **Disabling Data Classification** - To disable data classification, delete the entry from the central data classification field. Disabling data classification can also be achieved by setting the scheduler to be inactive (which is the default setting for data classification). **Create a Schedule** - This option is enabled only if a central data classification service is selected. Refer to [Scheduling a Task](https://documentation.sailpoint.com/fam-connectors/help/nas/emc_unity_cifs/add/perm_coll.html#scheduling-a-task). Refer to the Data Classification chapter in the File Access Manager Administrator Guide for more information. Select **Next** or **Finish**. ## Data Privacy A user can associate the application with a Central Data Classification Engine Service. This engine will be responsible for executed Data Privacy tasks. Though using different processes for each, the Data Classification engine service is in charge for both Data Privacy and Data Classification discovery tasks. You may choose the same service for both, or use a different one for each, to run them in parallel. Note The fields on the Data Privacy step are the same as the Data Classification step. # Configuring and Scheduling the Permissions Collection Permissions can be analyzed to determine the application permissions of an out-of-the-box application, provided you have defined an identity store for File Access Manager to use in its analysis, and you have run a crawl for the application. The permission collector is a software component responsible for analyzing the permissions in an application. The Central Permission Collector Service is responsible for running the Permission Collector and Crawler tasks. If the “File Access Manager Central Permission Collector” wasn’t installed during the installation of the server, this configuration setting will be disabled. **To configure the Permission Collection:** 1. Go to **Admin > Applications** to open the **Edit** page of the required application. 1. Scroll through the list, or use the filter to find the application. 1. Select the **edit** icon on the line of the application. 1. Select **Next** until you reach the **Crawler & Permissions Collection** settings page. The actual entry fields vary according to the application type. When entering this page in edit mode, you can navigate between the various configuration windows using the **Next** and **Back** buttons. - **Central Permissions Collection Service** - Select a central permission collection service from the dropdown list. You can create permissions collection services as part of the service installation process. Refer to the Services Configuration section in the File Access Manager Administrator Guide for further details. - **Skip Identities Sync during Permission Collection** - Skip identity synchronization before running permission collection tasks when the identity collector is common to different connector. Note This option is checked by default. You can now [schedule a task](#scheduling-a-task). ## Scheduling a Task To create a schedule: 1. Select **Create a Schedule**. 1. The system will provide a Schedule Name in the format `{appName} - {type} Scheduler`. Choose to keep or override this suggestion. 1. Select a scheduling frequency from the dropdown list. Schedule Frequency Options - Run After - Create dependency of tasks. The task starts running only upon successful completion of the first task. - Hourly - Set the start time. - Daily - Set the start date and time. - Weekly - Set the day(s) of the week on which to run. - Monthly - Set the day of the month on which to run a task. - Quarterly - Set a monthly schedule with an interval of 3 months. - Half Yearly - Set a monthly schedule with an interval of 6 months. - Yearly - Set a monthly schedule with an interval of 12 months. 1. Fill the Date and Time field with scheduling times. These fields differ depending upon the scheduling frequency selected. 1. Select the **Active** checkbox to activate the schedule. 1. Select **Next**. ## Configuring and Scheduling the Crawler **To set or edit the Crawler configuration and scheduling:** 1. Go to **Admin > Applications** to open the **Edit** page of the required application. 1. Scroll through the list, or use the filter to find the application. 1. Select the **edit** icon on the line of the application. 1. Select **Next** until you reach the **Crawler & Permissions Collection** settings page. The actual entry fields vary according to the application type. 1. **Calculate Resource Size** - Determine when, or at what frequency, File Access Manager calculates the resources' size. Select one of the following: - Never - Always - Second crawl and on (This is the default) 1. **Create a Schedule** - Select to open the **Schedule** panel. Refer to [Scheduling a Task](#scheduling-a-task). ## Setting the Crawl Scope There are several options to set the crawl scope: - Setting explicit list of resources to include and / or exclude from the scan. - Creating a regex to define resources to exclude. ## Including and Excluding Paths by List **To set the paths to include or exclude in the crawl process for an application:** 1. Go to **Admin > Applications** to open the **Edit** page of the required application. 1. Scroll through the list, or use the filter to find the application. 1. Select the **edit** icon on the line of the application. 1. Select **Next** until you reach the **Crawler & Permissions Collection** settings page. The actual entry fields vary according to the application type. 1. Scroll down to the Crawl configuration settings. 1. Select **Advanced Crawl Scope Configuration** to open the Scope configuration panel. 1. Select **Include / Exclude Resources** to open the input fields. 1. To add a resource to a list, type in the full path to include / exclude in the top field and then select the **+** icon to add it to the list. 1. To remove a resource from a list, find the resource from the list, and then select the **x** icon on the resource row. Note When creating exclusion lists, excludes take precedence over includes. ## Excluding Paths by Regex **To set filters of paths to exclude in the crawl process for an application using regex:** 1. Go to **Admin > Applications** to open the **Edit** page of the required application. 1. Scroll through the list, or use the filter to find the application. 1. Select the **edit** icon on the line of the application. 1. Select **Next** until you reach the **Crawler & Permissions Collection** settings page. The actual entry fields vary according to the application type. 1. Select **Exclude Paths by Regex** to open the configuration panel. 1. Type in the paths to exclude by Regex. Refer to the regex examples in the section below. Since the system does not collect BRs that match this Regex, it also does not analyze them for permissions. ## Crawler Regex Exclusion Example The following are examples of crawler Regex exclusions: ### Exclude all shares which start with one or more shares names | **Example** | **Regex** | | ------------------------------------------------------------------------- | ----------------------------- | | Starting with `\\server_name\shareName` | `\\\\server_name\\shareName$` | | Starting with `\\server_name\shareName` or `\\server_name\OtherShareName` | \`\\\\server_name\\(shareName | ### Include ONLY shares which start with one or more shares names | **Example** | **Regex** | | ------------------------------------------------------------------------- | ---------------------------------- | | Starting with `\\server_name\shareName` | \`^(?!\\\\server_name\\shareName($ | | Starting with `\\server_name\shareName` or `\\server_name\OtherShareName` | \`^(?!\\\\server_name\\(shareName | ### Narrow down the selection | **Example** | **Regex** | | --------------------------------------------------------------- | ---------------------------------- | | Include ONLY the C$ drive shares: `\\server_name\C$` | \`^(?!\\\\server_name\\C$($ | | Include ONLY one folder under a share: `\\server\share\folderA` | \`^(?!\\\\server_name\\share$($ | | Include ONLY all administrative shares | \`^(?!\\\\server_name\\[a-zA-Z]$($ | Note - To write a backslash or a Dollar sign, add a backslash before it as an escape character. - To add a condition in a single command, use a pipe character “|” . ## Excluding Top Level Resources Use the top level exclusion screen to select top level roots to exclude from the crawl. This setting is done per application. **To exclude top level resources from the crawl process:** 1. Go to **Admin > Applications** to open the application screen. 1. Find the application to configure and select the drop down menu on the application line. Select **Exclude Top Level Resources** to open the configuration panel. 1. Select **Run Task**. The Run Task button triggers a task that runs a short detection scan to detect the current top level resources. Before running the task for the first time, the following message displays above this button: **Note: Run task to detect the top-level resources**. If the top level resource list has changed in the application while you are on this screen, select this button to retrieve the updated structure. Once triggered, you can view the task status in **Settings > Task Management > Tasks**. Note This will only work if the user has access to the task page When the task has completed, select **Refresh** to update the page with the list of top level resources. 1. Select the top level resource list, and select top level resources to exclude. 1. Select **Save** to save the change. 1. To refresh the list of top level resources, run the task again. Running the task will not clear the list of top level resources to exclude. ## Special Consideration for Long File Paths in Crawl If you need to support long file paths above 4,000 characters for the crawl, set the `excludeVeryLongResourcePaths` flag in the Permission Collection Engine App.config file to `true`. By default this value will be commented out and set to `false`. This key ensures, when enabled, that paths longer than 4000 characters are excluded from the applications’ resource discovery (Crawl), to avoid issues while storing them in the SQLServer database. When enabled, business resources with full paths longer than 4000 characters, and everything included in the hierarchical structure below them, will be excluded from the crawl, and will not be collected by File Access Manager. This scenario is extremely rare. Note You should not enable exclusion of long paths, unless you experience an issue. - **Background** - File Access Manager uses a hashing mechanism to create a unique identifier for each business resource stored in the File Access Manager database. The hashing mechanism in SQLServer versions 2014 and earlier, is unable to process (hash) values with 4,000 or more characters. Though resources with paths of 4000 characters or longer are extremely rare, File Access Manager is designed to handle that limitation. - **Identifying the Problem** - When using an SQL Server database version 2014 and earlier. The following error message in the Permission Collection Engine log file: `System.Data.SqlClient.SqlException (0x80131904): String or binary data would be truncated.` In all other cases, this feature should not be enabled. - **Setting the Long Resource Path Key** - The Permission Collection Engine App.config file is `RoleAnalyticsServiceHost.exe.config`, and can be found in the following folder: %SailPoint_Home%\\FileAccessManager[Permission Collection instance]\\ Search for the key `excludeVeryLongResourcePaths` and correct it as described above. # HDS Connector Overview ## Capabilities This connector enables you to use File Access Manager to access and analyze data stored in HDS and do the following: - Analyze the structure of your stored data. - Monitor user activity in the resources. - Classify the data being stored. - Verify user permissions on the resources, and compare them against requirements. - Manage access fulfillment - automated granting and revoking of access - according to rules set in File Access Manager. - Identity collector – collect IAM users, groups and roles and the connections between them. Refer to the File Access Manager documentation for a full description. ## Connector Overview ### Activity Monitor File Access Manager uses the **HNAS** File System Audit to monitor file system events. Once the audit is configured on the HNAS EVS, HNAS starts collecting events, and displays them in a Windows Event Log-like interface. The File Access Manager HDS Activity Monitor remotely connects to the HNAS every 5 seconds to read and process new events, which it then sends to central servers every predefined interval. The system generates events on HNAS only on shares or folders enabled for auditing. HNAS lets you define the event types and logged in users to monitor the **Advanced Security Settings > Auditing** tab of a share or folder. Important Events received from HNAS contain the full physical path of the file, and not the share path. The Activity Monitor periodically correlates all shares and share mapping to physical paths, and translates the physical paths of events to their corresponding share paths. If the physical path is mapped to more than one share, the event is duplicated in all the matching share paths. ### Permissions Collector File Access Manager must first run a crawl process to discover shares and folders on the HNAS. The File Access Manager Permissions Collector service connects remotely to these shares and folders, and analyzes their permissions. ## Monitored Activities The following activities are monitored by the HDS connector: - **Create File** - A new file was created. - **Create Folder** - A new folder was created. - **Create from Move** - A “Create Folder” event generates this event on the newly created folder. - **Create from Rename** - A “Rename Folder” event generates this event on the newly created folder. - **Delete File** - A file was deleted. - **Delete Folder** - A folder was deleted. - **Move File** - A file was moved. - **Move Folder** - A folder was moved. - **Permission Change File** - A file’s permissions were changed. - **Permission Change Folder** - A folder’s permissions were changed. - **Read File** - A file was read. - **Rename File** - A file was renamed. - **Rename Folder** - A folder was renamed. - **Write File** - A file was modified. ## HDS Installation Flow Overview **To install the HDS connector:** 1. Configure all the prerequisites. 1. Add a new HDS application in the Business Website. 1. Install the relevant services: - Activity Monitor - This is the activity collection engine, used by all connectors that support activity monitoring. - Permissions Collector If you are using EC2 login, the collector should be installed on the EC2 instance. - Data Classification Collector Important Installing the permissions collector and data classification services is optional and should only be installed by someone with a full understanding of File Access Manager deployment architecture. The File Access Manager Administrator Guide has additional information on the architecture. ## Supported Versions HDS supports the File System Audit in HNAS version 11 and above. Permissions Collections and Data Classification supports all HNAS versions. # Collecting Data Stored in an External Application ## Terminology - **Connector** - The collection of features, components and capabilities that comprise File Access Manager support for an endpoint. - **Collector** - The “Agent” component or service in a Data Classification and or Permission Collection architecture. - **Engine** - The core service counterpart of this architecture. - **Identity Collector** - A logical component used to fetch identities from an identity store and holds the configuration, settings for that identity store, and the relations between these identities. The identity collector has no “physical” manifest. The actual work is done by the Collector Synchronizer. The list below describes the high level installation process required to collect and analyze data from an external application. Most of these should already be set up in your File Access Manager installation. Refer to the server Installation guide for further details. - **Install a Data Classification central engine** - One or more central engines, installed using the server installer - **Install a Permission Collection central engine** - One or more central engines, installed using the server installer - **Create an Application in File Access Manager** - From the Business Website. The application is linked to central engines listed above. - **Add an Activity Monitor** - To collect activities for this application - run the Collector Installation Manager and add an application under Activity Monitoring. ## Adding Collectors - **Install Permission Collectors and / or Data Classification Collector (optional)** - Optionally, you can install collectors that will run on a separate server and take some of the work from the central PC and DC engines (Where supported). When installing a collector, you attach it to an engine. If no collectors are installed, the central services act as both the engine and the collector. To install a collector, you must have the **RabbitMQ** service installed for communication between the central engines and the collectors. RabbitMQ is installed Note Some cloud connectors ignore collectors connected to the central engine (Box, Dropbox, OneDrive, SharePointOnline, Exchange Online, GoogleDrive). In these applications the task will be done entirely by the engine and not relegated to its collectors. Note For further details, refer to the **Application > Central Service > Collector Relations** section in the File Access Manager Administrator Guide. # Installing Activity Monitor and Collectors Services The Collector Installation Manager is part of the File Access Manager installation package. This tool is used to install the activity monitor, permission collector, and data classification collector. 1. Run the **Collector Installation Manager** as an Administrator. The installation files are in the installation package under the folder Collectors. The Collector Installation Manager window displays. 1. Enter the credentials to connect to File Access Manager. - ServerName/IP should be pointed to the Agent Configuration Manager service server. - A File Access Manager user with Collector Manager permission (permission to install collectors). For Active Directory authentication, use the format domain\\username. 1. Select **Next**. The Service Configuration window displays. 1. If you are installing the Activity Monitor, select the application, and select **Add**. 1. When installing a SharePoint Activity Monitor, you will be prompted for service account credentials. This service account will be used by the Activity Monitor service to run the service and authenticate against the SharePoint IIS servers to fetch the logs (“Log on as”). Make sure the service account provided has local administrator privileges on the local server (hosting the Activity Monitor service) and can access the activity logs on the IIS servers. 1. If you are installing the Permission Collector, select the Central Permission Collector to which to connect this service, and select **Add**. 1. If you are installing the Data Classification, select the Central Classification Collector to which to connect this service, and select **Add**. 1. Select **Next**. The Installation Folder window displays. Note If this is the first time you are installing collectors on this machine, you will be prompted to select an installation folder, in which all future collectors will also be installed. 1. Browse and select the location of the target folder for installation. 1. Browse and select the location of the folder for system logs. 1. Select **Next**. The system begins installing the selected components. 1. Select **Finish**. The Finish button is displayed after all the selected components have been installed. Note The File Access Manager Administrator Guide provides more information on the collector services. # Prerequisites Make sure your system fits the descriptions below before starting the installation. ## Software Requirements File Access Manager requires the latest ASP.NET Core 8.0.x Hosting Bundle. This bundle consists of .NET Runtime and ASP .NET Core Runtime. You can download the latest 8.0.x Hosting Bundle version from [here](https://dotnet.microsoft.com/en-us/download/dotnet/8.0). ## Permissions File Access Manager requires different permissions, based on the tasks to perform. The user configured in the Application configuration wizard must have the following permissions on the HNAS: - Share Read permissions to all shares - Full Control permission for each normalized folder - Member of the local Backup Operators group - Member of the local Administrators group The following detailed explanation describes permissions required by each File Access Manager task: - **Activity Monitoring** - The user must be a member of the local Administrator group on the HNAS. - **Crawling** - The user must have Share Read permissions to all the shares on the HNAS. The user must be a member of the local Backup Operators group on the file HNAS. - **Permission Collection** - The user must have Share Read permissions to all the shares on the HNAS. The user must be member of the local Backup Operators group on the HNAS. The user must be a member of the local Administrators group to read the Share Permissions, and the local Users and Groups of the HNAS. - **Access Fulfillment** - The user must have Full Control permission on the normalized folders to be able to set the permissions. - **Data Classification** - The user must have Share Read permissions for all the shares on the HNAS. The user must be member of the local Backup Operators group on the HNAS. ## Configuring the HNAS Audit Settings 1. Log into the Hitachi NAS console using administrator credentials. 1. Go to **Home > File Services > File System Audit Policies**. 1. Select the EVS for which auditing will be enabled. 1. Select **Add**. The Add File System Audit Policy page opens to display a set of audit policy default settings. 1. Set the maximum log file to a value of at least 8MB (16MB is recommended) in the Audit Log section. 1. Select **New** or **Wrap** (Wrap is recommended) in the **Log roll over policy** section. 1. Select **OK**. 1. Repeat Steps 4 and 5 to enable auditing in additional EVS file systems. ## Configuring the Audit Log Consolidated Cache 1. Log into the Hitachi NAS Admin Services’ EVS using SSH with administrator credentials. 1. Execute the following command to switch from admin EVS to file services EVS: `console-context --evs ` 1. Execute the following command to configure the audit log consolidated cache: `audit-log-consolidated-cache add -s ` For example, in audit-log-consolidated-cache add -s 50MB [file system name], the [file system name] is the name of the EVS file system on which the audit log consolidated cache file is stored. It is recommended that disk space of at least 50 MB be provisioned for an audit log consolidated cache to avoid losing events. It is also recommended that a new file system be created for the audit log consolidated cache. 1. Increase the size of the Event Pool in the EventLogEventCache by running the following command: `fsm set auto-heap-pool-sizeEventLogEventCache::Event 200000` The pool limit can be increased to 200,000, which is enough for a 50 MB audit log consolidated cache. ## Configuring Share Auditing 1. Open Computer Management (run compmgmt.msc). 1. Select **More Actions > Connect to another computer**. 1. Type the IP or DNS of the EVS. 1. Select **OK**. 1. Go to **System Tools > Shared Folders > Shares**. The EVS shares display on the right. 1. Right-click on a share, and select **Properties**. 1. Select the **Security** tab. 1. Select **Advanced**. The Advanced Security Settings window displays. 1. Select the **Auditing** tab. 1. Select **Add** or **Edit** to add/edit users/groups to be audited. 1. Select **Everyone** to make the EVS log events for all users. 1. Select **Success** in the **Type** field. 1. Select **Full Control** in the **Basic Permissions** field. 1. Repeat to audit additional shares. Important To avoid unnecessary overhead, define only those users or groups to be monitored, as well as any actions required for monitoring. (For example, removing Read will result in much less overhead on the HNAS.) HSD may provide more information on how to avoid unnecessary overhead. 1. Generate activity on the shares created in a required file system in order to verify if auditing is enabled on the EVS for that file system. 1. Execute the following command on the Hitachi NAS Console to verify whether the events are generated: `audit-log-show ` ## Communications Requirements | **Requirement** | **Source** | **Destination** | **Port** | | ---------------------------------- | ----------------------------------------------------- | -------------------------- | ------------- | | File Access Manager Message Broker | Permissions Collector / Data Classification Collector | RabbitMQ | 5671 | | File Access Manager Access | Activity Monitor | File Access ManagerServers | 8000-8008 | | Collecting Events | Activity Monitor | HDS | MSRPC (135) | | Permissions Collection | Permissions Collector | HDS | SMB (139/445) | | Data Classification | Data Classification | HDS | SMB (139/445) | # Verifying the HDS Connector Installation ### Installed Services Verify that the services installed for the connector are available and active. Using windows Service manager, or other tool, look for the File Access Manager services, and verify whether they are running. For example: - File Access Manager Central Permissions Collection - `` - File Access Manager Central Activity Monitor - `` - File Access Manager Central Data Classification - `` ### Log Files Check the log files listed below for errors: - `“%SAILPOINT_HOME_LOGS%\ FilesMiniFilter_ .log"` - `“%SAILPOINT_HOME_LOGS%\PermissionCollection_.log"` - `“%SAILPOINT_HOME_LOGS%\DataClassification_.log"` - `“%SAILPOINT_HOME_LOGS%\HDS-.log"` ### Monitored Activities 1. Simulate activities on the HNAS. 1. Wait approximately one minute. 1. Verify that the activities display in the File Access Manager website under **Forensics > Activities**. ### Permissions Collection 1. Run the Crawler and Permissions Collector tasks under **Settings > Task Management > Scheduled Tasks**. 1. Verify that: - The tasks completed successfully - Business resources were created in the resource explorer at **Admin > Applications > [application column] > Manage Resources**. - Permissions display in the Permission Forensics page at **Forensics > Permissions**. # Adding an HDS Application In order to integrate with HDS, we must first create an application entry in File Access Manager. This entry includes the identification, connection details, and other parameters necessary to create the link. To add an application, use the New Application Wizard. 1. Navigate to **Admin** > **Applications**. 1. Select **Add New** to open the New Application Wizard. 1. Select **Standard Application** for the wizard type. 1. Select **Next** to open the **General Details** page. ## General Details - **Application Type** - HDS - **Application Name** - Logical name of the application - **Description** - Description of the application - **Tags** - Select tags for the application from the dropdown menu, and / or type a new name, and select **Enter** to create a new tag. The dropdown list of tags filters out matching tags as you type and displays up to 50 tags. Note The tags replace the Logical container field that was used when creating applications in releases before 8.2. - **Event Manager Server** - This option is available if there are more than one event manager servers configured in the system. Select an event manager from the drop down menu. - **Identity Collector** - Select from the Identity Collector dropdown menu. - You can create identity collectors in the administrative client. Applications > Configuration > Permissions Management > Identity Collectors. Refer to the OOTB Identity Collection section in the Collector Installation Manager File Access Manager Administrator Guide for further details. - If adding a new identity collector, select the **Refresh** button to update the Identity Collector dropdown list. Select **Next** to open the **Connection Details** page. ## Connection Details - **Server Name** - The name of the HNAS filer to which users connect - **Domain Name** - The user defined in the prerequisites - **Username** - The user defined in the prerequisites - **Password** - The user defined in the prerequisites Select **Next**. # Enabling Access Fulfillment for an Application Access fulfillment is enabled per application in the application setting screen, for applications that support fulfillment. Refer to the compatibility table in Compass for the full list. **To enable Access Fulfillment for an application:** 1. Go to **Admin > Applications** to open the **Configuration** page of the required application. 1. Scroll through the list, or use the filter to find the application. 1. Select the **edit** icon on the line of the application. 1. Select **Next** until you reach the **Access Fulfillment** settings page. The setting pages and entry fields vary according to the application type. 1. For non-normalized resources, you can select **Enable Access Fulfillment for Revoking Explicit Permissions**. Refer to Access Fulfillment for Removal of Explicit Permissions. 1. Select **Enable Access Fulfillment for Normalized Groups**. - **Identity Collector** - Fulfillment requires an identity collector in order to run. If you did not select an identity collector in the General Details configuration page, you can select one from the drop down list now. If there is no identity collector defined for this application, or if you want to use a different identity collector than the ones in the dropdown list, you can create a new identity collector in the Administrative Client at **Applications > Configuration > Permissions Management > Identity Collectors**. Refer to Create/Edit an Active Directory Identity Collector for more details on creating an identity collector. - **Managed Group OU (DN)** - The organizational unit in which the managed permission groups will be created. Make sure that the chosen identity collector’s user has permissions to create groups under this location (e.g. OU=FileAccessManagerManaged, DC=SailPoint, DC=COM) - **OU** - Organizational Unit - **DN** - Distinguished Name. - **How to Handle List Folder Contents Permissions** - Create and manage a dedicated permissions group for it. This is the default value. - Revoke these permissions - **How to Handle Inexact Permissions Matches** - During the normalization process, the application has to decide what to do with permissions that do not match the normalized permissions: - Fail the normalization process - Elevate to the nearest permission match - Revoke the permission 1. Open the **Advanced Settings** panel for additional settings: - **Group Cache Sync Interval(sec)** - This setting will add a pause to the process of setting normalize permissions on the resource. This will allow the endpoint's local AD groups cache to sync the newly created managed groups. - The default Is 0 - signifying the process will not pause by default. - **Use Template Permission Group** - Template groups are created per application and added as a template to every managed resource. These groups are not managed by File Access Manager, and are usually used to ensure that users who need application-wide access such as backup or archiving users have access. - Select for each permission group whether File Access Manager should create a group or whether to use an existing group, for the following groups: - List Folder Contents - Read & Execute - Modify - Full Control - If you select **Use an Existing Group**, select the required group to use from the dropdown list. - Once an application is enabled for access fulfillment, you can set specific resources to be normalized using the **Manage Normalized Resources** page. # Configuring Activity Monitoring **To configure the activity monitoring polling parameters:** 1. Go to **Admin > Applications** to open the **Edit** page of the required application. 1. Scroll through the list, or use the filter to find the application. 1. Select the **edit** icon on the line of the application. 1. Select **Next** until you reach the **Activity Configurations & Decs** settings page. **Polling Interval (sec)** - Activity fetching interval [in seconds]). Default is set to 60 seconds, **Report Interval (sec)** - Activity Monitor Health reporting interval [in seconds]). Default is set to 60 seconds. **Local Buffer Size (MB)** - Local buffer size for activities [ in MB]). Default is set to 200MB. This cyclic buffer is used to store activities on the Application Monitor’s machine in case of network errors that prevent the activities from being sent. ## Monitoring Exclusions **To add an exclusion:** 1. Select the dropdown list. 1. Type in an exclusion (file extension, user, folder, etc. as relevant). 1. Select the **+** icon to add this item to the list. 1. After completing the list, select **Next** or **Cancel** to close the panel. **To edit or remove an exclusion from the list:** 1. Select the dropdown list. 1. On the extension to edit or remove, select the **delete** or **edit** icon. 1. Select **Next** or **Cancel** to close the panel. 1. Select **Clear Selection** to clear the entire list. **Excluded File Extensions** - List of file extensions that are not monitored, e.g., `txt`, `exe`. Enter one value at a time as described above. **Exclude Folders** - List of folders that are not monitored, e.g., `\\servername\share1\\folder1`. Enter one value at a time as described above. **Exclude Users** - List of users whose activities are not monitored, e.g., `user1`, `domain\user2`, `user3@domain.com`. Enter one value at a time as described above. Important The user format to be used depends on how the activity is logged by the endpoint. If you are not sure which of the user formats above to use, either specify all of them, or leave the list empty for now, navigate to the **Forensics > Activities** screen in the File Access Manager Website after some activities flow in to view how the user is depicted in them and use that depiction in the exclusion list. ### When an activity from a new resource is detected:(Modes of Storing Activities) - **Full Auto-Learning Mode** – Will audit everything (every action) on every resource. - **Semi Auto-Learning Mode** – Will monitor activities on resources nested under the top-level resources that are marked for Monitoring. This operation mode will also allow the user to select what type of activities are being monitored. Select **Next**. ## Monitored Actions The user has the ability set monitored actions within Manage Resources. 1. Go to **Admin > Applications**. 1. Under the **Actions** column, select the **ellipsis** icon on the desired application. 1. Select **Manage Resources**. The Manage Resources will display with all resources listed. 1. Select **Manage Monitored Actions**. 1. Toggle **Enable Activity Monitoring for this Resource Hierarchy**. The user can now select the type of actions they want monitored. Note All actions are automatically selected initially. ## Configuring Data Enrichment Connectors The Data Enrichment Connectors (DEC) configuration enables us to select data enrichment sources. These can be used to add information from other sources about identities. An enrichment source could be a local HR database that is used to combine users' job descriptions or departments to the information stored in the identity store. 1. Select the data enrichment connectors to enrich monitored activities from the **Available DECs** text box. 1. Use the **>** or **>>** arrows to move the selected DECs to the **Current DECs** text box. The user can select multiple DECs. Simply select each desired DEC. 1. You can create a new DEC in the Administrative Client on the **Applications > Configuration > Activity Monitoring > Data Enrichment Connectors** page. 1. After creating a new DEC, select **Refresh** to refresh the dropdown list. The Connectors chapter of the File Access Manager Administrator Guide provides more information on Data Enrichment Connectors, including what they are, how to configure them, and how they fit in the Activity Flow. # Selecting and Scheduling the Data Classification Settings **To associate an application with a data classification service, and set the schedule:** 1. Go to **Admin > Applications** to open the **Edit** page of the required application. 1. Scroll through the list, or use the filter to find the application. 1. Select the **edit** icon on the line of the application. 1. Select **Next** until you reach the **Data Classification** settings page. The actual entry fields vary according to the application type. **Central Data Classification Service** - Associate the application with a Central Data Classification Service. This service is responsible for running the Data Classification tasks. If the Central Data Classification wasn’t installed during the installation of the server, this field is disabled. **Disabling Data Classification** - To disable data classification, delete the entry from the central data classification field. Disabling data classification can also be achieved by setting the scheduler to be inactive (which is the default setting for data classification). **Create a Schedule** - This option is enabled only if a central data classification service is selected. Refer to [Scheduling a Task](https://documentation.sailpoint.com/fam-connectors/help/nas/hds/add/perm_coll.html#scheduling-a-task). Note Refer to the Data Classification chapter in the File Access Manager Administrator Guide for more information. Select **Next** or **Finish**. ## Data Privacy A user can associate the application with a Central Data Classification Engine Service. This engine will be responsible for executed Data Privacy tasks. Though using different processes for each, the Data Classification engine service is in charge for both Data Privacy and Data Classification discovery tasks. You may choose the same service for both, or use a different one for each, to run them in parallel. Note The fields on the Data Privacy step are the same as the Data Classification step. # Configuring and Scheduling the Permissions Collection Permissions can be analyzed to determine the application permissions of an out-of-the-box application, provided you have defined an identity store for File Access Manager to use in its analysis, and you have run a crawl for the application. The permission collector is a software component responsible for analyzing the permissions in an application. The Central Permission Collector Service is responsible for running the Permission Collector and Crawler tasks. If the “File Access Manager Central Permission Collector” wasn’t installed during the installation of the server, this configuration setting will be disabled. **To configure the Permission Collection:** 1. Go to **Admin > Applications** to open the **Edit** page of the required application. 1. Scroll through the list, or use the filter to find the application. 1. Select the **edit** icon on the line of the application. 1. Select **Next** until you reach the **Crawler & Permissions Collection** settings page. The actual entry fields vary according to the application type. When entering this page in edit mode, you can navigate between the various configuration windows using the **Next** and **Back** buttons. - **Central Permissions Collection Service** - Select a central permission collection service from the dropdown list. You can create permissions collection services as part of the service installation process. Refer to the Services Configuration section in the File Access Manager Administrator Guide for further details. - **Calculate Effective Permissions** - Calculate effective permissions during the permissions collection run. - **Calculate Riskiest Permissions** - Calculates the riskiest permission on a resource – for example, Full Control is riskier than Read permissions if both are on a resource. This option is available when selecting Calculate Effective Permissions - **Skip Identities Sync during Permission Collection** - Skip identity synchronization before running permission collection tasks when the identity collector is common to different connector. Note This option is checked by default. - **Permission Source** - This option is available when selecting **Calculate Effective Permissions**. - NTFS, Share, Both You can now [schedule a task](#scheduling-a-task). ## Scheduling a Task To create a schedule: 1. Select **Create a Schedule**. 1. The system will provide a Schedule Name in the format `{appName} - {type} Scheduler`. Choose to keep or override this suggestion. 1. Select a scheduling frequency from the dropdown list. Schedule Frequency Options - Run After - Create dependency of tasks. The task starts running only upon successful completion of the first task. - Hourly - Set the start time. - Daily - Set the start date and time. - Weekly - Set the day(s) of the week on which to run. - Monthly - Set the day of the month on which to run a task. - Quarterly - Set a monthly schedule with an interval of 3 months. - Half Yearly - Set a monthly schedule with an interval of 6 months. - Yearly - Set a monthly schedule with an interval of 12 months. 1. Fill the Date and Time field with scheduling times. These fields differ depending upon the scheduling frequency selected. 1. Select the **Active** checkbox to activate the schedule. 1. Select **Next**. ## Configuring and Scheduling the Crawler **To set or edit the Crawler configuration and scheduling:** 1. Go to **Admin > Applications** to open the **Edit** page of the required application. 1. Scroll through the list, or use the filter to find the application. 1. Select the **edit** icon on the line of the application. 1. Select **Next** until you reach the **Crawler & Permissions Collection** settings page. The actual entry fields vary according to the application type. **Calculate Resource Size** - Determine when, or at what frequency, File Access Manager calculates the resources' size. Select one of the following: - Never - Always - Second crawl and on (This is the default) **Create a Schedule** - Select to open the Schedule panel. Refer to [Scheduling a Task](#scheduling-a-task). ## Setting the Crawl Scope There are several options to set the crawl scope: - Setting explicit list of resources to include and / or exclude from the scan. - Creating a regex to define resources to exclude. ## Including and Excluding Paths by List **To set the paths to include or exclude in the crawl process for an application:** 1. Go to **Admin > Applications** to open the **Edit** page of the required application. 1. Scroll through the list, or use the filter to find the application. 1. Select the **edit** icon on the line of the application. 1. Select **Next** until you reach the **Crawler & Permissions Collection** settings page. The actual entry fields vary according to the application type. 1. Scroll down to the Crawl configuration settings. 1. Select **Advanced Crawl Scope Configuration** to open the scope configuration panel. 1. Select **Include / Exclude Resources** to open the input fields. 1. To add a resource to a list, type in the full path to include / exclude in the top field and select the **+** icon to add it to the list. 1. To remove a resource from a list, find the resource from the list, and select the **x** icon on the resource row. Note When creating exclusion lists, excludes take precedence over includes. ## Excluding Paths by Regex **To set filters of paths to exclude in the crawl process for an application using regex:** 1. Go to **Admin > Applications** to open the **Edit** page of the required application. 1. Scroll through the list, or use the filter to find the application. 1. Select the **edit** icon on the line of the application. 1. Select **Next** until you reach the **Crawler & Permissions Collection** settings page. The actual entry fields vary according to the application type. 1. Select **Exclude Paths by Regex** to open the configuration panel. 1. Type in the paths to exclude by Regex. Refer to the regex examples in the section below. Since the system does not collect BRs that match this Regex, it also does not analyze them for permissions. ## Crawler Regex Exclusion Example The following are examples of crawler Regex exclusions: ### Exclude all shares which start with one or more shares names | **Example** | **Regex** | | ------------------------------------------------------------------------- | ----------------------------- | | Starting with `\\server_name\shareName` | `\\\\server_name\\shareName$` | | Starting with `\\server_name\shareName` or `\\server_name\OtherShareName` | \`\\\\server_name\\(shareName | ### Include ONLY shares which start with one or more shares names | **Example** | **Regex** | | ------------------------------------------------------------------------- | ---------------------------------- | | Starting with `\\server_name\shareName` | \`^(?!\\\\server_name\\shareName($ | | Starting with `\\server_name\shareName` or `\\server_name\OtherShareName` | \`^(?!\\\\server_name\\(shareName | ### Narrow down the selection | **Example** | **Regex** | | --------------------------------------------------------------- | ---------------------------------- | | Include ONLY the C$ drive shares: `\\server_name\C$` | \`^(?!\\\\server_name\\C$($ | | Include ONLY one folder under a share: `\\server\share\folderA` | \`^(?!\\\\server_name\\share$($ | | Include ONLY all administrative shares | \`^(?!\\\\server_name\\[a-zA-Z]$($ | Note - To write a backslash or a Dollar sign, add a backslash before it as an escape character. - To add a condition in a single command, use a pipe character “|” . ## Excluding Top Level Resources Use the top level exclusion screen to select top level roots to exclude from the crawl. This setting is done per application. **To exclude top level resources from the crawl process:** 1. Go to **Admin > Applications** to open the **Application** page. 1. Find the application to configure and select the drop down menu on the application line. Select **Exclude Top Level Resources** to open the configuration panel. 1. Select **Run Task**. The Run Task button triggers a task that runs a short detection scan to detect the current top level resources. Before running the task for the first time, the following message displays above this button: **Note: Run task to detect the top-level resources**. If the top level resource list has changed in the application while yo u are on this screen, select this button to retrieve the updated structure. Once triggered, you can view the task status on the **Settings > Task Management > Tasks** page Note This will only work if the user has access to the task page When the task has completed, select **Refresh** to update the page with the list of top level resources. 1. Select the top level resource list, and select top level resources to exclude. 1. Select **Save** to save the change. 1. To refresh the list of top level resources, run the task again. Running the task will not clear the list of top level resources to exclude. ## Special Consideration for Long File Paths in Crawl If you need to support long file paths above 4,000 characters for the crawl, set the `excludeVeryLongResourcePaths` flag in the Permission Collection Engine App.config file to `true`. By default this value will be commented out and set to `false`. This key ensures, when enabled, that paths longer than 4000 characters are excluded from the applications’ resource discovery (Crawl), to avoid issues while storing them in the SQLServer database. When enabled, business resources with full paths longer than 4000 characters, and everything included in the hierarchical structure below them, will be excluded from the crawl, and will not be collected by File Access Manager. This scenario is extremely rare. Note You should not enable exclusion of long paths, unless you experience an issue. - **Background** - File Access Manager uses a hashing mechanism to create a unique identifier for each business resource stored in the File Access Manager database. The hashing mechanism in SQLServer versions 2014 and earlier, is unable to process (hash) values with 4,000 or more characters. Though resources with paths of 4000 characters or longer are extremely rare, File Access Manager is designed to handle that limitation. - **Identifying the Problem** - When using an SQL Server database version 2014 and earlier. The following error message in the Permission Collection Engine log file: `System.Data.SqlClient.SqlException (0x80131904): String or binary data would be truncated.` In all other cases, this feature should not be enabled. - **Setting the Long Resource Path Key** - The Permission Collection Engine App.config file is `RoleAnalyticsServiceHost.exe.config`, and can be found in the folder %SailPoint_Home%\\FileAccessManager[Permission Collection instance]\\ Search for the key `excludeVeryLongResourcePaths` and correct it as described above. # NetApp Connector Overview ## Capabilities This connector enables you to use File Access Manager to access and analyze data stored in NetApp and do the following: - Analyze the structure of your stored data. - Monitor user activity in the resources. - Classify the data being stored. - Verify user permissions on the resources, and compare them against requirements. - Manage access fulfillment - automated granting and revoking of access - according to rules set in File Access Manager. - Identity collector – collect IAM users, groups, and roles and the connections between them. Refer to the File Access Manager documentation for a full description. ## Supported Versions - ONTAP 7.3 7-mode and above - ONTAP Cluster mode 8.2 and above, including all 9.x versions. Note Earlier versions of ONTAP may be affected by the following: - Confirmed NetApp bug id 800390: Panic during SCSI compare and write. This issue is resolved in the following ONTAP version and all later releases: - 7-mode 7.3 and above - 8.2.1P1 - 8.2.1P2 - 8.2.2RC1 - 8.2.2RC2 ## Activity Monitor - SailPoint is a NetApp security alliance partner. - To monitor activities on a NetApp filer, **File Access Manager Connector for NetApp** uses the NetApp FPolicy mechanism and registers as an FPolicy server. ## Permissions Collector ### CIFS Shares - File Access Manager connects to CIFS shares using backup semantics (‘seBackup’ privilege). - During the Permissions Collection process, local groups and users are retrieved using the NetApp Ontapi Web API. ### NFS Exports - File Access Manager connects using standard NFSv3 access to analyze UNIX-style folder permissions. - A NIS Identity Collector is used to resolve UIDs/GIDs permissions discovered during the Permissions Collection process. - The NIS Identity Collector is the only selectable option and is required. - Volume information is retrieved using the NetApp Ontapi web API. ## NetApp Architecture and File Access Manager ### 7-mode ONTAPI NetApp - A 7-mode ONTAPI NetApp can work in one of two architectures: a single physical file server or multiple virtual filers hosted on the same physical machine (by using the Multistore feature). - The virtual architecture filers enable hosting multiple virtual file servers on a single physical machine, with all the benefits included in a virtualized environment. - In a physical architecture, there will be a single CIFS server configured on the NetApp. The physical filer will be represented by 2 Applications in File Access Manager: one for CIFS and another for NFS, each with its own set of Activity Monitor / Permissions Collector / Data Classification services. - For both CIFS/NFS, the File Access Manager connector will communicate directly with the CIFS server or the filer IP configured on the physical filer for registering with the FPolicy and calling the Web Ontapi API. - In a virtual architecture, each virtual file server is called Vfiler, and there is a CIFS server configured on every Vfiler. The name of the CIFS server does not have to match the name of the Vfiler. - On a Vfiler architecture, Vfiler0 is the default Vfiler. It represents the physical filer. - Each Vfiler is represented in File Access Manager by two Applications, one for CIFS, and another for NFS, each with its own set of Activity Monitor / Permissions Collector / Data Classification services. - In a virtual architecture, the FPolicy communication as well as the permissions collection and data classification go directly to the CIFS server configured on the Vfiler or the IP address configured for NFS. - The Ontapi API calls go to the management IP (the Vfiler 0 IP), with a destination of the Vfiler name – this mechanism is called **Vfiler tunneling**. - The FPolicy communication between the Activity Monitor service and the NetApp is based on the RPC protocol, and both the Activity Monitor must be installed on a server in the same Active Directory domain as the filer/Vfiler CIFS server. - File Access Manager can be configured to run multiple Activity Monitor services for a single NetApp application. Each Activity Monitor service implements an FPolicy server. For highly loaded environments, it is possible to install multiple Activity Monitors on different servers, which act together as a single logical Activity Monitor in File Access Manager. This architecture is aimed at increasing the number of concurrent events that the NetApp machine can handle by distributing the events between multiple FPolicy servers. Warning This architecture is not recommended unless instructed by File Access Manager professional services. ### NetApp Cluster Mode (cDot) on version 8.2 - On an 8.2 and above cluster mode NetApp, the architecture is the same as in a 7-mode virtual environment hosting multiple Vfilers. - Each virtual server on a clustered NetApp is called Vserver, and there will be a single CIFS server configured on each Vserver. - Each Vserver is represented in File Access Manager by two Applications, one for CIFS, and another for NFS, each with its own set of Activity Monitor/Permissions Collector/Data Classification services. - In a virtual architecture, the FPolicy communication, permission collection, and data classification all go directly to the CIFS server configured on the Vserver or to the IP address configured for NFS. The ONTAPI API call options are: - Using the cluster management IP, with the Vserver name as the destination (a mechanism called **Vserver tunneling**). - Using the Vserver management IP directly. - The FPolicy communication between the Activity Monitor service and the NetApp is based on XML over TCP, where the Activity Monitor acts as the server, and each of the cluster nodes acts as the client. A dedicated unique port must be configured for each Application if multiple Activity Monitor services are on the same server. - File Access Manager can be configured to run multiple Activity Monitor services for a single NetApp application. Each Activity Monitor service implements an FPolicy server. For highly loaded environments, it is possible to install multiple Activity Monitors on different servers, which will act together as a single logical Activity Monitor in File Access Manager. This architecture is aimed at increasing the number of concurrent events that the NetApp machine can handle by distributing the events between multiple FPolicy servers. Warning This architecture is not recommended unless instructed by File Access Manager professional services. ## NetApp Installation Flow Overview **To install the NetApp connector:** 1. Configure all the prerequisites. 1. Add a new NetApp application in the Business Website. 1. Install the relevant services: - Activity Monitor: This is the activity collection engine, used by all connectors that support activity monitoring. - Permissions Collector: If you are using EC2 login, the collector should be installed on the EC2 instance. - Data Classification Collector Important Installing the permissions collector and data classification services is optional and should only be installed by someone with a full understanding of File Access Manager deployment architecture. The File Access Manager Administrator Guide has additional information on the architecture. # Collecting Data Stored in an External Application ## Terminology: **Connector** - The collection of features, components, and capabilities that comprise File Access Manager support for an endpoint. **Collector** - The “Agent” component or service in a Data Classification and/or Permission Collection architecture. **Engine** - The core service counterpart of this architecture. **Identity Collector** - A logical component used to fetch identities from an identity store and holds the configuration, settings for that identity store, and the relations between these identities. - The identity collector has no “physical” manifest. - The actual work is done by the Collector Synchronizer. The list below describes the high-level installation process required to collect and analyze data from an external application. Most of these should already be set up in your File Access Manager installation. Refer to the server Installation guide for further details. **Install a Data Classification central engine** - One or more central engines, installed using the server installer. **Install a Permission Collection central engine** - One or more central engines, installed using the server installer. **Create an Application in File Access Manager** - From the Business Website. The application is linked to the central engines listed above. **Add an Activity Monitor** - To collect activities for this application - run the Collector Installation Manager and add an application under Activity Monitoring. ## Adding Collectors ### Install Permission Collectors and/or Data Classification Collector (optional) Optionally, you can install collectors that will run on a separate server and take some of the work from the central PC and DC engines (where supported). When installing a collector, you attach it to an engine. If no collectors are installed, the central services act as both the engine and the collector. To install a collector, you must have the **RabbitMQ** service installed for communication between the central engines and the collectors. RabbitMQ is installed. Note Some cloud connectors ignore collectors connected to the central engine. (Box, Dropbox, OneDrive, SharePointOnline, Exchange Online, GoogleDrive). In these applications, the task will be done entirely by the engine, and not relegated to its collectors. Note For further details, refer to the **Application > Central Service > Collector Relations** section in the File Access Manager Administrator Guide. # Installing Activity Monitor and Collectors Services The Collector Installation Manager is part of the File Access Manager installation package. This tool is used to install the activity monitor, permission collector, and data classification collector. 1. Run the **Collector Installation Manager** as an Administrator. The installation files are in the installation package under the folder **Collectors**. The **Collector Installation Manager** window displays. 1. Enter the credentials to connect to File Access Manager. - ServerName/IP should point to the Agent Configuration Manager service server. - A File Access Manager user with Collector Manager permission (permission to install collectors). For Active Directory authentication, use the format domain\\username. 1. Select **Next**. The **Service Configuration** window displays. 1. If you are installing the Activity Monitor, select the application, and select **Add**. 1. When installing a SharePoint Activity Monitor, you will be prompted for service account credentials. This service account will be used by the Activity Monitor service to run the service and authenticate against the SharePoint IIS servers to fetch the logs (“Log on as”). Ensure the service account provided has local administrator privileges on the local server (hosting the Activity Monitor service) and can access the activity logs on the IIS servers. 1. If you are installing the Permission Collector, select the **Central Permission Collector** to which to connect this service, and select **Add**. 1. If you are installing the Data Classification, select the **Central Classification Collector** to which to connect this service, and select **Add**. 1. Select **Next**. The **Installation Folder** window displays. Note If this is the first time you are installing collectors on this machine, you will be prompted to select an installation folder, in which all future collectors will also be installed. 1. Browse and select the location of the target folder for installation. 1. Browse and select the location of the folder for **system logs**. 1. Select **Next**. The system begins installing the selected components. 1. Select **Finish**. The **Finish** button is displayed after all the selected components have been installed. Note The File Access Manager Administrator Guide provides more information on the Collector services. # Adding a New Bulk Application (CIFS Only) To add NetApp CIFS applications in bulk, use the **New Application Wizard** in the admin client. 1. Log into the File Access Manager admin client and go to **Applications > New > Bulk Application**. The **New Bulk Application Wizard** window displays under the **Welcome** tab. 1. Select **NetApp CIFS**. 1. Select **Download Template** and download the bulk installation Excel template. Each application type has a different template. 1. Fill in a new row in the template for each application to be installed. In the multiple selection fields, such as **Cluster Mode** and **Multiple FPolicy Servers**, you can select valid options from the drop-down list in the Excel file. 1. Select **Save** to save the template file. 1. In the wizard, select **Browse** and select the template you filled out. 1. Select **Upload** to upload the template. Once the template is uploaded, the **Upload Status** table contains a row for each application in the template. 1. If there are errors displayed in the **Upload Status** table, correct the parameters and upload the template again. This stage is for validation only. Applications with errors will be ignored and won't be created. 1. Select **Next**. The **Permissions Collection** window of the **New Bulk Applications Wizard** displays under the **Scheduling** tab. Note You can navigate among the **Permissions Collection** and **Crawler scheduling** windows (under the **Scheduling** tab) using the **Next** and **Back** buttons. Note A schedule is created for each application with the name: **PermissionsCollection\_ Task**, with the same details. ## Scheduling Tasks In the next configuration screens, you can schedule tasks to collect and analyze the BRs in the connected servers. The scheduling includes: - Permissions Collector - Crawler - Automatic application crawling to find new resources - Data Classification - To classify your results You can now [schedule a task](#scheduling-a-task). ## Scheduling a Task To create a schedule: 1. Select **Create a Schedule**. 1. The system will provide a Schedule Name in the format `{appName} - {type} Scheduler`. Choose to keep or override this suggestion. 1. Select a scheduling frequency from the dropdown list. Schedule Frequency Options - Run After - Create dependency of tasks. The task starts running only upon successful completion of the first task. - Hourly - Set the start time. - Daily - Set the start date and time. - Weekly - Set the day(s) of the week on which to run. - Monthly - Set the day of the month on which to run a task. - Quarterly - Set a monthly schedule with an interval of 3 months. - Half Yearly - Set a monthly schedule with an interval of 6 months. - Yearly - Set a monthly schedule with an interval of 12 months. 1. Fill the Date and Time field with scheduling times. These fields differ depending upon the scheduling frequency selected. 1. Select the **Active** checkbox to activate the schedule. 1. Select **Next**. Note Refer to the Crawling chapter in the File Access Manager Administrator Guide for more information on the crawling mechanism. Select **Next** and **Back** to navigate between the screens. ## Completing the Installation 1. After the **Data Classification** screen, select **Next**. Note The applications are created at this stage. The **Application Creation Status** window of the **New Bulk Applications Wizard** displays under the **Status** tab. A table lists the creation status of each application. 1. Select **Next**. The **Installation File** window of the **New Bulk Applications Wizard** displays. 1. Browse to select the destination for the .zip file, which contains the files required to install the Activity Monitor / Permissions Collector / Data Classification services for each application. A text file with the command line for remote installation of the Activity Monitor connector is also created. This file can be used for unattended installations of the Activity Monitor. Refer to Activity Monitor Bulk/Unattended Installation for further information. 1. Select **Finish**. # Prerequisites Make sure your system fits the descriptions below before starting the installation. ## Software Requirements File Access Manager requires the latest ASP.NET Core 8.0.x Hosting Bundle. This bundle consists of .NET Runtime and ASP .NET Core Runtime. You can download the latest 8.0.x Hosting Bundle version from [here](https://dotnet.microsoft.com/en-us/download/dotnet/8.0). ## Permission Requirements File Access Manager requires different permissions, based on the tasks performed. The following listing describes the required permissions by File Access Manager task, in addition to the permissions described in sections 4.3, 54, or 6.3: **Activity Monitoring** - Refer to the additional information in the Permissions section of the relevant configuration (Physical 7-Mode/Virtual 7-Mode/Cluster Mode). ### CIFS Access Permissions **Crawling** - Requires a user with Share Read permission to all shares. **Permission Collection** - Requires a user with Share Read permission to all shares. - Enumeration of CIFS Share-Level Permissions - Refer to the additional information in the Permissions section of the relevant configuration (Physical 7-Mode/Virtual 7-Mode/Cluster Mode). - Enumeration of local Users and Groups - Refer to the additional information in the Permissions section of the relevant configuration (Physical 7-Mode/Virtual 7-Mode/Cluster Mode). **Data Classification** - Requires a user with Share Read permission to all shares. ### NFS Access Permissions **Crawling** - Requires a user with permission to mount all NFS exports on the virtual NFS server. - Requires a user with (a) read permission for all files, and (b) execute permission for all directories on the virtual NFS server. **Permission Collection** - Requires a user with permission to mount all NFS exports on the virtual NFS server. - Requires a user with (a) read permission for all files, and (b) execute permission for all directories on the virtual NFS server. **Data Classification** - Requires a user with permission to mount all NFS exports on the virtual NFS server. - Requires a user with (a) read permission for all files, and (b) execute permission for all directories on the virtual NFS server. ## NetApp Physical Filer 7-Mode Requirements 1. The monitor server is required to be in the same segment and AD Domain of the NetApp. No firewalls can be in the middle. 1. The Activity Monitor service must run with the dedicated user described in section [Physical Filer 7-Mode Permissions](#physical-filer-7-mode-permissions). ### Physical Filer 7-Mode Policy Definitions Note The configuration below is for CIFS filers. 1. To configure monitoring for NFS, repeat step 2 and replace `whitebox_cifs` with `whitebox_nfs`. 1. Run the following commands in the NetApp: `options fpolicy.enable on` `fpolicy create whitebox_cifs screen` `fpolicy options whitebox_cifs required off` `fpolicy options whitebox_cifs cifs_disconnect_check on` `fpolicy options whitebox_cifs serverprogress_timeout 1` `fpolicy options whitebox_cifs reqcancel_timeout 1` `fpolicy options whitebox_cifs cifs_setattr on` `fpolicy enable whitebox_cifs` 1. It is recommended to include only the required volumes to be monitored by fpolicy to reduce load from the NetApp machine. 1. To include only specific volumes to be monitored, run the following command: `fpolicy volume include add whitebox_cifs ` Note `` must be the short volume name as shown in the volume status command, without the /vol/ prefix. ### Physical Filer 7-Mode Permissions **To configure required permission for all File Access Manager tasks:** 1. Create a dedicated domain user for the filer (for example, `SIQ_`). This user will be used in the application configuration, and must also be the user running the Activity Monitor service. 1. This user must be a member of the Backup Operators and Power Users groups on the NetApp and an administrator on the server running the Activity Monitor service. 1. Run the following commands in the NetApp physical filer to grant the File Access Manager user permissions to access the Ontapi web API. Replace **``** with the domain name and **`siq_`** with the correct user name: `useradmin role add siq_netapp_role -a login-http-admin,api-nfs-exportfs-list-rules,api-cifs-share-list-iter-start,api-cifs-share-list-iter-next,api-cifs-share-list-iter-end,api-cifs-share-acl-list-iter-start,api-cifs-share-acl-list-iter-next,api-cifs-share-acl-list-iter-end,api-qtree-list,api-useradmin-group-list,api-useradmin-user-list,security-api-vfiler,api-system*,api-useradmin-domainuser-list, api-fpolicy-list-info,api-fpolicy-get-policy-options,api-volume-list-info,api-fpolicy-volume-list-info` `useradmin group add siq_group -r siq_netapp_role` `useradmin domainuser add \siq_ -g siq_group,"Backup Operators","Power Users"` Internal Note 1. [CVE-2016-2183 TLS Protocol 64-bit Cipher Vulnerability in Multiple NetApp Products](https://security.netapp.com/advisory/ntap-20160915-0001/) 1. [Disabling TLS 1.0 on your Windows 2008 R2 server – just because you still have one](https://blogs.msdn.microsoft.com/friis/2016/07/25/disabling-tls-1-0-on-your-windows-2008-r2-server-just-because-you-still-have-one/) ### Physical Filer 7-Mode Communications Requirements | **Requirement** | **Source** | **Destination** | **Port** | | ---------------------------------- | --------------------------------------------------- | --------------------------- | ------------------------- | | File Access Manager Message Broker | Permissions Collector/Data Classification Collector | RabbitMQ | 5671 | | File Access Manager Access | Activity Monitor | File Access Manager Servers | 8000-8008 | | NetApp CIFS Access | Activity Monitor | NetApp | RPC (135 + Dynamic) | | NetApp fpolicy | NetApp filer | Activity Monitor | MSRCP (139) | | NetApp fpolicy | Activity Monitor | NetApp | MSRPC (139) | | NetApp Web API | Activity Monitor/Permissions Collector | NetApp | 443 (https) | | NetAPP NFS Access | Permissions Collector/Data Classification | NetApp | UDP/TCP 111, 2049 (NFSv3) | ## NetApp Virtual Filer 7-Mode Requirements - The activity monitor server is required to be in the same segment and AD Domain of the NetApp. No firewalls can be in the middle. - The Activity Monitor service must run with the dedicated user described in section Virtual Filer 7-Mode Permissions. ### Ontapi API Configuration Options When working with 7-mode, there are two configuration options, which affect how the connector communicates with the NetApp ONTAPI API: 1. A single physical filer: there are no vFilers defined on NetApp, and there’s only one filer. In this configuration, communications are made directly with the filer. 1. vFilers (Multiple logical filers): there is more than one logical filer defined on the NetApp storage, with the original named vFiler0 (vFiler Zero). With vFilers, ONTAPI communications pass through vFiler0, and targeted at the correct vFiler using its name. ### Virtual Filer 7-mode FPolicy Definitions 1. The configuration below is for CIFS filers. To configure monitoring for NFS, repeat step 2 and replace whitebox_cifs with whitebox_nfs 1. Run the following commands in the NetApp vfiler: `vfiler context vfilername` `options fpolicy.enable on` `fpolicy create whitebox_cifs screen` `fpolicy options whitebox_cifs required off` `fpolicy options whitebox_cifs cifs_disconnect_check on` `fpolicy options whitebox_cifs serverprogress_timeout 1` `fpolicy options whitebox_cifs reqcancel_timeout 1` `fpolicy options whitebox_cifs cifs_setattr on` 1. To start fpolicy, run: `fpolicy enable whitebox_cifs` 1. It is recommended to include only the required volumes to the monitored by FPolicy to reduce load from the NetApp machine. To include only specific volumes to be monitored, run the following command: `fpolicy volume include add whitebox_cifs ` Note `` must be the short volume name as shown in the ‘volume status’ command, without the /vol/ prefix ### Virtual Filer 7-Mode Permissions **To configure the required permission for all File Access Manager tasks:** 1. When monitoring a vfiler, File Access Manager uses vfiler tunneling for the NetApp Web API. 1. The tunneling can work if the vfiler and vfiler0 (the physical filer is called vfiler0. "vfiler zero") are in the same domain or vfiler0 can resolve users from the vfiler domain. 1. If vfiler0 is not in any domain or cannot resolve the domain user, create a local user on vfiler0, and follow the steps described in section [Configuring a Local NetApp User for the Ontapi API](#configuring-a-local-netapp-user-for-the-ontapi-api) after the Activity Monitor and Permissions Collector installation. 1. Create a dedicated domain user for the filer. This user will be used later in the application configuration, and must also be the user running the Activity Monitor service. - `siq_` must be part of the domain. - In the commands below, replace **``** with the domain name and **`siq_`** with the correct username. - This user must be a member of the Backup Operators and Power Users groups in the NetApp (the command to add the user to the group is part of the sequence below). - This user must be an administrator on the server running the Activity Monitor service. 1. Decide if a local user is required on vfiler0 according to the previous sections. If you are not sure, consult with your File Access Manager technical support. 1. If a local user is required, name it SIQ_VFILER0. 1. These commands need to run only once, when the first vfiler is configured. For subsequent vfilers, the role and group will be present and this step can be skipped. 1. Run the commands below in the NetApp vfiler0 (vfiler zero) to grant the File Access Manager user permissions to access the Ontapi Web API. - Replace with the domain name and **siq\_** with the correct user name: `useradmin role add siq_netapp_role -a login-http-admin,api-nfs-exportfs-list-rules,api-cifs-share-list-iter-start,api-cifs-share-list-iter-next,api-cifs-share-list-iter-end,api-cifs-share-acl-list-iter-start,api-cifs-share-acl-list-iter-next,api-cifs-share-acl-list-iter-end,api-qtree-list,api-useradmin-group-list,api-useradmin-user-list,security-api-vfiler,api-system*,api-useradmin-domainuser-list, api-fpolicy-list-info,api-fpolicy-get-policy-options,api-volume-list-info,api-fpolicy-volume-list-info` `useradmin group add siq_group -r siq_netapp_role` `vfiler context vfiler0` `useradmin domainuser add \siq_ -g siq_group,"Backup Operators","Power Users"` 1. If this is the first vfiler added for monitoring, a local user is needed. Run the following command: `useradmin user add siq_VFILER0 -g siq_group` Note If this is NOT the first vfiler added for monitoring then the user is present and is associated with the group. This step can be skipped. 1. After the command is completed, assign a password for the local user. ### Configuring a Local NetApp User for the Ontapi API Note Make sure you have the password for the NetApp local user created as explained in the Permissions section 1. Go to the **File Access Manager** installation folder on one of the File Access Manager central servers. 1. Open the folder "%SAILPOINT_HOME%\\FileAccessManager\\Server Installer\\Tools\\EncryptStringForService". 1. Copy the content of the folder to the server on which the Activity Monitor service is installed. 1. Run **EncryptStringForService.exe** [password to encrypt]. 1. Copy the output of the command. #### Activity Monitor 1. Go to the **Activity Monitor** installation folder 1. Edit the Activity **BAMFramework.exe.config**. 1. Enter the name of the user in the alternativeUserName key: `` 1. Paste the output of the command copied in Section 5 into the value of the alternativeUserPassword key: `` 1. Restart the Activity Monitor service. #### Permission Analysis 1. Go to the **Permission Analysis** installation folder. 1. Edit the **RoleAnalyticsServiceHost.exe.config**. 1. Enter the name of the user in the netAppApiPassword key: `` 1. Paste the output of the command copied in Section 5 into the value of the netAppApiPassword key: `` ### Required Data for Creating a NetApp Application - CIFS Server name - VFILER IP address - VFILER name - An internal name, usually the same as the normal vfiler host name - Local user name and password - If the vfiler0 (vfiler zero) is not in any domain or cannot resolve the user ### Physical Filer 7-Mode Communications Requirements | **Requirement** | **Source** | **Destination** | **Port** | | -------------------------- | -------------------------------------------------------------- | --------------------------- | ------------------------- | | File Access Manager | Permissions Collector/Data Classification Collector | RabbitMQ | 5671 | | File Access Manager Access | Activity Monitor | File Access Manager Servers | 8000-8008 | | NetApp Access | Activity Monitor / Permissions Collector / Data Classification | NetApp VFILER | MSRPC (135 + Dynamic) | | NetApp fpolicy | NetApp VFILER | Activity Server | MSRCP (139) | | NetApp fpolicy | Activity Monitor | NetApp VFILER | MSRPC (139) | | NetApp Web API | Permissions Collector / Activity Monitor | NetApp VFILER ZERO | 443 (https) | | NetApp NFS Access | Permissions Collector | NetApp VFILER | UDP/TCP 111, 2049 (NFSv3) | ## NetApp 8.2+ Cluster Mode Requirements According to the NetApp Architecture and File Access Manager section, each Vserver is represented as a single Application in File Access Manager. If multiple Activity Monitor services are installed on the same server, each Application must be configured with a unique dedicated port, which is the port the Activity Monitor receives the FPolicy communication. Important The monitor server is required to be in the same segment. No firewalls can be in the middle. 1. Create a domain user for the monitor: For example, siq_vservername. Small lowercase is recommended. 1. Verify the case in which the user name is written AD. This field is case sensitive. 1. Each Vserver requires its own monitor installed. ### Cluster Mode FPolicy Definitions In the commands below, replace the parameters with the required values: - **[vserver_name]** - The name of the vserver. - **[monitors server ip]** - The ip address of the server where the Activity Monitor service is installed. - **[port number]** - The port number configured in the Application configuration wizard in section 7. - **[volume names to include]** - Replace with * if all volumes need to be monitored, or enter a list of volumes to monitor. - **[running number]** - A sequential number of the policy in the policy hierarchy. If no FPolicy is defined, this should be 1. **To configure FPolicy for CIFS:** `fpolicy policy event create -event-name siq_cifs_events -protocol cifs -file-operations create, create_dir, delete, delete_dir, read, write, rename, rename_dir, setattr, open -vserver [vserver_name] -filters first-read, first-write, open-with-delete-intent` `fpolicy policy external-engine create -vserver [vserver_name] -engine-name siq_cifs_engine -primary-servers [monitors server ip] -port [port_number] -extern-engine-type asynchronous -ssl-option no-auth` `fpolicy policy create -vserver [vserver_name] -policy-name wbx_cifs_policy -events siq_cifs_events -engine siq_cifs_engine -is-mandatory false` `fpolicy policy scope create -vserver [vserver_name] -policy-name wbx_cifs_policy -volumes-to-include [* or volume names to include]` `fpolicy enable -vserver [vserver_name] -policy-name wbx_cifs_policy -sequence-number [running_number]` **To configure FPolicy for NFS:** `fpolicy policy event create -event-name siq_nfs3_events -protocol nfsv3 -file-operations create, create_dir, delete, delete_dir, read, write, rename, rename_dir, setattr -vserver [vserver_name]` `fpolicy policy event create -event-name siq_nfs4_events -protocol nfsv4 -file-operations create, create_dir, delete, delete_dir, read, write, rename, rename_dir, setattr -vserver [vserver_name]` `fpolicy policy external-engine create -vserver [vserver_name] -engine-name siq_nfs_engine -primary-servers [monitors server ip] -port [port_number] -extern-engine-type asynchronous -ssl-option no-auth` `fpolicy policy create -vserver [vserver_name] -policy-name wbx_nfs_policy -events siq_nfs3_events, siq_nfs4_events -engine siq_nfs_engine -is-mandatory false -allow-privileged-access yes -privileged-user-name [domain\user_name]` `fpolicy policy scope create -vserver [vserver_name] -policy-name wbx_nfs_policy -volumes-to-include [* or volume names to include]` `fpolicy enable -vserver [vserver_name] -policy-name wbx_nfs_policy -sequence-number [running_number]` Note If multiple activity monitors are installed on the same server, set a unique port per vserver, and replace [port_number] with the value configured in the Application. ### Cluster Mode Permissions 1. Create a new role for File Access Manager. `security login role create -role siq_netapp_role_82 -cmddirname "vserver cifs share access-control" -access readonly -vserver ` `security login role create -role siq_netapp_role_82 -cmddirname "vserver cifs share" -access readonly -vserver ` `security login role create -role siq_netapp_role_82 -cmddirname "vserver cifs users-and-groups local-group" -access readonly -vserver ` `security login role create -role siq_netapp_role_82 -cmddirname "vserver cifs users-and-groups local-group show-members" -access readonly -vserver ` `security login role create -role siq_netapp_role_82 -cmddirname "vserver cifs users-and-groups local-user" -access readonly -vserver ` `security login role create -role siq_netapp_role_82 -cmddirname "vserver fpolicy engine-connect" -vserver ` `security login role create -role siq_netapp_role_82 -cmddirname "vserver fpolicy engine-disconnect" -vserver ` `security login role create -role siq_netapp_role_82 -cmddirname "vserver fpolicy show-engine" -access readonly -vserver ` `security login role create -role siq_netapp_role_82 -cmddirname "vserver services name-service unix-group" -access readonly -vserver ` `security login role create -role siq_netapp_role_82 -cmddirname "vserver services name-service unix-user" -access readonly -vserver ` `security login role create -role siq_netapp_role_82 -cmddirname "volume qtree" -access readonly -vserver ` `security login role create -role siq_netapp_role_82 -cmddirname "volume" -access readonly -vserver ` `security login role create -role siq_netapp_role_82 -cmddirname "vserver fpolicy policy scope" -access readonly -vserver ` `security login role create -role siq_netapp_role_82 -cmddirname "vserver fpolicy show" -access readonly -vserver ` `security login role create -role siq_netapp_role_82 -cmddirname "vserver fpolicy policy" -access readonly -vserver ` `security login role create -role siq_netapp_role_82 -cmddirname "vserver fpolicy policy external-engine" -access readonly -vserver ` Note `` = The Vserver name configured in NetApp settings. Note If the File Access Manager Application is configured to use Vserver Tunneling, run these commands at the cluster level without the -vserver parameter. However, if the File Access Manager Application is configured to use the Vserver directly, run these commands at the Vserver level without the -vserver parameter, or at the cluster level with the -vserver parameter. 1. Create a new user for File Access Manager, and assign to the newly created role: `security login create -vserver -username -application ontapi -authmethod domain -role siq_netapp_role_82` Important Domain and user_name must be configured with the same case as configured in the Application configuration. Important The username must be in the same case as defined in Active Directory. This is a known NetApp issue. 1. Add the new user to the **Backup Operators** security group on each virtual CIFS server. 1. Add the new user to the **Power Users** security group on each virtual CIFS server. 1. If no domain-tunnel is configured, run the following command (this command should be run only once, and not for each vserver): `security login domain-tunnel create –vserver [vserver_name]` Important If the domain-tunnel cannot be configured, authentication to the NetApp Web API will fail with the Active Directory user configured in the Application configuration. Note It is possible to define an alternative local NetApp user to use instead of the user defined in the application configuration. Refer to [Configuring a Local NetApp User for the Ontapi API](#configuring-a-local-netapp-user-for-the-ontapi-api) for detailed instructions. ### Communications Requirements | **Requirement** | **Source** | **Destination** | **Port** | | ---------------------------------- | ----------------------------------------------------- | ---------------------------- | ---------------------------------------------------------------------------------------- | | File Access Manager Message Broker | Permissions Collector / Data Classification Collector | RabbitMQ | 5671 | | File Access Manager Access | Activity Monitor | File Access Manager Servers | 8000-8008 | | NetApp Access | Each NetApp Cluster Nodes | Activity Monitor | MSRPC + The port defined in the FPolicy definition (12000, or the specific port defined) | | NetApp Web API | Activity Monitor / Permissions Collector | NetApp Cluster Management IP | 443 (https) | | NetApp NFS Access | Permissions Collector / Data Classification | NetApp | UDP/TCP 111, 2049 (NFSv3) | ## NetApp OnTap 9.X Command Template 1. Create a new role for File Access Manager for the CIFS vserver. For example, fam_netapp_role. 1. Replace (v_server) with CIFS vserver from cluster. 1. Replace (cluster) with cluster name. `security login role create -role fam_netapp_role -cmddirname "vserver cifs share access-control" -vserver (v_server) -access readonly` `security login role create -role fam_netapp_role -cmddirname "vserver cifs share" -vserver (v_server) -access readonly` `security login role create -role fam_netapp_role -cmddirname "vserver cifs users-and-groups local-group" -vserver (v_server) -access readonly` `security login role create -role fam_netapp_role -cmddirname "vserver cifs users-and-groups local-group show-members" -vserver (v_server) -access readonly` `security login role create -role fam_netapp_role -cmddirname "vserver cifs users-and-groups local-user" -vserver (v_server) -access readonly` `security login role create -role fam_netapp_role -cmddirname "vserver fpolicy engine-connect" -vserver (v_server)` `security login role create -role fam_netapp_role -cmddirname "vserver fpolicy engine-disconnect" -vserver (v_server)` `security login role create -role fam_netapp_role -cmddirname "vserver fpolicy show-engine" -vserver (v_server) -access readonly` `security login role create -role fam_netapp_role -cmddirname "vserver services name-service unix-group" -vserver (v_server) -access all` `security login role create -role fam_netapp_role -cmddirname "vserver services name-service unix-user" -vserver (v_server) -access readonly` `security login role create -role fam_netapp_role -cmddirname "volume qtree" -vserver (v_server) -access readonly` `security login role create -role fam_netapp_role -cmddirname "volume" -vserver (v_server) -access readonly` `security login role create -role fam_netapp_role -cmddirname "vserver fpolicy policy scope" -vserver (v_server) -access readonly` `security login role create -role fam_netapp_role -cmddirname "vserver fpolicy show" -vserver (v_server) -access readonly` 1. Create a new role for file access manager for the cluster (use cluster name for -vserver switch). `security login role create -role fam_netapp_role -cmddirname "vserver cifs share access-control" -vserver (cluster) -access readonly` `security login role create -role fam_netapp_role -cmddirname "vserver cifs share" -vserver (cluster) -access readonly` `security login role create -role fam_netapp_role -cmddirname "vserver cifs users-and-groups local-group" -vserver (cluster) -access readonly` `security login role create -role fam_netapp_role -cmddirname "vserver cifs users-and-groups local-group show-members" -vserver (cluster) -access readonly` `security login role create -role fam_netapp_role -cmddirname "vserver cifs users-and-groups local-user" -vserver (cluster) -access readonly` `security login role create -role fam_netapp_role -cmddirname "vserver fpolicy engine-connect" -vserver (cluster)` `security login role create -role fam_netapp_role -cmddirname "vserver fpolicy engine-disconnect" -vserver (cluster)` `security login role create -role fam_netapp_role -cmddirname "vserver fpolicy show-engine" -vserver (cluster) -access readonly` `security login role create -role fam_netapp_role -cmddirname "vserver services name-service unix-group" -vserver (cluster) -access all` `security login role create -role fam_netapp_role -cmddirname "vserver services name-service unix-user" -vserver (cluster) -access readonly` `security login role create -role fam_netapp_role -cmddirname "volume qtree" -vserver (cluster) -access readonly` `security login role create -role fam_netapp_role -cmddirname "volume" -vserver (cluster) -access readonly` `security login role create -role fam_netapp_role -cmddirname "vserver fpolicy policy scope" -vserver (cluster) -access readonly` `security login role create -role fam_netapp_role -cmddirname "vserver fpolicy show" -vserver (cluster) -access readonly` 1. Assign the newly created role to the domain user created for fam (Upper and lower case are important.) `security login create -vserver (cluster) -username domain\domainAccountFam -application ontapi -authmethod domain -role fam_netapp_role` `security login create -vserver (v_server) -username domain\domainAccountFam -application ontapi -authmethod domain -role fam_netapp_role` 1. Domain user must be a member of the **Backup Operators** group on the VServer. Execute the below command for the Vserver you intend to on-board. `vserver cifs users-and-groups local-group add-members -vserver (v_server) -group-name "BUILTIN\Backup Operators" -member-names domain\domainAccountFam` 1. Domain user to be a member of the **Power Users** group on the Vserver. Execute the below command for the Vserver you intend to on-board `vserver cifs users-and-groups local-group add-members -vserver (v_server) -group-name "BUILTIN\Power Users" -member-names domain\domainAccountFam` 1. If no domain-tunnel is configured, run the following command (this command should be run only once, and not for each vserver): `security login domain-tunnel create -vserver (v_server)` 1. CIFS Access: - User account should have Share Read permission to all shares. - Requires a user with Share Read permission to all shares - Should be able to enumerate CIFS Share-Level Permissions - Should be able to enumerate local Users and Groups 1. Domain user must be an administrator (local administrator) on the server running the Activity Monitor service. 1. Execute the commands to configure a fpolicy for CIFS server. `fpolicy policy event create -event-name fam_cifs_events -protocol cifs -file-operations create,create_dir,delete,delete_dir,read,write,rename,rename_dir,setattr,open -vserver (v_server) -filters first-read,first-write,open-with-delete-intent` Note IP for the SailPoint Activity Mornitor server should be used in place of x.x.x.x. `fpolicy policy external-engine create -vserver (v_server) -engine-name fam_cifs_engine -primary-servers x.x.x.x -port 12000 -extern-engine-type asynchronous -ssl-option no-auth` `fpolicy policy create -vserver (v_server) -policy-name wbx_cifs_policy -events fam_cifs_events -engine fam_cifs_engine -is-mandatory false` `fpolicy policy scope create -vserver (v_server) -policy-name wbx_cifs_policy -volumes-to-include *` `fpolicy enable -vserver (v_server) -policy-name wbx_cifs_policy -sequence-number 1` # Troubleshooting Check the issues below for common problems and suggested ways of handling them. ## What to Do if Events Are Not Collected ### NetApp 7-mode 1. In the relevant vfiler context in NetApp, run the command: `fpolicy show [whitebox_cifs_policy]` or `[whitebox_nfs_policy]` depending on the application type. 1. Verify that the Activity Monitor server is connected as an FPolicy server. 1. If the FPolicy server is registered, simulate some activity and run the command again. - Look at the counters at the end of the output of the command. They should increase. - If they don't increase, there might be an issue with the definition of the included volumes. - If the name of the included volume is incorrect, no events will be sent by NetApp. 1. If the Activity Monitor is not registered as an FPolicy server, stop the activity monitor service, wait for 60 seconds, and then start the activity monitor service again. Note In some cases, it might take a while for NetApp to de-register the FPolicy server in case of an error. 1. Run the command again and make sure the FPolicy server is registered. 1. If the FPolicy server is not registered, verify the following: - The Activity Monitor service is running with a domain user who is a local administrator on the server running the Activity Monitor. - The user running the Activity Monitor service is a member of the Backup Operators local group on the filer/vfiler. - The Activity Monitor server is in the same domain as the server running the Activity Monitor service. - The clocks of the server running the Activity Monitor and the NetApp clock are accurate within 5 minutes. A larger difference might cause the RPC Kerberos authentication process to fail. - There is no firewall between the NetApp and the server running the Activity Monitor, and the Windows Firewall is off on the server running the Activity Monitor. 1. If all prerequisites are set, look for errors in the Activity Monitor logs indicating connection issues with the FPolicy server. Also, check for messages in the NetApp logs indicating whether the FPolicy server failed to register or disconnected after a while. 1. If there are authenticated failures in the Activity Monitor/Permission Collector Logs to the **Ontapi API**: - Ensure all the prerequisites listed in the **Permissions section** were configured correctly. - If the Activity Monitor seems to connect to the NetApp but disconnects after a few seconds, check if the NetApp filer and Activity Monitor server use the same SMB version. Note SMB1 is no longer supported on most modern systems. Use SMB2 or higher when possible. - Run the following command on the NetApp side to verify whether **SMB2** is enabled: `options cifs.smb2.enable` - If SMB2 is not enabled, run the following command to enable it: `options cifs.smb2.enable on` - If for some internal reason you cannot are are not allowed to enable SMB2, use one of the following methods to enable SMB1 on the Windows side: - On Windows Server 2012 to 2016, run the following PowerShell command: `Set-SmbServerConfiguration -EnableSMB1Protocol $true` - For Windows Server 2016 or lower, check the **registry value SMB1** under: `HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters` - If it exists and is set to **0**, SMB1 is disabled. To enable it, set the value to **1**. ### NetApp Cluster Mode If not all events are collected, perform the following steps: 1. Run the command: `fpolicy show-engine` 1. Locate the line representing the FPolicy engine for the Vserver you are analyzing. Verify that the IP address of the FPolicy server matches the IP address of the server where the Activity Monitor is installed, and that the **Server Status** is **connected**. 1. If the **Server Status** is **disconnected**, run the following command: `fpolicy show-engine –node -instance` This will indicate the reason for the disconnection. 1. If the disconnect reason is **TCP failure**, make sure the port configured in the Application configuration matches the port configured in the FPolicy configuration, and that the IP address of the external-engine configuration is the same as the IP address of the server running the Activity Monitor. 1. Verify that there is no firewall between the Activity Monitor server and the cluster nodes, and that the Windows firewall is off on the Activity Monitor server. Note The firewall should only be off during troubleshooting. Turning off the firewall should not be a permanent solution. Refer to the [Physical Filer 7-Mode Communications Requirements](https://documentation.sailpoint.com/fam-connectors/help/nas/netapp/prereqs.html#physical-filer-7-mode-communications-requirements) for more information. 1. If there are **Authentication Failures** to the **ONTAP API** in the Activity Monitor or Permissions Collector logs, check for the following: - Ensure all the prerequisites in the Permissions section were configured correctly. - Ensure the domain case configured in the application matches the domain value for the user configured in the Permissions sections. - Ensure the username configured in the Permissions section matches the username in Active Directory and the user defined in the Application configuration. 1. Ensure the NetApp internal firewall is not blocking communications with the Activity Monitor. Run the following commands in case of a block to allow communication with the Activity Monitor: `system services firewall policy clone -vserver -policy data -destination-policy fp_siq1 -destination-vserver ` `system services firewall policy create -vserver -policy fp_siq -service http -allow-list ` 1. If the Crawler hits unexpected "access denied" errors or misses entire shares due to access issues, this might be related to a known NetApp bug, which is documented in their knowledgebase (you need a NetApp account to view the entire entry): [Backups failing even though user is part of BUILTIN\\Backup Operators group for ONTAP 9](https://kb.netapp.com/Advice_and_Troubleshooting/Data_Storage_Software/ONTAP_OS/Backups_failing_even_though_user_is_part_of_BUILTIN%5CBackup_Operators_group_for_ONTAP_9) - The bug affects Data ONTAP 9.x, and according to the document should be fixed in version 9.4. It “causes backup intent permissions to be incorrectly checked”. This means the Backup Operators membership used to gain access to the filesystem doesn’t work, and “access denied” errors are sent back. - Fortunately, there’s a workaround provided in the knowledgebase entry, which is to “disable fake open capability” by running the following commands on the NetApp console or an SSH connection to the management interface (replace SVM01 with the relevant Vserver): `set diag` `cifs options modify -vserver SVM01 -is-fake-open-enabled false` ## SSL Connection Failure If an error is received in the Permissions Collector or Activity Monitor about an SSL connection which can’t be established: - The certificate key length on the NetApp should be verified. In older NetApp versions, the default certificate is created with a 512-bit length certificate. Use this command to create a certificate with at least a 1024-bit length key: `secureadmin setup ssl` - Data ONTAP up to version 8.2.3 operating in 7-mode only supports security protocols up to TLSv1.0, with the following cipher suites supported when using TLSv1.0: - TLS_RSA_WITH_RC4_128_MD5 - TLS_RSA_WITH_RC4_128_SHA - TLS_RSA_WITH_3DES_EDE_CBC_SHA - Removing support for cipher suites using RC4 or 3DES as their block cipher (the algorithm used to encrypt the data) means that the filer has no available cipher suites to use for secure communications. - Any server trying to communicate securely with the filer must support one of the above cipher suites, preferably 3DES, because it has been deprecated most recently and is still allowed for use. If you have knowledge of these ciphers or TLSv1.0 being blocked in your organization, you must unblock them on the servers running Permission Collection and Activity Monitoring. If you don’t know how to unblock them, talk to your organization’s security department/team, because those settings are not set that way by default. For more information, refer to the links below: - [Disabling TLS 1.0 on your Windows 2008 R2 server – just because you still have one](https://blogs.msdn.microsoft.com/friis/2016/07/25/disabling-tls-1-0-on-your-windows-2008-r2-server-just-because-you-still-have-one/) - [How to disable RC4 and 3DES on Windows Server?](https://www.tbs-certificates.co.uk/FAQ/en/desactiver_rc4_windows.html) - According to a NetApp security advisory, Data ONTAP 8.2.5 operating in 7-mode has the option to turn off TLSv1.0 entirely, and it supports TLSv1.1 and TLSv1.2, plus extra cipher suites that are supported by them, so this version should not be affected by removing support for cipher suites using RC4 or 3DES. The advisory is linked here: - [CVE-2016-2183 TLS Protocol 64-bit Cipher Vulnerability in Multiple NetApp Products](https://security.netapp.com/advisory/ntap-20160915-0001/) If no events are collected, refer to [What to do if Events are not Collected](#what-to-do-if-events-are-not-collected). # Verifying the NetApp Connector Installation ## Verifying Application Configuration After configuring one of the following applications, verify that it was properly configured by running the Test Connection task. The Test Connection will run a series of validations to check if the application was configured correctly. ## Common NetApp Validations The following is a list of common validations that run when the Test Connection is executed with a NetApp application: - Server responsiveness - Verifying the ability to list shares - Verifying the ability to read share permissions - Verifying the membership to the Backup Operators group - Verifying access to the ONTAP API - Verifying that the FPolicy is configured - Verifying that there is a connection between FPolicy and the Activity Monitor ## Installed Services Verify that the services installed for the connector are available and active. Using Windows Service Manager, or other tools, check for the File Access Manager services, and confirm that they are running. For example: - File Access Manager Central Activity Monitor - `` - File Access Manager Central Permissions Collection - `` - File Access Manager Central Data Classification - `` ## Log Files Check the log files listed below for errors: - `"%SAILPOINT_HOME_LOGS%\FilesMiniFilter_.log"` - `"%SAILPOINT_HOME_LOGS%\PermissionCollection_.log"` - `"%SAILPOINT_HOME_LOGS%\DataClassification_.log"` - `"%SAILPOINT_HOME_LOGS%\Netapp-.log"` ## Monitored Activities 1. Simulate activities on NetApp. 1. Wait approximately one minute. 1. Verify that the activities display in the File Access Manager website on the **Forensics > Activities** page. ## Permissions Collection 1. Run the Crawler and Permissions Collector tasks on the **Settings > Task Management > Scheduled Tasks** page. 1. Verify the following: 1. The tasks completed successfully. 1. Business resources were created in the Resource Explorer on the **Admin > Applications > [application column] > Manage Resources** page. 1. Permissions display in the **Permission Forensics** page under **Forensics > Permissions**. # Adding a NetApp Application In order to integrate with NetApp, we must first create an application entry in File Access Manager. This entry includes the identification, connection details, and other parameters necessary to create the link. To add an application, use the New Application Wizard. 1. Navigate to **Admin** > **Applications**. 1. Select **Add New** to open the New Application Wizard. 1. Select **Standard Application** for the wizard type. 1. Select **Next** to open the **General Details** page. ## General Details - **Application Type** - Select NetApp Type. - NetApp CIFS - NetApp DFS - **Application Name** - Logical name of the application. - **Description** - Description of the application. - **Tags** - Select tags for the application from the dropdown menu, and/or type a new name, and select **Enter** to create a new tag. The dropdown list of tags filters out matching tags as you type and displays up to 50 tags. Note The **tags** replace the **Logical container** field that was used when creating applications in releases before 8.2. - **Event Manager Server** - This option is available if there are more than one event manager servers configured in the system. - Select an event manager from the dropdown menu. - **Identity Collector** - Select from the **Identity Collector** dropdown menu. - You can create identity collectors in the administrative client: **Applications > Configuration > Permissions Management > Identity Collectors**. Refer to the OOTB Identity Collection section in the Collector Installation Manager File Access Manager Administrator Guide for further details. - If adding a new identity collector, select the **Refresh** button to update the Identity Collector dropdown list. Select **Next** to open the **Connection Details** page. ## Connection Details - **Filer Name** - The CIFS server name or the NFS IP address to which users connect. - **Domain Name, Username and Password** - The user defined in the prerequisites. ### When working with NetApp 7-mode #### If there is only one filer (no vFilers): - **Management IP** - Empty. - **Use Management IP for tunneling** - Unchecked. - **Is Cluster-Mode** - Unchecked. #### If there is more than one filer (working with vFilers): - **Management IP** - vFiler0’s (vFiler Zero) IP address. - **Use Management IP for tunneling** - Checked. - **vFiler/Vserver name** - The target vFiler’s name in NetApp settings. - **Is Cluster-Mode?** - Unchecked. ### When working with NetApp Cluster-Mode #### If communicating directly with the Vserver: - **Management IP** - The Vserver’s management IP. If it’s the same as the data access IP, leave empty. - **Use Management IP for tunneling** - Unchecked. - **Is Cluster-Mode** - Checked. - **Port** - The port used by the FPolicy Server as configured in NetApp. #### If using Vserver Tunneling: - **Management IP** - The cluster management IP. - **Use Management IP for tunneling** - Checked. - **vFiler/Vserver name** - The target Vserver’s name in NetApp settings. - **Is Cluster-Mode** - Checked. - **Port** - The port used by the FPolicy Server as configured in NetApp. - **Multiple FPolicy Servers?** - (Check this checkbox if more than one FPolicy server needs to be installed for performance reasons. This should be used only with File Access Manager Professional Services/Support). Select **Next**. # Enabling Access Fulfillment for an Application Access fulfillment is enabled per application in the application setting screen for applications that support fulfillment. Refer to the compatibility table in Compass for the full list. **To enable Access Fulfillment for an application:** 1. Go to **Admin > Applications** to open the **Configuration** page of the required application. 1. Scroll through the list, or use the filter to find the application. 1. Select the **edit** icon on the line of the application. 1. Select **Next** until you reach the **Access Fulfillment** settings page. The setting pages and entry fields vary according to the application type. 1. For non-normalized resources, select **Enable Access Fulfillment for Revoking Explicit Permissions**. Refer to Access Fulfillment for Removal of Explicit Permissions. 1. Select **Enable Access Fulfillment for Normalized Groups**. - **Identity Collector** - Fulfillment requires an identity collector in order to run. If you did not select an identity collector in the **General Details** configuration page, you can select one from the dropdown list now. If there is no identity collector defined for this application, or if you want to use a different identity collector than the ones in the dropdown list, you can create a new identity collector in the Administrative Client (Applications > Configuration > Permissions Management > Identity Collectors). Refer to Create/Edit an Active Directory Identity Collector for more details on creating an identity collector. - **Managed Group OU (DN)** - The organizational unit in which the managed permission groups will be created. Make sure that the chosen identity collector’s user has permissions to create groups under this location (e.g., `OU=FileAccessManagerManaged, DC=SailPoint, DC=COM`). - **OU** - Organizational Unit - **DN** - Distinguished Name - **How to Handle ‘List Folder Contents’ Permissions** - Create and manage a dedicated permissions group for it. This is the default value. - Revoke these permissions. - Not relevant for SharePoint. - **How to Handle Inexact Permissions Matches** - During the normalization process, the application has to decide what to do with permissions that do not match the normalized permissions: - Fail the normalization process. - Elevate to the nearest permission match. - Revoke the permission. 1. Open the **Advanced Settings** panel for additional settings: - **Group Cache Sync Interval (sec)** - This setting will add a pause to the process of setting normalized permissions on the resource. This will allow the endpoint's local AD groups cache to sync the newly created managed groups. - The default is 0 – signifying the process will not pause by default. - **Use Template Permission Group** - Template groups are created per application and added as a template to every managed resource. These groups are not managed by File Access Manager, and are usually used to ensure that users who need application-wide access, such as backup or archiving users, have access. - Select for each permission group whether **File Access Manager** should create a group or whether to use an existing group, for the following groups: - List Folder Contents - Read & Execute - Modify - Full Control - If you select **Use an Existing Group**, select the required group to use from the dropdown list. - Once an application is enabled for access fulfillment, you can set specific resources to be normalized using the **Manage Normalized Resources** page. # Configuring Activity Monitoring **To configure the activity monitoring polling parameters:** 1. Go to **Admin > Applications** to open the **Edit** page of the required application. 1. Scroll through the list, or use the filter to find the application. 1. Select the **edit** icon on the line of the application. 1. Select **Next** until you reach the **Activity Configurations & Decs** settings page. **Polling Interval (sec)** - Activity fetching interval (in seconds). Default is set to 60 seconds. **Report Interval (sec)** - Activity Monitor Health reporting interval (in seconds). Default is set to 60 seconds. **Local Buffer Size (MB)** - Local buffer size for activities (in MB). Default is set to 200MB. This cyclic buffer is used to store activities on the Application Monitor’s machine in case of network errors that prevent the activities from being sent. **Activity Data Retention Period** - When selecting the Clear Activity Data option, a user is able to provide a time frame (1 to 100) in either months or years for all activity to be retained. After that time period is met, all data will be removed. Note By default, this feature is disabled. A user can also select to backup the data before it is deleted by selecting the **Backup Events Before Clearing** option. Note The Backup Before Clearing Option will only be enabled if the backup option was set during system installation. If a user did not select the backup option during installation nor provided a backup path, this option will not be enabled. ## Configuring Data Enrichment Connectors The Data Enrichment Connectors (DEC) configuration enables us to select data enrichment sources. These can be used to add information from other sources about identities. An enrichment source could be a local HR database that is used to combine users' job descriptions or departments to the information stored in the identity store. **To configure the Data Enrichment Connectors:** 1. Select the data enrichment connectors to enrich monitored activities from the **Available DECs** text box. 1. Use the **>** or **>>** arrows to move the selected DECs to the **Current DECs** text box. The user can select multiple DECs. Simply select each desired DEC. 1. You can create a new DEC in the **Administrative Client** at **Applications > Configuration > Activity Monitoring > Data Enrichment Connectors**. 1. After creating a new DEC, select **Refresh** to refresh the dropdown list. The Connectors chapter of the File Access Manager Administrator Guide provides more information on Data Enrichment Connectors, including what they are, how to configure them, and how they fit into the Activity Flow. ## Monitoring Exclusions **To add an exclusion:** 1. Select the **dropdown list**. 1. Type in an exclusion (file extension, user, folder, etc., as relevant). 1. Select the **+** icon to add this item to the list. 1. After completing the list, select **Next** or **Cancel** to close the panel. **To edit or remove an exclusion from the list:** 1. Select the **dropdown list**. 1. On the extension to edit or remove, select the **delete** or **edit** icon. 1. Select **Next** or **Cancel** to close the panel. 1. Select **Clear Selection** to clear the entire list. **Excluded File Extensions** - List of file extensions that are not monitored, e.g., `.txt`, `.exe`. Enter one value at a time as described above. **Exclude Folders** - List of folders that are not monitored, e.g., `\\servername\share1\folder1`. Enter one value at a time as described above. **Exclude Users** - List of users whose activities are not monitored, e.g., `user1`, `domain\user2`, `user3@domain.com`. Enter one value at a time as described above. Important The user format to be used depends on how the activity is logged by the endpoint. If you are not sure which of the user formats above to use, either specify all of them, or leave the list empty for now. Go to the **Forensics > Activities** page on the **File Access Manager Website** after some activities flow in to view how the user is depicted in them and use that depiction in the exclusion list. ### When an activity from a new resource is detected: (Modes of Storing Activities) - **Full Auto-Learning Mode** – Will audit everything (every action) on every resource. - **Semi Auto-Learning Mode** – Will monitor activities on resources nested under the top-level resources that are marked for Monitoring. This operation mode will also allow the user to select what type of activities are being monitored. ## Monitored Actions The user has the ability to set monitored actions within Manage Resources. 1. Go to **Admin > Applications**. 1. Under the **Actions** column, select the **ellipsis** icon on the desired application. 1. Select **Manage Resources**. The **Manage Resources** window will display with all resources listed. 1. Select **Manage Monitored Actions**. 1. Toggle **Enable Activity Monitoring for this Resource Hierarchy**. The user can now select the type of actions they want monitored. Note All actions are automatically selected initially. 1. Select **Next**. # Selecting and Scheduling the Data Classification Settings **To associate an application with a data classification service and set the schedule:** 1. Go to **Admin > Applications** to open the **Edit** page of the required application. 1. Scroll through the list, or use the filter to find the application. 1. Select the **edit** icon on the line of the application. 1. Select **Next** until you reach the **Data Classification** settings page. The actual entry fields vary according to the application type. **Central Data Classification Service** - Associate the application with a Central Data Classification Service. This service is responsible for running the Data Classification tasks. If the Central Data Classification service wasn’t installed during the installation of the server, this field will be disabled. **Disabling Data Classification** - Disabling data classification can also be achieved by setting the scheduler to be inactive, which is the default setting for data classification. To disable data classification, delete the entry from the central **Data Classification** field. **Create a Schedule** - This option is enabled only if a central data classification service is selected. Refer to [Scheduling a Task](https://documentation.sailpoint.com/fam-connectors/help/nas/netapp/add/perm_coll.html#scheduling-a-task). Note Refer to the Data Classification chapter in the File Access Manager Administrator Guide for more information. Select **Next** or **Finish**. ## Data Privacy A user can associate the application with a Central Data Classification Engine Service. This engine will be responsible for executing Data Privacy tasks. Though using different processes for each, the Data Classification engine service is in charge of both Data Privacy and Data Classification discovery tasks. You may choose the same service for both, or use a different one for each, to run them in parallel. Note The fields on the Data Privacy step are the same as the Data Classification step. # Configuring and Scheduling the Permissions Collection Permissions can be analyzed to determine the application permissions of an out-of-the-box application, provided you have defined an identity store for File Access Manager to use in its analysis, and you have run a crawl for the application. The permission collector is a software component responsible for analyzing the permissions in an application. The Central Permission Collector Service is responsible for running the Permission Collector and Crawler tasks. If the “IdentityIQ FAM Central Permission Collector” wasn’t installed during the installation of the server, this configuration setting will be disabled. **To configure the Permission Collection:** 1. Go to **Admin > Applications** to open the **Edit** page of the required application. 1. Scroll through the list, or use the filter to find the application. 1. Select the **edit** icon on the line of the application. 1. Select **Next** until you reach the **Crawler & Permissions Collection settings** page. The actual entry fields vary according to the application type. When entering this page in edit mode, you can navigate between the various configuration windows using the **Next** and **Back** buttons. - **Central Permissions Collection Service** - Select a central permission collection service from the dropdown list. You can create permissions collection services as part of the service installation process. Refer to the Services Configuration section in the File Access Manager Administrator Guide for further details. - **Calculate Effective Permissions** - Calculate effective permissions during the permissions collection run. - Valid for NetApp-CIFS only - **Calculate Riskiest Permissions** - Calculates the riskiest permission on a resource – for example, Full Control is riskier than Read permissions if both are on a resource. This option is available when selecting **Calculate Effective Permissions**. - Valid for NetApp-CIFS only. - **Skip Identities Sync during Permission Collection** - Skip identity synchronization before running permission collection tasks when the identity collector is common to different connectors. Note This option is checked by default. ## Permission Collection Setup Notes for NetApp Note - The permissions are managed either on the NTFS level, or on the Share Level. - When the shares are configured with Full Control to Everyone, and all the permissions are defined in the folders, you should select **NTFS**, which is the default. You can now [schedule a task](#scheduling-a-task). ## Scheduling a Task To create a schedule: 1. Select **Create a Schedule**. 1. The system will provide a Schedule Name in the format `{appName} - {type} Scheduler`. Choose to keep or override this suggestion. 1. Select a scheduling frequency from the dropdown list. Schedule Frequency Options - Run After - Create dependency of tasks. The task starts running only upon successful completion of the first task. - Hourly - Set the start time. - Daily - Set the start date and time. - Weekly - Set the day(s) of the week on which to run. - Monthly - Set the day of the month on which to run a task. - Quarterly - Set a monthly schedule with an interval of 3 months. - Half Yearly - Set a monthly schedule with an interval of 6 months. - Yearly - Set a monthly schedule with an interval of 12 months. 1. Fill the Date and Time field with scheduling times. These fields differ depending upon the scheduling frequency selected. 1. Select the **Active** checkbox to activate the schedule. 1. Select **Next**. ## Configuring and Scheduling the Crawler **To set or edit the Crawler configuration and scheduling:** 1. Go to **Admin > Applications** to open the **Edit** page of the required application. 1. Scroll through the list, or use the filter to find the application. 1. Select the **edit** icon on the line of the application. 1. Select **Next** until you reach the **Crawler & Permissions Collection settings** page. The actual entry fields vary according to the application type. **Crawl Snapshot Folders** - Only for NetApp CIFS / NetApp DFS. **Calculate Resource Size** - Determine when, or at what frequency, File Access Manager calculates the resources' size. Select one of the following: - Never - Always - Second crawl and on (this is the default) **Create a Schedule** - Select to open the schedule panel. Refer to [Scheduling a Task](#scheduling-a-task). ### Setting the Crawl Scope There are several options to set the crawl scope: - Setting explicit list of resources to include and/or exclude from the scan. - Creating a regex to define resources to exclude. ## Including and Excluding Paths by List **To set the paths to include or exclude in the crawl process for an application:** 1. Go to **Admin > Applications** to open the **Edit** page of the required application. 1. Scroll through the list, or use the filter to find the application. 1. Select the **edit** icon on the line of the application. 1. Select **Next** until you reach the **Crawler & Permissions Collection settings** page. 1. Scroll down to the **Crawl configuration settings**. 1. Select **Advanced Crawl Scope Configuration** to open the scope configuration panel. 1. Select **Include / Exclude Resources** to open the input fields. 1. To add a resource to a list, type in the full path to include/exclude in the top field and select **+** to add it to the list. 1. To remove a resource from a list, find the resource from the list, and select the **x** icon on the resource row. Note When creating exclusion lists, excludes take precedence over includes. ## Excluding Paths by Regex **To set filters of paths to exclude in the crawl process for an application using regex:** 1. Go to **Admin > Applications** to open the **Edit** page of the required application. 1. Scroll through the list, or use the filter to find the application. 1. Select the **edit** icon on the line of the application. 1. Select **Next** until you reach the **Crawler & Permissions Collection settings** page. 1. Select **Exclude Paths by Regex** to open the configuration panel. 1. Type in the paths to exclude by Regex. Refer to the regex examples below. Since the system does not collect BRs that match this Regex, it also does not analyze them for permissions. ## Crawler Regex Exclusion Example The following are examples of crawler Regex exclusions: ### Exclude all shares which start with one or more shares names | **Example** | **Regex** | | ------------------------------------------------------------------------- | ----------------------------- | | Starting with `\\server_name\shareName` | `\\\\server_name\\shareName$` | | Starting with `\\server_name\shareName` or `\\server_name\OtherShareName` | \`\\\\server_name\\(shareName | ### Include ONLY shares which start with one or more shares names | **Example** | **Regex** | | ------------------------------------------------------------------------- | ---------------------------------- | | Starting with `\\server_name\shareName` | \`^(?!\\\\server_name\\shareName($ | | Starting with `\\server_name\shareName` or `\\server_name\OtherShareName` | \`^(?!\\\\server_name\\(shareName | ### Narrow down the selection | **Example** | **Regex** | | --------------------------------------------------------------- | ---------------------------------- | | Include ONLY the C$ drive shares: `\\server_name\C$` | \`^(?!\\\\server_name\\C$($ | | Include ONLY one folder under a share: `\\server\share\folderA` | \`^(?!\\\\server_name\\share$($ | | Include ONLY all administrative shares | \`^(?!\\\\server_name\\[a-zA-Z]$($ | Note - To write a backslash or a dollar sign, add a backslash before it as an escape character. - To add a condition in a single command, use a pipe character “|”. ## Excluding Top Level Resources Use the top-level exclusion screen to select top-level roots to exclude from the crawl. This setting is done per application. **To exclude top-level resources from the crawl process:** 1. Go to **Admin > Applications** to open the **Application** page. 1. Find the application to configure and select the dropdown menu on the application line. 1. Select **Exclude Top Level Resources** to open the configuration panel. 1. Select **Run Task**. The **Run Task** button triggers a task that runs a short detection scan to detect the current top-level resources. Before running the task for the first time, the following message displays above this button: **Note: Run task to detect the top-level resources**. Once triggered, you can view the task status on the **Settings > Task Management > Tasks** page. Note This will only work if the user has access to the task page. 1. When the task has completed, select **Refresh** to update the page with the list of top-level resources. 1. Select the top-level resource list and select top-level resources to exclude. 1. Select **Save** to save the change. 1. To refresh the list of top-level resources, run the task again. Running the task will not clear the list of top-level resources to exclude. ## Special Consideration for Long File Paths in Crawl If you need to support long file paths above 4,000 characters for the crawl, set the flag `excludeVeryLongResourcePaths` in the Permission Collection Engine App.config file to `true`. By default, this value will be commented out and set to `false`. This key ensures, when enabled, that paths longer than 4000 characters are excluded from the applications’ resource discovery (Crawl), to avoid issues while storing them in the SQLServer database. When enabled, business resources with full paths longer than 4000 characters, and everything included in the hierarchical structure below them, will be excluded from the crawl, and will not be collected by File Access Manager. This scenario is extremely rare. Note You should not enable exclusion of long paths, unless you experience an issue. - **Background** - File Access Manager uses a hashing mechanism to create a unique identifier for each business resource stored in the File Access Manager database. The hashing mechanism in SQLServer versions 2014 and earlier is unable to process (hash) values with 4,000 or more characters. Though resources with paths of 4000 characters or longer are extremely rare, File Access Manager is designed to handle that limitation. - **Identifying the Problem** - When using an SQL Server database version 2014 and earlier, the following error message in the Permission Collection Engine log file might be observed: `System.Data.SqlClient.SqlException (0x80131904): String or binary data would be truncated.` In all other cases, this feature should not be enabled. - **Setting the Long Resource Path Key** - The Permission Collection Engine App.config file is `RoleAnalyticsServiceHost.exe.config`, and can be found in the following folder: ```text %SailPoint_Home%\FileAccessManager[Permission Collection instance]\ ``` Search for the key `excludeVeryLongResourcePaths` and correct it as described above. # O365 File Storage The following are File Access Manager supported connectors: - Exchange Online - [OneDrive](https://documentation.sailpoint.com/fam-connectors/help/o365/onedrive/index.html) - [SharePoint Online](https://documentation.sailpoint.com/fam-connectors/help/o365/sharepoint_online/index.html) # Connector Overview Access to Exchange Online is based on Microsoft Exchange Online PowerShell API capabilities. ## Audit types include: - **Mailbox Access Audit** - Administrators who access other users’ mailboxes - Users who access other users’ mailboxes as delegates - **Administrator Audit PowerShell Cmdlets** - Every `Set-*` PowerShell cmdlet is audited ## Capabilities This connector enables you to use Data Access Security to access and analyze data stored in Exchange Online and do the following: - Analyze the structure of your stored data. - Monitor user activity in the resources. - Classify the data being stored. - Verify user permissions on the resources, and compare them against requirements. - Manage access fulfillment – automated granting and revoking of access – according to rules set in Data Access Security. - Identity collector – collect IAM users, groups, and roles and the connections between them. See the Data Access Security documentation for a full description. ## Exchange Online Connector OAuth 2.0 Support The connector uses fully Modern Authentication methods, and does not require Legacy Authentication methods be enabled, tenant-wide, or otherwise. ## Permissions Collection Operation Principle The File Access Manager Connector connects using the PowerShell interface and analyzes mailboxes, folders, public folders, and their permissions. ## Mailbox Audit 1. Mailbox audit events are assigned to the relevant mailbox business resource. 1. The list of monitored mailbox types can be found in the `BAMFramework.exe.config` file under the `recipientTypeDetailsToMonitor` setting. By default, the following types are defined and monitored: - **UserMailbox** - **SharedMailbox** ## Monitored Activities | **Action** | **Description** | **Admin** | **Delegate** | **Owner** | | ------------------ | ------------------------------------------------------------------------------------------------------------------------- | --------- | ------------ | --------- | | Copy | An item is copied to another folder. | Yes | Yes | No | | Create | An item is created in the mailbox. (For example, a message is sent or received.) Note that folder creation isn't audited. | Yes | Yes | Yes | | FolderBind | A mailbox folder is accessed. | Yes | Yes | No | | HardDelete | An item is deleted permanently from the Recoverable Items folder. | Yes | Yes | Yes | | MessageBind | An item is accessed in the reading pane or opened. | Yes | No | No | | Move | An item is moved to another folder. | Yes | Yes | Yes | | MoveToDeletedItems | An item is moved to the Deleted Items folder. | Yes | Yes | Yes | | SendAs | A message is sent using Send As permissions. | Yes | Yes | N/A | | SendOnBehalf | A message is sent using Send on Behalf permissions. | Yes | Yes | N/A | | SoftDelete | An item is deleted from the Deleted Items folder. | Yes | Yes | Yes | | Update | An item's properties are updated. | Yes | Yes | Yes | ## Admin Audit Events (Administrator Audit Logging) File Access Manager features the following Admin audit events: - **General Admin audit events** are assigned to a special resource (Audit Admin). - **Admin audit events** that relate to a specific mailbox are assigned to the mailbox business resource. The list of commands can be found in the framework configuration file in the `mailboxAuditLogCmdLets` setting. - For Exchange: The config file is `WBX.Exchange2010BAMHost.dll.config` - For Exchange Online: The config file is `WBX.ExchangeOnlineBAMHost.dll.config` By default, the following are defined as mailbox commands: - `Remove-Mailbox` - `New-Mailbox` - `Set-Mailbox` - `Add-MailboxPermission` - `Remove-MailboxPermission` - `Set-MailboxAutoReplyConfiguration` Admin audit events related to a specific mailbox folder are assigned to the mailbox folder business resource.\ The list of commands can be found in the `BAMFramework.exe.config` file in the `mailboxFolderAuditLogCmdLets` setting.\ By default, the following are defined as mailbox folder commands: - `Add-MailboxFolderPermission` - `Remove-MailboxFolderPermission` - `Set-MailboxFolderPermission` Admin audit events related to a specific public folder are assigned to the public folder business resource.\ The list of commands can be found in the `BAMFramework.exe.config` file in the `publicFolderAuditLogCmdLets` setting.\ By default, the following commands are defined as public folder commands: - `Add-PublicFolderClientPermission` - `Remove-PublicFolderClientPermission` - `New-PublicFolder` - `Remove-PublicFolder` - `Add-PublicFolderAdministrativePermission` - `Remove-PublicFolderAdministrativePermission` ## Exchange Online Connector Installation Flow Overview To install the Exchange Online connector: 1. Configure all the prerequisites. 1. Add a new Exchange Online application. 1. Install the relevant services: - **Activity Monitor** Note Exchange Online currently does not support the Cloud-Ready architecture for permissions collection and data classification. Permission collection and data classification tasks will run on the central engine services associated with the application, regardless of whether these services have one or more collectors associated with the central engine. # Collecting Data Stored in an External Application ## Terminology - **Connector** - The collection of features, components and capabilities that comprise File Access Manager support for an endpoint. - **Collector** - The “Agent” component or service in a Data Classification and or Permission Collection architecture. - **Engine** - The core service counterpart of this architecture. - **Identity Collector** - A logical component used to fetch identities from an identity store and holds the configuration, settings for that identity store, and the relations between these identities. The identity collector has no “physical” manifest. The actual work is done by the Collector Synchronizer. ## Configuring Data Collection and Analysis The list below describes the high level installation process required to collect and analyze data from an external application. Most of these should already be set up in your File Access Manager installation. See the server Installation guide for further details. - **Install a Data Classification central engine** - One or more central engines, installed using the server installer. - **Install a Permission Collection central engine** - One or more central engines, installed using the server installer. - **Create an Application in File Access Manager** - From the Business Website. The application is linked to central engines listed above. - **Add an Activity Monitor** - To collect activities for this application - run the Collector Installation Manager and add an application under Activity Monitoring. # Installing Services: Activity Monitor and Collectors The Collector Installation Manager is part of the File Access Manager installation package. This tool is used to install the activity monitor, permission collector, and data classification collector. 1. Run the Collector Installation Manager as an Administrator. The installation files are in the installation package under the Collectors folder. The Collector Installation Manager window displays. 1. Enter the credentials to connect to File Access Manager. - ServerName/IP should point to the Agent Configuration Manager service server. - An File Access Manager user with Collector Manager permission (permission to install collectors) is required. For Active Directory authentication, use the format `domain\username`. 1. Select **Next**. 1. If you are installing the Activity Monitor, select the application, and select **Add**. When installing a SharePoint Activity Monitor, you will be prompted for service account credentials. This service account will be used by the Activity Monitor service to run the service and authenticate against the SharePoint IIS servers to fetch the logs (“Log on as”). Make sure the service account provided has local administrator privileges on the local server (hosting the Activity Monitor service) and can access the activity logs on the IIS servers. 1. If you are installing the Permission Collector, select the Central Permission Collector to which to connect this service, and select **Add**. 1. If you are installing the Data Classification, select the Central Classification Collector to which to connect this service, and select **Add**. 1. Select Next. Note If this is the first time you are installing collectors on this machine, you will be prompted to select an installation folder, in which all future collectors will also be installed. 1. Browse and select the location of the target folder for installation. 1. Browse and select the location of the folder for system logs. 1. Select **Next**. The system begins installing the selected components. 1. Select **Finish**. The Finish button is displayed after all the selected components have been installed. Note The File Access Manager Administrator Guide provides more information on the collector services. # Prerequisites Make sure your system fits the descriptions below before starting the installation. ## Software Requirements Data Access Security requires the latest ASP.NET Core 8.0.x Hosting Bundle. This bundle consists of .NET Runtime and ASP .NET Core Runtime. You can download the latest 8.0.x Hosting Bundle version from [here](https://dotnet.microsoft.com/en-us/download/dotnet/8.0). ## Exchange Online Powershell Module Installation For servers that host Permission Collection and Activity Monitoring, the EXO powershell module needs to be installed. Run the following command from an elevated (Administrator) powershell prompt: `Install-Module -Name ExchangeOnlineManagement -RequiredVersion 3.1.0 -Scope AllUsers -Force -AllowClobber` If this is done before applying the upgrade, no further action is required. If this upgrade is completed after the upgrade, the Permission Collection and Activity Monitor will need to be restarted. ## Creating an Azure Application for Exchange Online A new Azure Active Directory application must be created and configured to support the File Access Manager SharePoint Online functionality. This configuration can be performed either by running the automated PowerShell script supplied with the SailPoint distribution pack, or by creating and configuring the application through the Azure portal. ### Creating and Configuring the Application Automatically There is a PowerShell script named CreateSharePointOnlineAndSharePoint OnlineApp.ps1 provided in the Collectors.zip under the extracted scripts sub-folder. This script will perform all the Azure application creation and configuration steps required for SharePoint Online. To run this script, the Azure AD PowerShell module must be installed. `Install-Module -Name AzureAD` Before running the script, open the file in a text editor to review the default parameters. The parameters can be edited in the file or passed as parameters when running the script. To run the script with the default parameters: `.\CreateExchangeOnlineApp.ps1` To run the script while overriding some of the default parameters: `.\CreateExchangeOnlineApp.ps1 -AppName "Exchange Online FAM App" -DirectoryRole "Exchange Administrator" -CertDnsName "contoso.com" -CertYearsValid 15` When prompted, log in with administrator credentials to create and configure Azure applications. The last step of the script will launch a URL to grant admin consent for the application. After granting consent, the page will redirect to a missing localhost URL. The operation is successful if the URL for that page contains admin_consent=True. Note If you experience an access denied error or other error in the web browser when granting admin consent, this might be a timing issue. This can be resolved by either manually granting admin consent through the Azure portal (see section Grant admin consent manually), or by copying and pasting the consent URL (represented in the line from the script output that starts in "Consent URL: ") into your browser. The following output should be gathered or noted when running the script. This information will be used to configure the SharePoint Online application in File Access Manager: 1. The App ID value in the console output. 1. The created certificate file .pfx located in your working directory. 1. The certificate password that was entered when prompted. ### Creating and Configuring the Application Manually The following steps create and configure an Azure application for SharePoint Online authentication through the Azure portal. These steps are adapted from the online [Microsoft](https://docs.microsoft.com/en-us/powershell/exchange/app-only-auth-powershell-v2?view=exchange-ps#set-up-app-only-authentication) documentation. #### Registering an Azure Active Directory Application Follow these steps to register an application in Azure Active Directory (Azure AD): 1. Open the Azure AD portal at . 1. Under Manage Azure Active Directory, select **View**. 1. On the Overview page, under Manage, select **App registrations**. 1. On the App registrations, select **New registration**. 1. On the Register an application page, configure the following settings: - **Name**: Enter something descriptive. For example, `Exchange Online FAM App`. - **Supported account types**: Verify that **Accounts in this organizational directory only ( only - Single tenant)** is selected. - **Redirect URI (optional)**: Leave this field empty. 1. When you're finished, select **Register**. Note Leave the app page open. You'll use it in the next step. #### Assign API Permissions to the Application 1. On the app page under Manage, select **Manifest**. Locate the requiredResourceAccess entry. 1. Replace the entire requiredResourceAccess entry with the following: ```text "requiredResourceAccess": [ { "resourceAppId": "c5393580-f805-4401-95e8-94b7a6ef2fc2", "resourceAccess": [ { "id": "594c1fb6-4f81-4475-ae41-0c394909246c", "type": "Role" } ] }, { "resourceAppId": "00000003-0000-0ff1-ce00-000000000000", "resourceAccess": [ { "id": "678536fe-1083-478a-9c59-b99265e6b0d3", "type": "Role" } ] } ], ``` 1. Select **Save**. 1. On the Manifest page, under Manage, select **API permissions**. 1. Select **Grant admin consent for** and complete the following: 1. Verify the value **Exchange.ManageAsApp** is shown in the API / Permissions Name. 1. For **Status**, select **Grant admin consent got** and read the confirmatio dialog that displays. 1. Select **Yes**. The Status value should now be Granted for on both entries. 1. Close the current API permissions page (not the browser tab) to return to the App registrations page. You will use it in an upcoming step. #### Generate a Self-Signed Certificate Create a self-signed x.509 certificate using the following PowerShell commands. Edit parameters such as DnsName, Certificate expiration, and password as appropriate: **# Create certificate** - `$mycert = New-SelfSignedCertificate -DnsName "contoso.org" -CertStoreLocation "cert:\LocalMachine\My" -NotAfter (Get-Date).AddYears(15) -KeySpec KeyExchange` **# Export certificate to .pfx file** - `$mycert | Export-PfxCertificate -FilePath mycert.pfx -Password $(ConvertTo-SecureString -String "P@ssw0Rd1234" -AsPlainText -Force)` **# Export certificate to .cer file** - `$mycert | Export-Certificate -FilePath mycert.cer` #### Assign the Certificate to the Azure Active Directory Application After you register the certificate with your application, you can use the private key (.pfx file) for authentication. 1. If you need to get back to the Apps registration page: 1. Open the Azure AD portal at 1. Under **Manage Azure Active Directory**, select **View**. 1. On the Overview page that opens, under Manage, select **App registrations**. 1. On the Apps registration page from the end of Step 2, select your application. 1. On the application page that opens, under Manage, select **Certificates & secrets**. 1. Select **Upload Certificate**. 1. Browse to the self-signed certificate (.cer file) that you created in Step 3. 1. Click **Add**. The certificate is now shown in the Certificates section. 1. Close the current Certificates & secrets page, and then the App registrations page to return to the main page. You'll use it in the next step. #### Assign Azure Active Directory Role to the Application 1. Open the Azure AD portal at 1. Under **Manage Azure Active Directory**, select **View**. 1. On the Overview page that opens, under Manage, select **Roles and administrators**. 1. Find and select one of the supported roles by clicking on the name of the role (not the check box) in the results. 1. On the Assignments page that opens, click **Add assignments**. 1. In the Add assignments flyout that opens, find and select the app that you created in Step 1. 1. Select **Add**. 1. Back on the Assignments page, verify that the app has been assigned to the role. ## Permissions The Office365 Exchange Online service uses a similar permission model as the equivalent Exchange On-Premises. ## Audit Bypass The File Access Manager Connector for Exchange Online sets the mailbox audit for the selected mailboxes according to the configuration in the application. However, there are application service accounts (for example, BlackBerry or IXOS) that create many mailbox audit log entries, which can overload the Exchange and generate a lot of noise in **File Access Manager**. You can configure a user or computer account to bypass mailbox audit logging, so that actions taken by that user or account for any mailbox are not logged. By bypassing trusted user or computer accounts that require frequent access to mailboxes, you can reduce the noise in mailbox audit logs. For more information, see [Technet: Bypass Mailbox Audit Logging](https://technet.microsoft.com/en-us/library/ff461934%28v=exchg.150%29.aspx) Note It is recommended to set an alert on bypass commands to verify that users are not bypassed unexpectedly. ## Audit Age Log Limit By default, audit logging is configured to store audit log entries for 90 days. After 90 days, the audit log entry is cycled. You can change the audit log age limit using the `Set-Mailbox` cmdlet with the `AuditLogAgeLimit` parameter. You can specify the number of days, hours, minutes, and seconds to retain audit log entries. Logs need not be retained for a long time (more than a few days), since File Access Manager offloads the data from the exchange. Important It is not recommended to retain an audit for a long time, as doing so expands the Exchange DB. For more information, see [Technet: Audit Log Age Limit](https://technet.microsoft.com/en-us/library/bb123981%28v=exchg.150%29.aspx) ## Communication Requirements | **Requirement** | **Source** | **Destination** | **Port** | | --------------------------------- | -------------------------------------------------- | --------------------------- | --------- | | File Access ManagerMessage Broker | Permissions Collector Server | RabbitMQ | 5671 | | File Access ManagerAccess | Activity Monitor and Permissions Collector servers | File Access Manager Servers | 8000-8008 | | Remote PowerShell | Activity Monitor/Permissions Collector server | Office 365 Cloud | 80 or 443 | # Verifying the Exchange Online Connector Installation ## Installed Services Verify that the services installed for the connector are available and active. Using Windows Service Manager or another tool, look for the File Access Manager services and ensure that they are running. For example: - **File Access Manager Central Permissions Collection** - `` service is running. - **File Access Manager Central Activity Monitor** - `` service is running. ## Log Files Check the log files listed below for errors: - `%SAILPOINT_HOME_LOGS%\FilesMiniFilter_.log` - `%SAILPOINT_HOME_LOGS%\PermissionCollection_.log` - `%SAILPOINT_HOME_LOGS%\DataClassification_.log` - `%SAILPOINT_HOME_LOGS%\ExchangeOnlineBAM-.log` ## Monitored Activities 1. Simulate activities on Exchange Online. 1. Wait approximately one minute. 1. Verify that the activities display in the File Access Manager website under: 1. **Forensics > Activities** ## Permissions Collection 1. Run the Crawler and Permissions Collector tasks (**Settings > Task Management > Scheduled Tasks**). 1. Verify that: 1. The tasks completed successfully. 1. Business resources were created in the resource explorer (**Admin > Applications > [application column] > Manage Resources**). 1. Permissions display in the Permission Forensics page (**Forensics > Permissions**). # Adding a New Exchange Online Application To integrate with Exchange Online, we need to create an application entry in File Access Manager. This entry will include the identification, connection details, and other parameters required to establish the link. 1. Navigate to **Admin** > **Applications**. 1. Select **Add New** to open the New Application Wizard. 1. Select **Standard Application** for the wizard type. 1. Select **Next** to open the **General Details** page. ## General Details 1. Complete the General Details: - Application Type - Exchange Online - Application Name - Logical name of the application - Description - Description of the application - Tags - Select tags for the application from the dropdown list or type a new name and press Enter to create a tag. The dropdown list of tags filters out matching tags as you type and displays up to 50 tags. Note The tags replace the Logical container field that was used when creating applications in releases before 8.2. - Event Manager Server - If there are multiple event manager servers configured in the system, you can select an event manager from the dropdown list. - Identity Collector - Select from the Identity Collector dropdown menu. You can create identity collectors in the administrative client by going to **Applications > Configuration > Permissions Management > Identity Collectors**. See section "OOTB Identity Collection" in the Collector Installation ManagerFile Access Manager Administrator Guide for further details. If adding a new identity collector, select the **Refresh** button to update the Identity Collector dropdown list. 1. Select **Next**. ## Connection Details 1. Complete the Connection Details fields: - Tenant Domain Name - Use your company name as registered in Azure. Otherwise, fill in the full DNS name of a custom domain name. e.g., `company_name.com`. - Application ID - Enter the Application ID for the Azure Application used by the File Access Manager Exchange Online Connector. - Certificate File Path - Either navigate to the certificate by pressing **Choose a File**, or drag the certificate onto the Certificate File Path field. Supported file formats: `pfx`, `p12` - Certificate Password - Enter the password for the certificate. Note When editing this application, if a new certificate is uploaded, then the former password cannot be used. The user has to provide a new password. Select **Next**. # Configuring Activity Monitoring ## Configuring Activity Monitoring Process Frequency - **Polling Interval (sec)** - Activity fetching interval [in seconds]. Default is set to 60 seconds, - **Report Interval (sec)** - Activity Monitor Health reporting interval [in seconds]. Default is set yo 60 seconds. - **Local Buffer Size (MB)** - Local buffer size for activities [in MB]. Default is set to 200MB. - This cyclic buffer is used to store activities on the Application Monitor’s machine in case of network errors that prevent the activities from being sent. - **Activity Data Retention Period** - When selecting the Clear Activity Data option, a user is able to provide a time frame (1 to 100) in either months or years for all activity to be retained. Once that time period is met, all data will be removed. - A user can also select to backup the data before it is deleted by selecting the Backup Events Before Clearing option. Notes - By default, this feature is disabled. - The Backup Before Clearing Option will only be enabled if the backup option is set during the system installation. If a user has not selected the backup option during the installation nor provided a backup path, this option will not be enabled. ## Configuring Data Enrichment Connectors The Data Enrichment Connectors (DEC) configuration enables us to select data enrichment sources. These can be used to add information from other sources about identities. An enrichment source could be a local HR database that is used to combine users' job descriptions or departments to the information stored in the identity store. - Select the data enrichment connectors to enrich monitored activities from the Available DECs text box. - Use the **>** or **>>** arrows to move the selected DECs to the Current DECs text box. - The user can select multiple DECs. Simply select each desired DEC. - You can create a new DEC in the Administrative Client, **Applications > Configuration > ActivityMonitoring > DataEnrichmentConnectors**. - After creating a new DEC, select **Refresh** to refresh the dropdown list. The chapter Connectors of the File Access Manager Administrator Guide provides more information on Data Enrichment Connectors, including what they are, how to configure them, and how they fit in the Activity Flow. # Selecting and Scheduling the Data Classification Settings ## Associating an Application with Data Classification Server To associate an application with a data classification service, and set the schedule 1. Open the edit screen of the required application. - Go to **Admin > Applications** - Scroll through the list, or use the filter to find the application. - Select the edit icon on the line of the application. 1. Select **Next** till you reach the **Data Classification** settings page. The actual entry fields vary according to the application type. - **Central Data Classification Service** - Associate the application with a Central Data Classification Service. This service is responsible for running the Data Classification tasks. - If the “Central Data Classification” wasn’t installed during the installation of the server, this field is disabled. - **Disabling Data Classification** - To disable data classification, delete the entry from the central data classification field. - Disabling data classification can also be achieved by setting the scheduler to be inactive (which is the default setting for data classification). - **Create a Schedule** - This option is enabled only if a central data classification service is selected. - See Scheduling a Task. Note See the chapter “Data Classification” in the File Access Manager Administrator Guide for more information Select **Next** or **Finish**. ## Data Privacy A user can associate the application with a Central Data Classification Engine Service. This engine will be responsible for executed Data Privacy tasks. Though using different processes for each, the Data Classification engine service is in charge for both Data Privacy and Data Classification discovery tasks. You may choose the same service for both, or use a different one for each, to run them in parallel. Note The fields on the Data Privacy step are the same as the Data Classification step. # Configuring and Scheduling the Permissions Collection Permissions can be analyzed to determine the application permissions of an out-of-the-box application, provided you have defined an identity store for File Access Manager to use in its analysis, and you have run a crawl for the application. The permission collector is a software component responsible for analyzing the permissions in an application. The Central Permission Collector Service is responsible for running the Permission Collector and Crawler tasks. If the “File Access Manager Central Permission Collector” wasn’t installed during the installation of the server, this configuration setting will be disabled. Note If using a proxy in your File Access Manager environment, see How to Use Proxy in a File Access Manager Environment in the Azure File Guide. ## Configuring the Permission Collection The permission collector is a software component responsible for analyzing the permissions in an application. Note If the File Access Manager Central Permission Collector wasn’t installed during server installation, this configuration setting will be disabled. To configure the permission collector: 1. Go to **Admin > Applications**. 1. Scroll through the list or use the filter to find the application. 1. Select the **Edit** icon on the application row. 1. Select **Next** until you reach the **Permissions Collector** settings page. Note The entry fields vary by application type. 1. Select **Central Permissions Collection** to create permissions collection services as part of the service installation process. 1. Seelct **Calculate Effective Permissions** during the permissions collection run. 1. Select **Calculate Riskiest Permissions** to calculate the riskiest permissions on a resource. 1. Select **Skip Identities Sync during Permissions Collection** to skip identity synchronization before running the permission collection tasks when the identity collector is common to different connector. This option is enabled by default. You can now [schedule a task](#scheduling-a-task). ## Scheduling a Task To create a schedule: 1. Select **Create a Schedule**. 1. The system will provide a Schedule Name in the format `{appName} - {type} Scheduler`. Choose to keep or override this suggestion. 1. Select a scheduling frequency from the dropdown list. Schedule Frequency Options - Run After - Create dependency of tasks. The task starts running only upon successful completion of the first task. - Hourly - Set the start time. - Daily - Set the start date and time. - Weekly - Set the day(s) of the week on which to run. - Monthly - Set the day of the month on which to run a task. - Quarterly - Set a monthly schedule with an interval of 3 months. - Half Yearly - Set a monthly schedule with an interval of 6 months. - Yearly - Set a monthly schedule with an interval of 12 months. 1. Fill the Date and Time field with scheduling times. These fields differ depending upon the scheduling frequency selected. 1. Select the **Active** checkbox to activate the schedule. 1. Select **Next**. ## Configuring and Scheduling the Crawler To configure the crawler: 1. Go to **Admin > Applications**. 1. Scroll through the list or use the filter to find the application. 1. Select the **Edit** icon on the application row. 1. Select **Next** until you reach the **Crawler & Permissions Collector** settings page. Note The entry fields vary by application type. **Crawl Mailboxes, Crawl Public Folders** - Select the types of folders to scan Select one of the following: - Never - Always - Second crawl and on (this is the default) You can now [schedule a task](#scheduling-a-task). ## Setting the Crawl Scope There are several options to set the crawl scope: - Setting explicit list of resources to include and / or exclude from the scan. - Creating a regex to define resources to exclude. ## Including and Excluding Paths by List To set the paths to include or exclude in the crawl process for an application: 1. Go to **Admin > Applications**. 1. Scroll through the list or use the filter to find the application. 1. Select the **Edit** icon on the application row. 1. Select **Next** until you reach the **Crawler & Permissions Collector** settings page. 1. Scroll down to the Crawl configuration settings. 1. Select **Advanced Crawl Scope Configuration** to open the scope configuration panel. 1. Select **Include / Exclude Resources** to open the input fields. 1. To add a resource to a list, type in the full path to include/exclude in the top field and select **+** to add it to the list. 1. To remove a resource from a list, find the resource from the list and select the **x icon** on the resource row. Note When creating exclusion lists, excludes take precedence over includes. ## Excluding Paths by Regex 1. Go to **Admin > Applications**. 1. Scroll through the list or use the filter to find the application. 1. Select the **Edit** icon on the application row. 1. Select **Next** until you reach the **Crawler & Permissions Collector** settings page. 1. Select Exclude Paths by Regex to open the configuration panel. 1. Type in the paths to exclude by Regex, See regex examples in the section below. Since the system does not collect BRs that match this Regex, it also does not analyze them for permissions. ### Crawler Regex Examples The following are examples of crawler Regex exclusions: **Exclude all shares which start with one or more shares names:** - Example: Starting with Public Folders\\shareName - Regex: Public Folders\\shareName$ - Example: Starting with Public Folders\\shareName or Public Folders\\OtherShareName - Regex: Public Folders\\(shareName|OtherShareName)$ **Include ONLY shares which start with one or more shares names:** - Example: Starting with Public Folders\\shareName - Regex: ^(?!Public Folders\\shareName($|.*)).* - Example: Starting with Public Folders\\shareName or Public Folders\\OtherShareName - Regex: ^(?!Public Folders\\(shareName|OtherShareName)($|.*)).* - Example: Include ONLY one folder under a share: \\server\\share\\folderA - Regex: ^(?!\\Public Folders\\shareName$(|\\folderA|\\folderA.*)).* **Exclude all mailboxes which start with one or more user names:** - Example: Starting with John.Doe - Regex: ^Mailboxes\\John.Doe@.\* - Example: Starting with John.Doe or Jane.Doe - Regex: ^Mailboxes(John|Jane).Doe@.\* **Include ONLY mailboxes that start with one or more user names:** - Example: Starting with John.Doe - Regex: ^(?!Mailboxes/John.Doe@.*).* - Example: Starting with John.Doe or Jane.Doe - Regex: ^(?!Mailboxes/(John|Jane).Doe@.*).* **Narrow down the selection:** - Example: Include ONLY the C$ drive shares: \\server_name\\C$ - Regex: ^(?!\\server_name\\C$($|.*)).* - Example: Include ONLY one folder under a share: \\server\\share\\folderA - Regex: ^(?!\\server_name\\share$(|\\folderA|\\folderA.*)).* - Example: Include ONLY all administrative shares - ^(?!\\server_name[a-zA-Z]$($|)).\* Notes - To use a backslash or `$` sign, add a backslash before it as an escape character. - To add a condition in a single command, use a pipe character `|`. ## Excluding Top-Level Resources Use the top-level exclusion screen to select top-level roots to exclude from the crawl. This setting is done per application. To exclude top-level resources from the crawl process: 1. Go to **Admin > Applications**. 1. Find the application to configure and select the dropdown list menu on the application line. Select **Exclude Top Level Resources** to open the configuration panel. 1. Select the **Run Task** button to trigger a task that runs a short detection scan to detect the current top-level resources. If the top-level resource list has changed in the application while you are on this screen, select the **Run Task** button to retrieve the updated structure. 1. Once triggered, you can view the task status in **Settings > Task Management > Tasks**, depending on your access to the task page. 1. When the task has completed, select **Refresh** to update the page with the list of top-level resources. 1. Select the top-level resource list and choose top-level resources to exclude. Note If all resources are selected and you wish for them to be deselected, select **Deselect All**. You can also select individual resources. 1. Select **Save** to save the change. 1. To refresh the list of top-level resources, run the task again. Running the task will not clear the list of top-level resources to exclude. ## Special Consideration for Long File Paths in Crawl If you need to support long file paths above 4,000 characters for the crawl, set the flag `excludeVeryLongResourcePaths` in the **Permission Collection Engine App.config** file to `true`. By default, this value will be commented out and set to `false`. This key ensures, when enabled, that paths longer than 4,000 characters are excluded from the applications’ resource discovery (Crawl), to avoid issues while storing them in the SQL Server database. When enabled, business resources with full paths longer than 4,000 characters, and everything included in the hierarchical structure below them, will be excluded from the crawl and will not be collected by File Access Manager. This scenario is extremely rare. Note You should not enable exclusion of long paths unless you experience an issue. **Background** File Access Manager uses a hashing mechanism to create a unique identifier for each business resource stored in the File Access Manager database. The hashing mechanism in SQL Server versions 2014 and earlier is unable to process (hash) values with 4,000 or more characters. Though resources with paths of 4,000 characters or longer are extremely rare, File Access Manager is designed to handle that limitation. **Identifying the Problem** When using an SQL Server database version 2014 and earlier, you may see the following error message in the Permission Collection Engine log file: `System.Data.SqlClient.SqlException (0x80131904): String or binary data would be truncated` In all other cases, this feature should not be enabled. **Setting the Long Resource Path Key** The Permission Collection Engine App.config file is `RoleAnalyticsServiceHost.exe.config`, and can be found in the folder `%SailPoint_Home%\FileAccessManager\[Permission Collection instance]\`. Search for the key excludeVeryLongResourcePaths and correct it as described above. # Capabilities This connector enables you to use File Access Manager to access and analyze data stored in Windows File Server and do the following: - Analyze the structure of your stored data. - Monitor user activity in the resources. - Classify the data being stored. - Verify user permissions on the resources, and compare them against requirements. - Manage access fulfillment - automated granting and revoking of access - according to rules set in File Access Manager. - Identity collector – collect IAM users, groups and roles and the connections between them. ## Monitored Activities Monitored events and activities are as defined in the [Office365 Management Activity API specification](https://msdn.microsoft.com/en-us/library/office/mt607130.aspx#SharePointAuditOperations). ## Activity Monitor Operation Principles File Access Manager Activity Monitor for OneDrive uses the Microsoft Office365 Management Activity API. The Activity Monitor queries the API for OneDrive events. The Microsoft Office365 Management Activity API uses the OAuth 2.0 authorization protocol to authenticate and authorize API requests. Use of the API, File Access Manager for OneDrive Connector requires a short authorization process during the definition of the OneDrive for Business application. After the initial authorization process, File Access Manager will handle OAuth token management automatically and refresh the token if needed. Note It might take up to two hours for events to be received by the File Access Manager for OneDrive Activity Monitor (a current Microsoft limitation). Monitored events and activities are as defined in the [Office365 Management Activity API](https://msdn.microsoft.com/en-us/library/office/mt607130.aspx#SharePointAuditOperations) specification. ## Permissions Collection Operation Principles File Access Manager OneDrive for Business permissions collection task uses the Microsoft OneDrive REST API. The permissions collection task queries OneDrive for Business for the existing Role Assignments to determine object permissions. An Azure Identity Collector must be configured to map the permissions to users and groups from the Azure Active Directory. Note The section on Identity collection in the File Access Manager Installation Guide provides more information on how to define an Azure Identity Collector. ## OneDrive Connector Installation Flow Overview To install the OneDrive connector: 1. Configure all the prerequisites. 1. Add a new OneDrive application in the File Access Manager website. 1. Install the relevant services: 1. Activity Monitor Note OneDrive currently does not support the Cloud-Ready architecture for permissions collection and data classification. Permission collection and data classification tasks will run on the central engine services associated with the application, regardless of whether these services have one or more collectors associated with the central engine. # Installing Services: Activity Monitor and Collectors The Collector Installation Manager is part of the File Access Manager installation package. This tool is used to install the activity monitor, permission collector, and data classification collector. 1. Run the Collector Installation Manager as an Administrator. The installation files are in the installation package under the Collectors folder. The Collector Installation Manager window displays. 1. Enter the credentials to connect to File Access Manager. - ServerName/IP should point to the Agent Configuration Manager service server. - An File Access Manager user with Collector Manager permission (permission to install collectors) is required. For Active Directory authentication, use the format `domain\username`. 1. Select Next. 1. If you are installing the Activity Monitor, select the application, and select **Add**. When installing a SharePoint Activity Monitor, you will be prompted for service account credentials. This service account will be used by the Activity Monitor service to run the service and authenticate against the SharePoint IIS servers to fetch the logs (“Log on as”). Make sure the service account provided has local administrator privileges on the local server (hosting the Activity Monitor service) and can access the activity logs on the IIS servers. 1. If you are installing the Permission Collector, select the Central Permission Collector to which to connect this service, and select **Add**. 1. If you are installing the Data Classification, select the Central Classification Collector to which to connect this service, and select **Add**. 1. Select Next. Note If this is the first time you are installing collectors on this machine, you will be prompted to select an installation folder, in which all future collectors will also be installed. 1. Browse and select the location of the target folder for installation. 1. Browse and select the location of the folder for system logs. 1. Select **Next**. The system begins installing the selected components. 1. Select **Finish**. The Finish button is displayed after all the selected components have been installed. Note The File Access Manager Administrator Guide provides more information on the collector services. # Prerequisites Make sure your system fits the descriptions below before starting the installation. ## Software Requirements File Access Manager requires the latest ASP.NET Core 8.0.x Hosting Bundle. This bundle consists of .NET Runtime and ASP .NET Core Runtime. You can download the latest 8.0.x Hosting Bundle version from [here](https://dotnet.microsoft.com/en-us/download/dotnet/8.0). ## Permissions **Activity Monitor** - To perform Activity Monitoring, the Azure AD application for OneDrive requires the ActivityFeed.Read permission to access the Office 365 Management APIs. **Permissions Collection** - To perform crawl and permissions collection, the Azure AD application for OneDrive requires the Sites.FullControl.All permission to access the SharePoint APIs. ## Communication Requirements | **Requirement** | **Source** | **Destination** | **Port** | | -------------------------------------------- | ------------------------------------------------------------------- | --------------------------- | --------- | | File Access Manager Access | Activity Monitor | File Access Manager Servers | 8000-8008 | | Permissions Collection / Data Classification | Permissions Collector/Data Classification | OneDrive | https | | Activity Monitoring | Activity Monitor | Office365 Activity API | https | | OAuth Access Token Acquisition | Permission Collector/Data Classification Collector/Activity Monitor | Microsoft Token Endpoint | https | **Access to the following over HTTPS** - https://{tenant-name}.sharepoint.com/\* - https://{tenant-name}-admin.sharepoint.com/\* - https://{tenant-name}-my.sharepoint.com/\* - \* - to monitor and collect event data, using the Microsoft Management API - \* - for OAuth access token acquisition. ### Azure Active Directory Connectivity Requirements The OneDrive Connector requires an AzureAD Identity Collector. File Access Manager uses the Microsoft Graph REST API – which works exclusively in HTTPS. The API base path is: , where the tenant domain name is the customer assigned domain name on Microsoft cloud. It is usually in the format of domain_name.onmicrosoft.com, but might be different in your configuration. **Resources that are accessed by File Access Manager using the REST graph API include:** - - - } - } - - } ## Creating an Azure Application for OneDrive A new Azure Active Directory application must be created and configured to support the File Access Manager OneDrive functionality. This configuration can be performed either by running the automated PowerShell script supplied with the SailPoint distribution pack, or by creating and configuring the application through the Azure portal. ### Creating and Configuring the Application Automatically There is a PowerShell script named CreateSharePointOnlineAndOneDriveApp.ps1 provided in the Collectors.zip under the extracted scripts sub-folder. This script will perform all the Azure application creation and configuration steps required for OneDrive. To run this script, the Azure AD PowerShell module must be installed. `Install-Module -Name AzureAD` Before running the script, open the file in a text editor to review the default parameters. The parameters can be edited in the file or passed as parameters when running the script. To run the script with the default parameters: `.\CreateSharePointOnlineAndOneDriveApp.ps1` To run the script while overriding some of the default parameters: `.\CreateSharePointOnlineAndOneDriveApp.ps1 -AppName "OneDrive FAM App" -CertDnsName "contoso.com" -CertYearsValid 15` When prompted, log in with administrator credentials to create and configure Azure applications. The last step of the script will launch a URL to grant admin consent for the application. After granting consent, the page will redirect to a missing localhost URL. The operation is successful if the URL for that page contains admin_consent=True. Note If you experience an access denied error or other error in the web browser when granting admin consent, this might be a timing issue. This can be resolved by either manually granting admin consent through the Azure portal (see section Grant admin consent manually), or by copying and pasting the consent URL (represented in the line from the script output that starts in "Consent URL: ") into your browser. The following output should be gathered or noted when running the script. This information will be used to configure the OneDrive application in File Access Manager: 1. The App ID value in the console output. 1. The created certificate file .pfx located in your working directory. 1. The certificate password that was entered when prompted. ### Creating and Configuring the Application Manually The following steps create and configure an Azure application for OneDrive authentication through the Azure portal. These steps are adapted from the online [Microsoft](https://docs.microsoft.com/en-us/sharepoint/dev/solution-guidance/security-apponly-azuread) documentation. #### Registering an Azure Active Directory Application Follow these steps to register an application in Azure Active Directory (Azure AD): 1. Open the Azure AD portal at . 1. Under Manage Azure Active Directory, select **View**. 1. On the Overview page, under Manage, select **App registrations**. 1. On the App registrations, select **New registration**. 1. On the Register an application page, configure the following settings: - **Name**: Enter something descriptive. For example, `OneDrive FAM App`. - **Supported account types**: Verify that **Accounts in this organizational directory only ( only - Single tenant)** is selected. - **Redirect URI (optional)**: Leave this field empty. 1. When you're finished, select **Register**. Note Leave the app page open. You'll use it in the next step. #### Assign API Permissions to the Application 1. On the app page under Manage, select **Manifest**. Locate the requiredResourceAccess entry. 1. Replace the entire requiredResourceAccess entry with the following: ```text "requiredResourceAccess": [ { "resourceAppId": "c5393580-f805-4401-95e8-94b7a6ef2fc2", "resourceAccess": [ { "id": "594c1fb6-4f81-4475-ae41-0c394909246c", "type": "Role" } ] }, { "resourceAppId": "00000003-0000-0ff1-ce00-000000000000", "resourceAccess": [ { "id": "678536fe-1083-478a-9c59-b99265e6b0d3", "type": "Role" } ] } ], ``` 1. Select **Save**. 1. On the Manifest page, under Manage, select **API permissions**. 1. On the API permissions page, verify that both Sites.FullControl.All and ActivityFeed.Read appear on the list. 1. Select **Grant admin consent for** and read the confirmation dialog that opens. 1. Select **Yes**. The Status value should now be Granted for on both entries. 1. Close the current API permissions page (not the browser tab) to return to the App registrations page. You will use it in an upcoming step. #### Generate a Self-Signed Certificate Create a self-signed x.509 certificate using the following PowerShell commands. Edit parameters such as DnsName, Certificate expiration, and password as appropriate: **# Create certificate** - `$mycert = New-SelfSignedCertificate -DnsName "contoso.org" -CertStoreLocation "cert:\LocalMachine\My" -NotAfter (Get-Date).AddYears(15) -KeySpec KeyExchange` **# Export certificate to .pfx file** - `$mycert | Export-PfxCertificate -FilePath mycert.pfx -Password $(ConvertTo-SecureString -String "P@ssw0Rd1234" -AsPlainText -Force)` **# Export certificate to .cer file** - `$mycert | Export-Certificate -FilePath mycert.cer` #### Assign the Certificate to the Azure Active Directory Application After you register the certificate with your application, you can use the private key (.pfx file) for authentication. 1. If you need to get back to the Apps registration page: 1. Open the Azure AD portal at 1. Under Manage Azure Active Directory, select View. 1. On the Overview page that opens, under Manage, select **App registrations**. 1. On the Apps registration page from the end of Step 2, select your application. 1. On the application page that opens, under Manage, select **Certificates & secrets**. 1. Select **Upload Certificate**. 1. Browse to the self-signed certificate (.cer file) that you created in Step 3. 1. Click **Add**. The certificate is now shown in the Certificates section. 1. Close the current Certificates & secrets page, and then the App registrations page to return to the main page. You'll use it in the next step. # Troubleshooting Check the issues below for common problems and suggested ways of handling them. ## Accounts do not Appear in the Resources Tree There are several reasons why the crawler might not identify all or part of the accounts, which would cause OneDrive accounts to either not appear in the resources tree, or appear only partially: **Uninitialized OneDrive accounts** - These are accounts which were never accessed and activated. These accounts can’t be crawled, nor will they appear in the resources tree. In the Crawl task details, you will see the following summary message: `Not initialized accounts: X (see logs for details)` Note X stands for the number of uninitialized accounts **Inaccessible OneDrive accounts** - These are accounts which were not granted the prerequisites Site Collection Administrator permissions and cannot be accessed. In the Crawl task details, you will see the following summary message: `Not accessible accounts: X (see logs for details)` Note X stands for the number of uninitialized accounts ## Partial Folder Structure For a OneDrive Account. Important This is the hardest problem to troubleshoot. It can happen when there is at least 1 publicly shared object (either a folder or file) under the OneDrive account, which makes it possible for external users to crawl it, but only the publicly shared objects will be returned. No error message is logged for these accounts, and you should verify that the required Site Collector Administrator permissions were granted. # Verifying the OneDrive Connector Installation ## Verifying Application Configuration After the configuration of one of the following applications is complete, verify it was properly configured by running the Test Connection task. The Test Connection will run and validate a series of checks to ensure the application was configured correctly. ### Common OneDrive Validations The following is a list of common validations that run when the test connection is executed with a OneDrive application: - Server responsiveness - Verifying the connectivity to the OneDrive API - Verifying the permissions to read file data through the API - Verifying that event auditing is active through the Office 365 API ## Installed Services Verify that the services installed for the connector are available and active. Using the Windows Service Manager, or another tool, look for the File Access Manager services and confirm they are running. For example: - **File Access Manager Central Application** - `` - **File Access Manager Central Data Classification** - `` ## Log Files Check the log files listed below for errors: - `"%SAILPOINT_HOME_LOGS%\FilesMiniFilter_.log"` - `"%SAILPOINT_HOME_LOGS%\PermissionCollection_.log"` - `"%SAILPOINT_HOME_LOGS%\DataClassification_.log"` - `"%SAILPOINT_HOME_LOGS%\OneDrive-.log"` ## Monitored Activities 1. Simulate activities on OneDrive. 1. Wait for about a minute. 1. Verify that the activities are displayed in the File Access Manager website under **Forensics > Activities**. ## Permissions Collection 1. Run the Crawler and Permissions Collector tasks (**Settings > Task Management > Scheduled Tasks**). 1. Verify that: - The tasks completed successfully. - Business resources were created in the Resource Explorer (**Admin > Applications > [application column] > Manage Resources**). - Permissions display in the Permission Forensics page (**Forensics > Permissions**). # Adding a New OneDrive Application To integrate with OneDrive, we need to create an application entry in File Access Manager. This entry will include the identification, connection details, and other parameters required to establish the link. 1. Navigate to **Admin** > **Applications**. 1. Select **Add New** to open the New Application Wizard. 1. Select **Standard Application** for the wizard type. 1. Select **Next** to open the **General Details** page. ## General Details 1. Complete the General Details: - Application Type - OneDrive for Business - Application Name - Logical name of the application - Description - Description of the application - Tags - Select tags for the application from the dropdown list or type a new name and press Enter to create a tag. The dropdown list of tags filters out matching tags as you type and displays up to 50 tags. !!! note ```text The tags replace the Logical container field that was used when creating applications in releases before 8.2. ``` - Event Manager Server - If there are multiple event manager servers configured in the system, you can select an event manager from the dropdown list. - Identity Collector - Select from the Identity Collector dropdown menu. You can create identity collectors in the administrative client by going to **Applications > Configuration > Permissions Management > Identity Collectors**. See section "OOTB Identity Collection" in the Collector Installation ManagerFile Access Manager Administrator Guide for further details. If adding a new identity collector, select the **Refresh** button to update the Identity Collector dropdown list. 1. Select **Next**. ## Connection Details 1. Complete the Connection Details: - Initial Domain Name - The Initial Domain Name that was given when the Azure tenant was initially created can be found in Microsoft 365 admin center > Settings > Domains. It can be identified by its .onmicrosoft.com suffix and that it cannot be deleted. - Application ID - Enter the Application ID for the Azure application used by the File Access Manager SharePoint Online Connector. - Certificate File - The certificate assigned to the Azure application used by the File Access Manager SharePoint Online Connector. Either navigate to the certificate by selecting Choose a File, or drag the certificate onto the Certificate File Path field. Supported file formats: pfx, p12. - Certificate Password - Enter the password for the certificate. Note When editing this application, if a new certificate is uploaded, the former password cannot be used. The user has to provide a new password. 1. Select Next. # Configuring Activity Monitoring Configure the activity monitoring process frequency. **Polling Interval (sec)** - Activity fetching interval [in seconds]). Default is set to 60 seconds, **Report Interval (sec)** - Activity Monitor Health reporting interval [in seconds]). Default is set yo 60 seconds. **Local Buffer Size (MB)** - Local buffer size for activities [ in MB]). Default is set to 200MB. This cyclic buffer is used to store activities on the Application Monitor’s machine in case of network errors that prevent the activities from being sent. **Activity Data Retention Period** - Disabled by default. When selecting the Clear Activity Data option, a user is able to provide a time frame (1 to 100) in either months or years for all activity to be retained. Once that time period is met, all data will be removed. A user can also select to backup the data before it is deleted by selecting the Backup Events Before Clearing option. Note The Backup Before Clearing Option will only be enabled if the backup option is set during the system installation. If a user has not selected the backup option during the installation nor provided a backup path, this option will not be enabled. ## Configuring Data Enrichment Connectors The Data Enrichment Connectors (DEC) configuration enables us to select data enrichment sources. These can be used to add information from other sources about identities. An enrichment source could be a local HR database that is used to combine users' job descriptions or departments to the information stored in the identity store. Select the data enrichment connectors to enrich monitored activities from the Available DECs text box. Use the > or >> arrows to move the selected DECs to the Current DECs text box. The user can select multiple DECs. Simply select each desired DEC. You can create a new DEC in the Administrative Client(Applications>Configuration>ActivityMonitoring>DataEnrichmentConnectors). After creating a new DEC, click Refresh to refresh the dropdown list. The chapter Connectors of the File Access Manager Administrator Guide provides more information on Data Enrichment Connectors, including what they are, how to configure them, and how they fit in the Activity Flow. # Selecting and Scheduling the Data Classification Settings To associate an application with a data classification service and set the schedule: 1. Go to **Admin > Applications**. 1. Scroll through the list or use the filter to find the application. 1. Select the **Edit** icon on the application row. 1. Select **Next** until you reach the **Permissions Collector** settings page. **Central Data Classification Service** - Associate the application with a Central Data Classification Service. This service is responsible for running the Data Classification tasks. If the “Central Data Classification” wasn’t installed during the installation of the server, this field is disabled. **Disabling Data Classification** - To disable data classification, delete the entry from the central data classification field. Disabling data classification can also be achieved by setting the scheduler to be inactive (which is the default setting for data classification). 1. You can now [schedule a task](#scheduling-a-task). ## Scheduling a Task To create a schedule: 1. Select **Create a Schedule**. 1. The system will provide a Schedule Name in the format `{appName} - {type} Scheduler`. Choose to keep or override this suggestion. 1. Select a scheduling frequency from the dropdown list. Schedule Frequency Options - Run After - Create dependency of tasks. The task starts running only upon successful completion of the first task. - Hourly - Set the start time. - Daily - Set the start date and time. - Weekly - Set the day(s) of the week on which to run. - Monthly - Set the day of the month on which to run a task. - Quarterly - Set a monthly schedule with an interval of 3 months. - Half Yearly - Set a monthly schedule with an interval of 6 months. - Yearly - Set a monthly schedule with an interval of 12 months. 1. Fill the Date and Time field with scheduling times. These fields differ depending upon the scheduling frequency selected. 1. Select the **Active** checkbox to activate the schedule. 1. Select **Next**. ## Data Privacy A user can associate the application with a Central Data Classification Engine Service. This engine will be responsible for executing Data Privacy tasks. Though using different processes for each, the Data Classification Engine Service is in charge of both Data Privacy and Data Classification discovery tasks. You may choose the same service for both, or use a different one for each, to run them in parallel. Note The fields on the Data Privacy step are the same as the Data Classification step. # Configuring and Scheduling the OneDrive Crawler Permissions can be analyzed to determine the application permissions of an out-of-the-box application, provided you have defined an identity store for File Access Manager to use in its analysis, and you have run a crawl for the application. ## Configuring the Permission Collection The permission collector is a software component responsible for analyzing the permissions in an application. Note If the File Access Manager Central Permission Collector wasn’t installed during server installation, this configuration setting will be disabled. To configure the permission collector: 1. Go to **Admin > Applications**. 1. Scroll through the list or use the filter to find the application. 1. Select the **Edit** icon on the application row. 1. Select **Next** until you reach the **Permissions Collector** settings page. Note The entry fields vary by application type. 1. Select **Central Permissions Collection** to create permissions collection services as part of the service installation process. 1. Select **Analyze Files with Unique Permissions**. 1. Select **Skip Identities Sync during Permissions Collection** to skip identity synchronization before running the permission collection tasks when the identity collector is common to different connector. This option is enabled by default. You can now [schedule a task](#scheduling-a-task). ## Scheduling a Task To create a schedule: 1. Select **Create a Schedule**. 1. The system will provide a Schedule Name in the format `{appName} - {type} Scheduler`. Choose to keep or override this suggestion. 1. Select a scheduling frequency from the dropdown list. Schedule Frequency Options - Run After - Create dependency of tasks. The task starts running only upon successful completion of the first task. - Hourly - Set the start time. - Daily - Set the start date and time. - Weekly - Set the day(s) of the week on which to run. - Monthly - Set the day of the month on which to run a task. - Quarterly - Set a monthly schedule with an interval of 3 months. - Half Yearly - Set a monthly schedule with an interval of 6 months. - Yearly - Set a monthly schedule with an interval of 12 months. 1. Fill the Date and Time field with scheduling times. These fields differ depending upon the scheduling frequency selected. 1. Select the **Active** checkbox to activate the schedule. 1. Select **Next**. ## Configuring and Scheduling the Crawler To configure the crawler: 1. Go to **Admin > Applications**. 1. Scroll through the list or use the filter to find the application. 1. Select the **Edit** icon on the application row. 1. Select **Next** until you reach the **Crawler & Permissions Collector** settings page. Note The entry fields vary by application type. **Calculate Resource Size** - Determine when, or at what frequency, File Access Manager calculates the resources' size. Select one of the following: - Never - Always - Second crawl and on (this is the default) You can now [schedule a task](#scheduling-a-task). ## Setting the Crawl Scope There are several options to set the crawl scope: - Setting explicit list of resources to include and / or exclude from the scan. - Creating a regex to define resources to exclude. ## Including and Excluding Paths by List To set the paths to include or exclude in the crawl process for an application: 1. Go to **Admin > Applications**. 1. Scroll through the list or use the filter to find the application. 1. Select the **Edit** icon on the application row. 1. Select **Next** until you reach the **Crawler & Permissions Collector** settings page. 1. Scroll down to the Crawl configuration settings. 1. Select **Advanced Crawl Scope Configuration** to open the scope configuration panel. 1. Select **Include / Exclude Resources** to open the input fields. 1. To add a resource to a list, type in the full path to include/exclude in the top field and select **+** to add it to the list. 1. To remove a resource from a list, find the resource from the list and select the **x icon** on the resource row. Note When creating exclusion lists, excludes take precedence over includes. ## Excluding Paths by Regex 1. Go to **Admin > Applications**. 1. Scroll through the list or use the filter to find the application. 1. Select the **Edit** icon on the application row. 1. Select **Next** until you reach the **Crawler & Permissions Collector** settings page. 1. Select Exclude Paths by Regex to open the configuration panel. 1. Type in the paths to exclude by Regex, See regex examples in the section below. Since the system does not collect BRs that match this Regex, it also does not analyze them for permissions. ## Crawler Regex Examples The following are examples of crawler Regex exclusions: **Exclude all drives which start with one or more user names:** - Exclude drives starting with John.Doe: `^Personal\/John\.Doe@.*` - Exclude drives starting with John.Doe or Jane.Doe: `^Personal\/(John|Jane)\.Doe@.*` **Include ONLY drives which start with one or more user names:** - Include only drives starting with John.Doe: `^(?!Personal\/John\.Doe@.*).*` - Include only drives starting with John.Doe or Jane.Doe: `^(?!Personal\/(John|Jane)\.Doe@.*).*` **Narrow down the selection:** - Include only the C$ drive shares: \\server_name\\C$: `^(?!\\\\server_name\\*C*\$($|\\.*)).*` - Include only one folder under a share: \\server\\share\\folderA: `^(?!\\\\server_name\\share\$($|\\*folderA*$|\\*folderA*\\.*)).*` - Include only administrative shares: `^(?!\\\\server_name\\[a-zA-Z]\$($|)).*` Notes - To use a backslash or `$` sign, add a backslash before it as an escape character. - To add a condition in a single command, use a pipe character `|`. ## Excluding Top-Level Resources Use the top-level exclusion screen to select top-level roots to exclude from the crawl. This setting is done per application. To exclude top-level resources from the crawl process: 1. Go to **Admin > Applications**. 1. Find the application to configure and select the dropdown list menu on the application line. Select **Exclude Top Level Resources** to open the configuration panel. 1. Select the **Run Task** button to trigger a task that runs a short detection scan to detect the current top-level resources. If the top-level resource list has changed in the application while you are on this screen, select the **Run Task** button to retrieve the updated structure. 1. Once triggered, you can view the task status in **Settings > Task Management > Tasks**, depending on your access to the task page. 1. When the task has completed, select **Refresh** to update the page with the list of top-level resources. 1. Select the top-level resource list and choose top-level resources to exclude. Note If all resources are selected and you wish for them to be deselected, select **Deselect All**. You can also select individual resources. 1. Select **Save** to save the change. 1. To refresh the list of top-level resources, run the task again. Running the task will not clear the list of top-level resources to exclude. ## Special Consideration for Long File Paths in Crawl If you need to support long file paths above 4,000 characters for the crawl, set the flag `excludeVeryLongResourcePaths` in the **Permission Collection Engine App.config** file to `true`. By default, this value will be commented out and set to `false`. This key ensures, when enabled, that paths longer than 4,000 characters are excluded from the applications’ resource discovery (Crawl), to avoid issues while storing them in the SQL Server database. When enabled, business resources with full paths longer than 4,000 characters, and everything included in the hierarchical structure below them, will be excluded from the crawl and will not be collected by File Access Manager. This scenario is extremely rare. Note You should not enable exclusion of long paths unless you experience an issue. **Background** File Access Manager uses a hashing mechanism to create a unique identifier for each business resource stored in the File Access Manager database. The hashing mechanism in SQL Server versions 2014 and earlier is unable to process (hash) values with 4,000 or more characters. Though resources with paths of 4,000 characters or longer are extremely rare, File Access Manager is designed to handle that limitation. **Identifying the Problem** When using an SQL Server database version 2014 and earlier, you may see the following error message in the Permission Collection Engine log file: `System.Data.SqlClient.SqlException (0x80131904): String or binary data would be truncated` In all other cases, this feature should not be enabled. **Setting the Long Resource Path Key** The Permission Collection Engine App.config file is `RoleAnalyticsServiceHost.exe.config`, and can be found in the folder `%SailPoint_Home%\FileAccessManager\[Permission Collection instance]\`. Search for the key excludeVeryLongResourcePaths and correct it as described above. # Capabilities This connector enables you to use File Access Manager to access and analyze data stored in SharePoint Online and perform the following tasks: - Analyze the structure of your stored data. - Monitor user activity in the resources. - Classify the data being stored. - Verify user permissions on the resources and compare them against requirements. - Manage access fulfillment — automated granting and revoking of access — according to rules set in File Access Manager. - Identity collector – collect IAM users, groups, and roles and the connections between them. See the File Access Manager documentation for a full description. ## Activity Monitor Operation Principles File Access Manager Activity Monitor for SharePoint Online uses the Microsoft Office365 Management Activity API. - The Activity Monitor queries the API for SharePoint events, which discards OneDrive for Business related events. - The Microsoft Office365 Management Activity API uses the OAuth 2.0 authorization protocol to authenticate and authorize API requests. Use of the API with the File Access Manager for SharePoint Online Connector requires a short authorization process during the definition of the SharePoint Online application. After the initial authorization process, File Access Manager will handle OAuth token management automatically and refresh the token if needed. Note It might take up to two hours for events to be received by the File Access Manager for SharePoint Online Activity Monitor (This is due to a current Microsoft limitation). ## Monitored Activities Monitored events and activities are as defined in the [Office365 Management Activity API specification](https://msdn.microsoft.com/en-us/library/office/mt607130.aspx#SharePointAuditOperations). ## Permissions Collection Operation Principles ### CSOM File Access Manager SharePoint Online permissions collection and crawling uses SharePoint Client-Side Object Model (CSOM). ### Azure Identity Collector The permissions collection task queries SharePoint Online for the existing Role Assignments to determine object permissions. An Azure Identity Collector must be configured to map the permissions to users and groups from the Azure Active Directory. ### Crawl Level: Folder vs File By default, permissions are analyzed to the folder level, but they can also be analyzed on the file level. If permissions are analyzed on the file level, the system will only display uniquely managed files in the Business Resource Tree. Adding a SharePoint Online Application describes how to analyze file level permissions. Note The section on “Identity collection” in the File Access Manager Administrator Guide provides more information on how to define an Azure Identity Collector. ## SharePoint Online Connector Installation Flow Overview To install the SharePoint Online connector: 1. Configure all the prerequisites. 1. Add a new SharePoint Online application in the File Access Manager website. 1. Install the relevant services: 1. Activity Monitor Note SharePoint Online currently does not support the Cloud-Ready architecture for permissions collection and data classification. Permission collection and data classification tasks will run on the central engine services associated with the application, regardless of whether these services have one or more collectors associated with the central engine. ## Microsoft Teams Support The SharePoint Online connector supports gathering permissions, monitoring activities, and classifying information being stored in Teams sites and channels. Files transferred through Teams chats are viewable under the Team site > Shared Documents > General. Files transferred through private chats are placed under the initiating user's OneDrive for Business Personal Drive and are managed by the File Access Manager OneDrive for Business Application. # Collecting Data Stored in an External Application ## Terminology - **Connector** - The collection of features, components and capabilities that comprise File Access Manager support for an endpoint. - **Collector** - The “Agent” component or service in a Data Classification and or Permission Collection architecture. - **Engine** - The core service counterpart of this architecture. - **Identity Collector** - A logical component used to fetch identities from an identity store and holds the configuration, settings for that identity store, and the relations between these identities. The identity collector has no “physical” manifest. The actual work is done by the Collector Synchronizer. ## Configuring Data Collection and Analysis The list below describes the high level installation process required to collect and analyze data from an external application. Most of these should already be set up in your File Access Manager installation. See the server Installation guide for further details. - **Install a Data Classification central engine** - One or more central engines, installed using the server installer. - **Install a Permission Collection central engine** - One or more central engines, installed using the server installer. - **Create an Application in File Access Manager** - From the Business Website. The application is linked to central engines listed above. - **Add an Activity Monitor** - To collect activities for this application - run the Collector Installation Manager and add an application under Activity Monitoring. # Installing Services: Activity Monitor and Collectors The Collector Installation Manager is part of the File Access Manager installation package. This tool is used to install the activity monitor, permission collector, and data classification collector. 1. Run the Collector Installation Manager as an Administrator. The installation files are in the installation package under the Collectors folder. The Collector Installation Manager window displays. 1. Enter the credentials to connect to File Access Manager. - ServerName/IP should point to the Agent Configuration Manager service server. - An File Access Manager user with Collector Manager permission (permission to install collectors) is required. For Active Directory authentication, use the format `domain\username`. 1. Select **Next**. 1. If you are installing the Activity Monitor, select the application, and select **Add**. When installing a SharePoint Activity Monitor, you will be prompted for service account credentials. This service account will be used by the Activity Monitor service to run the service and authenticate against the SharePoint IIS servers to fetch the logs (“Log on as”). Make sure the service account provided has local administrator privileges on the local server (hosting the Activity Monitor service) and can access the activity logs on the IIS servers. 1. If you are installing the Permission Collector, select the Central Permission Collector to which to connect this service, and select **Add**. 1. If you are installing the Data Classification, select the Central Classification Collector to which to connect this service, and select **Add**. 1. Select Next. Note If this is the first time you are installing collectors on this machine, you will be prompted to select an installation folder, in which all future collectors will also be installed. 1. Browse and select the location of the target folder for installation. 1. Browse and select the location of the folder for system logs. 1. Select **Next**. The system begins installing the selected components. 1. Select **Finish**. The Finish button is displayed after all the selected components have been installed. Note The File Access Manager Administrator Guide provides more information on the collector services. # Prerequisites Make sure your system fits the descriptions below before starting the installation. ## Software Requirements File Access Manager requires the latest ASP.NET Core 8.0.x Hosting Bundle. This bundle consists of .NET Runtime and ASP .NET Core Runtime. You can download the latest 8.0.x Hosting Bundle version from [here](https://dotnet.microsoft.com/en-us/download/dotnet/8.0). ## Permissions **Activity Monitor** - To perform Activity Monitoring, the Azure AD application for SharePoint Online requires the ActivityFeed.Read permission to access the Office 365 Management APIs. **Permissions Collection** - To perform crawl and permissions collection, the Azure AD application for SharePoint Online requires the Sites.FullControl.All permission to access the SharePoint APIs. ## Communication Requirements | **Requirement** | **Source** | **Destination** | **Port** | | -------------------------------------------- | ------------------------------------------------------------------- | --------------------------- | --------- | | File Access Manager Access | Activity Monitor | File Access Manager Servers | 8000-8008 | | Permissions Collection / Data Classification | Permissions Collector/Data Classification | SharePoint Online | https | | Activity Monitoring | Activity Monitor | Office365 Activity API | https | | OAuth Access Token Acquisition | Permission Collector/Data Classification Collector/Activity Monitor | Microsoft Token Endpoint | https | **Access to the following over HTTPS** - https://{tenant-name}.sharepoint.com/\* - https://{tenant-name}-admin.sharepoint.com/\* - https://{tenant-name}-my.sharepoint.com/\* - \* - to monitor and collect event data, using the Microsoft Management API - \* - for OAuth access token acquisition. ## Creating an Azure Application for SharePoint Online A new Azure Active Directory application must be created and configured to support the File Access Manager SharePoint Online functionality. This configuration can be performed either by running the automated PowerShell script supplied with the SailPoint distribution pack, or by creating and configuring the application through the Azure portal. ### Creating and Configuring the Application Automatically There is a PowerShell script named CreateSharePointOnlineAndSharePoint OnlineApp.ps1 provided in the Collectors.zip under the extracted scripts sub-folder. This script will perform all the Azure application creation and configuration steps required for SharePoint Online. To run this script, the Azure AD PowerShell module must be installed. `Install-Module -Name AzureAD` Before running the script, open the file in a text editor to review the default parameters. The parameters can be edited in the file or passed as parameters when running the script. To run the script with the default parameters: `.\CreateSharePointOnlineAndSharePoint OnlineApp.ps1` To run the script while overriding some of the default parameters: `.\CreateSharePointOnlineAndSharePoint OnlineApp.ps1 -AppName "SharePoint Online FAM App" -CertDnsName "contoso.com" -CertYearsValid 15` When prompted, log in with administrator credentials to create and configure Azure applications. The last step of the script will launch a URL to grant admin consent for the application. After granting consent, the page will redirect to a missing localhost URL. The operation is successful if the URL for that page contains admin_consent=True. Note If you experience an access denied error or other error in the web browser when granting admin consent, this might be a timing issue. This can be resolved by either manually granting admin consent through the Azure portal (see section Grant admin consent manually), or by copying and pasting the consent URL (represented in the line from the script output that starts in "Consent URL: ") into your browser. The following output should be gathered or noted when running the script. This information will be used to configure the SharePoint Online application in File Access Manager: 1. The App ID value in the console output. 1. The created certificate file .pfx located in your working directory. 1. The certificate password that was entered when prompted. ### Creating and Configuring the Application Manually The following steps create and configure an Azure application for SharePoint Online authentication through the Azure portal. These steps are adapted from the online [Microsoft](https://docs.microsoft.com/en-us/sharepoint/dev/solution-guidance/security-apponly-azuread) documentation. #### Registering an Azure Active Directory Application Follow these steps to register an application in Azure Active Directory (Azure AD): 1. Open the Azure AD portal at . 1. Under Manage Azure Active Directory, select **View**. 1. On the Overview page, under Manage, select **App registrations**. 1. On the App registrations, select **New registration**. 1. On the Register an application page, configure the following settings: - **Name**: Enter something descriptive. For example, `SharePoint Online FAM App`. - **Supported account types**: Verify that **Accounts in this organizational directory only ( only - Single tenant)** is selected. - **Redirect URI (optional)**: Leave this field empty. 1. When you're finished, select **Register**. Note Leave the app page open. You'll use it in the next step. #### Assign API Permissions to the Application 1. On the app page under Manage, select **Manifest**. Locate the requiredResourceAccess entry. 1. Replace the entire requiredResourceAccess entry with the following: ```text "requiredResourceAccess": [ { "resourceAppId": "c5393580-f805-4401-95e8-94b7a6ef2fc2", "resourceAccess": [ { "id": "594c1fb6-4f81-4475-ae41-0c394909246c", "type": "Role" } ] }, { "resourceAppId": "00000003-0000-0ff1-ce00-000000000000", "resourceAccess": [ { "id": "678536fe-1083-478a-9c59-b99265e6b0d3", "type": "Role" } ] } ], ``` 1. Select **Save**. 1. On the Manifest page, under Manage, select **API permissions**. 1. On the API permissions page, verify that both Sites.FullControl.All and ActivityFeed.Read appear on the list. 1. Select **Grant admin consent for** and read the confirmation dialog that opens. 1. Select **Yes**. The Status value should now be Granted for on both entries. 1. Close the current API permissions page (not the browser tab) to return to the App registrations page. You will use it in an upcoming step. #### Generate a Self-Signed Certificate Create a self-signed x.509 certificate using the following PowerShell commands. Edit parameters such as DnsName, Certificate expiration, and password as appropriate: **# Create certificate** - `$mycert = New-SelfSignedCertificate -DnsName "contoso.org" -CertStoreLocation "cert:\LocalMachine\My" -NotAfter (Get-Date).AddYears(15) -KeySpec KeyExchange` **# Export certificate to .pfx file** - `$mycert | Export-PfxCertificate -FilePath mycert.pfx -Password $(ConvertTo-SecureString -String "P@ssw0Rd1234" -AsPlainText -Force)` **# Export certificate to .cer file** - `$mycert | Export-Certificate -FilePath mycert.cer` #### Assign the Certificate to the Azure Active Directory Application After you register the certificate with your application, you can use the private key (.pfx file) for authentication. 1. If you need to get back to the Apps registration page: 1. Open the Azure AD portal at 1. Under Manage Azure Active Directory, select View. 1. On the Overview page that opens, under Manage, select **App registrations**. 1. On the Apps registration page from the end of Step 2, select your application. 1. On the application page that opens, under Manage, select **Certificates & secrets**. 1. Select **Upload Certificate**. 1. Browse to the self-signed certificate (.cer file) that you created in Step 3. 1. Click **Add**. The certificate is now shown in the Certificates section. 1. Close the current Certificates & secrets page, and then the App registrations page to return to the main page. You'll use it in the next step. # Verifying the SharePoint Online Connector Installation ## Verifying Application Configuration After the configuration of one of the following applications is complete, verify it was properly configured by running the Test Connection\*task. The Test Connection will run and validate a series of checks to ensure the application was configured correctly. ### Common SharePoint Online Validations The following is a list of common validations that run when the test connection is executed with a SharePoint Online application: - Server responsiveness - Verifying there is a connection with SharePoint Online - Verifying access to the admin site - Verifying the ability to list site collections - Verifying the API permissions are correctly configured - Verifying that event auditing is active through the Office 365 API ## Installed Services Verify that the services installed for the connector are available and active. Using Windows Service Manager, or another tool, look for the \*File Acc Manager services and confirm they are running. For example: - **File Access Manager Central Activity Monitor** - `` - **File Access Manager Central Permissions Collection** - `` - **File Access Manager Central Data Classification** - `` ## Log Files Check the log files listed below for errors: - `"%SAILPOINT_HOME_LOGS%\FilesMiniFilter_.log"` - `"%SAILPOINT_HOME_LOGS%\PermissionCollection_.log"` - `"%SAILPOINT_HOME_LOGS%\DataClassification_.log"` - `"%SAILPOINT_HOME_LOGS%\SharePointOnline-.log"` ## Monitored Activities 1. Simulate activities on SharePoint Online. 1. Wait for about a minute. 1. Verify that the activities are displayed in the File Access Manager website under **Forensics > Activities**. ## Permissions Collection 1. Run the Crawler and Permissions Collector tasks (**Settings > Task Management > Scheduled Tasks**). 1. Verify that: - The tasks completed successfully. - Business resources were created in the Resource Explorer (**Admin > Applications > [application column] > Manage Resources**). - Permissions display in the Permission Forensics page (**Forensics > Permissions**). # Adding a New SharePoint Online Application To integrate with SharePoint Online, we need to create an application entry in File Access Manager. This entry will include the identification, connection details, and other parameters required to establish the link. 1. Navigate to **Admin** > **Applications**. 1. Select **Add New** to open the New Application Wizard. 1. Select **Standard Application** for the wizard type. 1. Select **Next** to open the **General Details** page. ## General Details 1. Complete the General Details: - Application Type - SharePoint Online for Business - Application Name - Logical name of the application - Description - Description of the application - Tags - Select tags for the application from the dropdown list or type a new name and press Enter to create a tag. The dropdown list of tags filters out matching tags as you type and displays up to 50 tags. !!! note ```text The tags replace the Logical container field that was used when creating applications in releases before 8.2. ``` - Event Manager Server - If there are multiple event manager servers configured in the system, you can select an event manager from the dropdown list. - Identity Collector - Select from the Identity Collector dropdown menu. You can create identity collectors in the administrative client by going to **Applications > Configuration > Permissions Management > Identity Collectors**. See section "OOTB Identity Collection" in the Collector Installation ManagerFile Access Manager Administrator Guide for further details. If adding a new identity collector, select the **Refresh** button to update the Identity Collector dropdown list. 1. Select **Next**. ## Connection Details 1. Complete the Connection Details: - Initial Domain Name - The Initial Domain Name that was given when the Azure tenant was initially created can be found in **Microsoft 365 admin center > Settings > Domains**. It can be identified by its .onmicrosoft.com suffix and that it cannot be deleted. - Application ID - Enter the Application ID for the Azure application used by the File Access Manager SharePoint Online Connector. - Certificate File - The certificate assigned to the Azure application used by the File Access Manager SharePoint Online Connector. Either navigate to the certificate by selecting Choose a File, or drag the certificate onto the Certificate File Path field. Supported file formats: pfx, p12. - Certificate Password - Enter the password for the certificate. Note When editing this application, if a new certificate is uploaded, the former password cannot be used. The user has to provide a new password. 1. Select Next. # Configuring Activity Monitoring Configure the activity monitoring process frequency. **Polling Interval (sec)** - Activity fetching interval [in seconds]). Default is set to 60 seconds, **Report Interval (sec)** - Activity Monitor Health reporting interval [in seconds]). Default is set yo 60 seconds. **Local Buffer Size (MB)** - Local buffer size for activities [ in MB]). Default is set to 200MB. This cyclic buffer is used to store activities on the Application Monitor’s machine in case of network errors that prevent the activities from being sent. **Activity Data Retention Period** - Disabled by default. When selecting the Clear Activity Data option, a user is able to provide a time frame (1 to 100) in either months or years for all activity to be retained. Once that time period is met, all data will be removed. A user can also select to backup the data before it is deleted by selecting the Backup Events Before Clearing option. Note The Backup Before Clearing Option will only be enabled if the backup option is set during the system installation. If a user has not selected the backup option during the installation nor provided a backup path, this option will not be enabled. ## Configuring Data Enrichment Connectors The Data Enrichment Connectors (DEC) configuration enables us to select data enrichment sources. These can be used to add information from other sources about identities. An enrichment source could be a local HR database that is used to combine users' job descriptions or departments to the information stored in the identity store. Select the data enrichment connectors to enrich monitored activities from the Available DECs text box. Use the > or >> arrows to move the selected DECs to the Current DECs text box. The user can select multiple DECs. Simply select each desired DEC. You can create a new DEC in the Administrative Client (Applications>Configuration>ActivityMonitoring>DataEnrichmentConnectors). After creating a new DEC, select **Refresh** to refresh the dropdown list. The chapter Connectors of the File Access Manager Administrator Guide provides more information on Data Enrichment Connectors, including what they are, how to configure them, and how they fit in the Activity Flow. # Selecting and Scheduling the Data Classification Settings To associate an application with a data classification service and set the schedule: 1. Go to **Admin > Applications**. 1. Scroll through the list or use the filter to find the application. 1. Select the **Edit** icon on the application row. 1. Select **Next** until you reach the **Permissions Collector** settings page. **Central Data Classification Service** - Associate the application with a Central Data Classification Service. This service is responsible for running the Data Classification tasks. If the “Central Data Classification” wasn’t installed during the installation of the server, this field is disabled. **Disabling Data Classification** - To disable data classification, delete the entry from the central data classification field. Disabling data classification can also be achieved by setting the scheduler to be inactive (which is the default setting for data classification). 1. You can now [schedule a task](#scheduling-a-task). ## Scheduling a Task To create a schedule: 1. Select **Create a Schedule**. 1. The system will provide a Schedule Name in the format `{appName} - {type} Scheduler`. Choose to keep or override this suggestion. 1. Select a scheduling frequency from the dropdown list. Schedule Frequency Options - Run After - Create dependency of tasks. The task starts running only upon successful completion of the first task. - Hourly - Set the start time. - Daily - Set the start date and time. - Weekly - Set the day(s) of the week on which to run. - Monthly - Set the day of the month on which to run a task. - Quarterly - Set a monthly schedule with an interval of 3 months. - Half Yearly - Set a monthly schedule with an interval of 6 months. - Yearly - Set a monthly schedule with an interval of 12 months. 1. Fill the Date and Time field with scheduling times. These fields differ depending upon the scheduling frequency selected. 1. Select the **Active** checkbox to activate the schedule. 1. Select **Next**. ## Data Privacy A user can associate the application with a Central Data Classification Engine Service. This engine will be responsible for executing Data Privacy tasks. Though using different processes for each, the Data Classification Engine Service is in charge of both Data Privacy and Data Classification discovery tasks. You may choose the same service for both, or use a different one for each, to run them in parallel. Note The fields on the Data Privacy step are the same as the Data Classification step. # Configuring and Scheduling the OneDrive Crawler Permissions can be analyzed to determine the application permissions of an out-of-the-box application, provided you have defined an identity store for File Access Manager to use in its analysis, and you have run a crawl for the application. ## Configuring the Permission Collection The permission collector is a software component responsible for analyzing the permissions in an application. The Central Permission Collector Service is responsible for running the Permission Collector and Crawler tasks. Note If using a proxy in your File Access Manager environment, see How to Use Proxy in a File Access Manager Environment in the Azure File Guide. To configure the permission collector: 1. Go to **Admin > Applications**. 1. Scroll through the list or use the filter to find the application. 1. Select the **Edit** icon on the application row. 1. Select **Next** until you reach the **Permissions Collector** settings page. Note The entry fields vary by application type. 1. Select **Central Permissions Collection** to create permissions collection services as part of the service installation process. 1. Select **Skip Identities Sync during Permissions Collection** to skip identity synchronization before running the permission collection tasks when the identity collector is common to different connector. This option is enabled by default. You can now [schedule a task](#scheduling-a-task). ## Scheduling a Task To create a schedule: 1. Select **Create a Schedule**. 1. The system will provide a Schedule Name in the format `{appName} - {type} Scheduler`. Choose to keep or override this suggestion. 1. Select a scheduling frequency from the dropdown list. Schedule Frequency Options - Run After - Create dependency of tasks. The task starts running only upon successful completion of the first task. - Hourly - Set the start time. - Daily - Set the start date and time. - Weekly - Set the day(s) of the week on which to run. - Monthly - Set the day of the month on which to run a task. - Quarterly - Set a monthly schedule with an interval of 3 months. - Half Yearly - Set a monthly schedule with an interval of 6 months. - Yearly - Set a monthly schedule with an interval of 12 months. 1. Fill the Date and Time field with scheduling times. These fields differ depending upon the scheduling frequency selected. 1. Select the **Active** checkbox to activate the schedule. 1. Select **Next**. ## Configuring and Scheduling the Crawler To configure the crawler: 1. Go to **Admin > Applications**. 1. Scroll through the list or use the filter to find the application. 1. Select the **Edit** icon on the application row. 1. Select **Next** until you reach the **Crawler & Permissions Collector** settings page. Note The entry fields vary by application type. **Calculate Resource Size** - Determine when, or at what frequency, File Access Manager calculates the resources' size. Select one of the following: - Never - Always - Second crawl and on (this is the default) You can now [schedule a task](#scheduling-a-task). ## Setting the Crawl Scope There are several options to set the crawl scope: - Setting explicit list of resources to include and / or exclude from the scan. - Creating a regex to define resources to exclude. ## Including and Excluding Paths by List To set the paths to include or exclude in the crawl process for an application: 1. Go to **Admin > Applications**. 1. Scroll through the list or use the filter to find the application. 1. Select the **Edit** icon on the application row. 1. Select **Next** until you reach the **Crawler & Permissions Collector** settings page. 1. Scroll down to the Crawl configuration settings. 1. Select **Advanced Crawl Scope Configuration** to open the scope configuration panel. 1. Select **Include / Exclude Resources** to open the input fields. 1. To add a resource to a list, type in the full path to include/exclude in the top field and select **+** to add it to the list. 1. To remove a resource from a list, find the resource from the list and select the **x icon** on the resource row. Note When creating exclusion lists, excludes take precedence over includes. ## Excluding Paths by Regex 1. Go to **Admin > Applications**. 1. Scroll through the list or use the filter to find the application. 1. Select the **Edit** icon on the application row. 1. Select **Next** until you reach the **Crawler & Permissions Collector** settings page. 1. Select **Exclude Paths by Regex** to open the configuration panel. 1. Type in the paths to exclude by Regex, See regex examples in the section below. Since the system does not collect BRs that match this Regex, it also does not analyze them for permissions. ## Crawler Regex Examples The following are examples of crawler Regex exclusions: **Exclude all resources which start with one or more resource names:** - Example: Starting with - Regex: https://[www.mysharepoint.com](http://www.mysharepoint.com)/resourceName$ - Example: Starting with \\resourceName or //[www.mysharepoint.com/OtherResourceName](http://www.mysharepoint.com/OtherResourceName) - Regex: https://[www.mysharepoint.com](http://www.mysharepoint.com)/(resourceName|OtherResourceName)$ - Example: SharePoint resources starting with - Regex: https://[www.mysharepoint.com](http://www.mysharepoint.com)/sites/mySiteCollection$ - Example: SharePoint resources starting with or site/Different Site - Regex: https://[www.mysharepoint.com](http://www.mysharepoint.com)/(sites/mySiteCollection|other_site/Different_Site)$ **Include ONLY resources which start with one or more resources names:** - Example: ^(?!https://[www.mysharepoint.com](http://www.mysharepoint.com)/resourceName($|/.*)).* - Regex: ^(?!https://[www.mysharepoint.com](http://www.mysharepoint.com)/resourceName($|/.*)).* - Example: Starting with or - Regex: ^(?!https://[www.mysharepoint.com](http://www.mysharepoint.com)/(resourceName|OtherResourceName)($|/.*)).* - Example: SharePoint resources starting with - Regex: ^(?!https://[www.mysharepoint.com](http://www.mysharepoint.com)/sites/mySiteCollection($|/.*)).* - Example: SharePoint resources starting with or site/Different_Site - Regex: ^(?!https://[www.mysharepoint.com](http://www.mysharepoint.com)/(sites/mySiteCollection|other\_ site/Different_Site)($|/.*)).* ## Excluding Top-Level Resources Use the top-level exclusion screen to select top-level roots to exclude from the crawl. This setting is done per application. To exclude top-level resources from the crawl process: 1. Go to **Admin > Applications**. 1. Find the application to configure and select the dropdown list menu on the application line. Select **Exclude Top Level Resources** to open the configuration panel. 1. Select the **Run Task** button to trigger a task that runs a short detection scan to detect the current top-level resources. If the top-level resource list has changed in the application while you are on this screen, select the **Run Task** button to retrieve the updated structure. 1. Once triggered, you can view the task status in **Settings > Task Management > Tasks**, depending on your access to the task page. 1. When the task has completed, select **Refresh** to update the page with the list of top-level resources. 1. Select the top-level resource list and choose top-level resources to exclude. Note If all resources are selected and you wish for them to be deselected, select **Deselect All**. You can also select individual resources. 1. Select **Save** to save the change. 1. To refresh the list of top-level resources, run the task again. Running the task will not clear the list of top-level resources to exclude. ## Special Consideration for Long File Paths in Crawl If you need to support long file paths above 4,000 characters for the crawl, set the flag `excludeVeryLongResourcePaths` in the **Permission Collection Engine App.config** file to `true`. By default, this value will be commented out and set to `false`. This key ensures, when enabled, that paths longer than 4,000 characters are excluded from the applications’ resource discovery (Crawl), to avoid issues while storing them in the SQL Server database. When enabled, business resources with full paths longer than 4,000 characters, and everything included in the hierarchical structure below them, will be excluded from the crawl and will not be collected by File Access Manager. This scenario is extremely rare. Note You should not enable exclusion of long paths unless you experience an issue. **Background** File Access Manager uses a hashing mechanism to create a unique identifier for each business resource stored in the File Access Manager database. The hashing mechanism in SQL Server versions 2014 and earlier is unable to process (hash) values with 4,000 or more characters. Though resources with paths of 4,000 characters or longer are extremely rare, File Access Manager is designed to handle that limitation. **Identifying the Problem** When using an SQL Server database version 2014 and earlier, you may see the following error message in the Permission Collection Engine log file: `System.Data.SqlClient.SqlException (0x80131904): String or binary data would be truncated` In all other cases, this feature should not be enabled. **Setting the Long Resource Path Key** The Permission Collection Engine App.config file is `RoleAnalyticsServiceHost.exe.config`, and can be found in the folder `%SailPoint_Home%\FileAccessManager\[Permission Collection instance]\`. Search for the key excludeVeryLongResourcePaths and correct it as described above. # On-Premise File Storage The following are File Access Manager supported connectors: - Exchange - Generic Table - Linux - NFS - SharePoint - Windows File Server # Connector Overview Monitoring Microsoft Exchange On-Premises is based on standard Microsoft Exchange monitoring capabilities. Access to Exchange On-Premises is based on [Remote Power Shell capabilities](https://docs.microsoft.com/en-us/powershell/module/exchange/set-mailbox?redirectedfrom=MSDN&view=exchange-ps). Audit types include: **Mailbox Access Audit** - Administrators who access other users’ mailboxes - Users who access other users’ mailboxes as delegates - Owners who access their own mailbox **Administrator Audit PowerShell Cmdlets** - Every Set-\* PowerShell is audited Important It is not recommended to enable Owner auditing on all mailboxes, due to Exchange overload and DB size. ## Capabilities This connector enables you to use File Access Manager to access and analyze data stored in Exchange and do the following: - Analyze the structure of your stored data. - Monitor user activity in the resources. - Classify the data being stored. - Verify user permissions on the resources, and compare them against requirements. - Manage access fulfillment - automated granting and revoking of access - according to rules set in File Access Manager. - Identity collector – collect IAM users, groups and roles and the connections between them. ## Exchange Installation Flow Overview To install the Exchange connector: 1. Configure all the prerequisites. 1. Add a new Exchange application in the Business Website. 1. Install the relevant services: - Activity Monitor - This is the activity collection engine, used by all connectors that support activity monitoring. - Permissions CollectorIf you are using EC2 login, the collector should be installed on the EC2 instance. - Data Classification Collector. Important Installing the permissions collector and data classification services is optional and should only be installed by someone with a full understanding of File Access Manager deployment architecture. The File Access Manager Administrator Guide has additional information on the architecture. ## Permissions Collection Operation Principle The File Access Manager Connector connects using the PowerShell interface and analyzes mailboxes, folders, public folders, and their permissions. ## Mailbox Audit 1. Mailbox audit events are assigned to the relevant mailbox business resource. 1. The list of monitored mailbox types can be found in the `BAMFramework.exe.config` file under the `recipientTypeDetailsToMonitor` setting. By default, the following types are defined and monitored: - UserMailbox - SharedMailbox Note Additional mailbox types can be added to this list, for reference follow this link. ## Monitored Activities | Action | Description | Admin | Delegate | Owner | | ------------------ | ---------------------------------------------------------------------------------------------------------------------------- | ----- | -------- | ----- | | Copy | An item is copied to another folder. | Yes | Yes | No | | Create | An item is created in the mailbox. (For example, a message is sent or received.) Note that folder creation isn't audited.Yes | Yes | Yes | | | FolderBind | A mailbox folder is accessed.Yes | Yes | No | | | HardDelete | An item is deleted permanently from the Recoverable Items folder. | Yes | Yes | Yes | | MessageBind | An item is accessed in the reading pane or opened. | Yes | No | No | | Move | An item is moved to another folder. | Yes | Yes | Yes | | MoveToDeletedItems | An item is moved to the Deleted Items folder. | Yes | Yes | Yes | | SendAs | A message is sent using Send As permissions. | Yes | Yes | N/A | | SendOnBehalf | A message is sent using Send on Behalf permissions. | Yes | Yes | N/A | | SoftDelete | An item is deleted from the Deleted Items folder. | Yes | Yes | Yes | | Update | An item's properties are updated. | Yes | Yes | Yes | ## Exclusion of Specific Mailboxes from Auditing Specific mailboxes can be excluded from Auditing by setting a configurable key in the Application Monitor app.config file. To exclude mailboxes, set the `mailboxAuditExcludeByFilter` under the AppSetting tag with a regular expression that matches only the names of the mailboxes to be excluded. Use this setting to exclude a relatively small number of mailboxes from Auditing, when in Full Learning mode. The No Learning mode configuration is preferable if many mailboxes are excluded from auditing. **Example** Journal mailboxes monitor and register every Exchange Server event, which doubles the number of generated events. Use this feature to exclude them. After all mailboxes have been fetched from the Exchange server, the system applies a filter on the returned result set to filter out excluded mailboxes. All other mailboxes will be audited, subject to the setting defined. Note The defined setting only affects the mailbox Audit and does not affect Admin Audit events. By default, the system removes all Audit settings from all monitored mailboxes (including those excluded by the Exclude Audit by Filter operation) when the Application monitor service stops running. This prevents unnecessary Audit settings from remaining after other changes have been made to the Application Monitor configuration over time. ## Admin Audit Events (Administrator Audit Logging) File Access Manager features the following Admin audit events: 1. General Admin audit events are assigned to a special resource (*Audit Admin*). 1. Admin audit events that relate to a specific mailbox are assigned to the mailbox business resource. - The list of commands can be found in the framework configuration file in the `mailboxAuditLogCmdLets` setting. For Exchange: The config file is WBX.Exchange2010BAMHost.dll.config. For Exchange Online it is WBX.ExchangeOnlineBAMHost.dll.config - By default, the following are defined as mailbox commands: - Remove-Mailbox - New-Mailbox - Set-Mailbox - Add-MailboxPermission - Remove-MailboxPermission - Set-MailboxAutoReplyConfiguration 1. Admin audit events related to a specific mailbox folder are assigned to the mailbox folder business resource. - The list of commands can be found in the BAMFramework.exe.config file in the - `mailboxFolderAuditLogCmdLets` setting. - By default, the following are defined as mailbox folder commands: - Add-MailboxFolderPermission - Remove-MailboxFolderPermission - Set-MailboxFolderPermission 1. Admin audit events related to a specific public folder are assigned to the public folder business resource. - The list of commands can be found in the BAMFramework.exe.config file in the `publicFolderAuditLogCmdLets` setting. - By default, the following commands are defined as public folder commands: - Add-PublicFolderClientPermission - Remove-PublicFolderClientPermission - New-PublicFolder - Remove-PublicFolder - Add-PublicFolderAdministrativePermission - Remove-PublicFolderAdministrativePermission # Collecting Data Stored in an External Application ## Terminology - **Connector** - The collection of features, components and capabilities that comprise File Access Manager support for an endpoint. - **Collector** - The “Agent” component or service in a Data Classification and or Permission Collection architecture. - **Engine** - The core service counterpart of this architecture. - **Identity Collector** - A logical component used to fetch identities from an identity store and holds the configuration, settings for that identity store, and the relations between these identities. The identity collector has no “physical” manifest. The actual work is done by the Collector Synchronizer. The list below describes the high level installation process required to collect and analyze data from an external application. Most of these should already be set up in your File Access Manager installation. See the server Installation guide for further details. - **Install a Data Classification central engine** - One or more central engines, installed using the server installer - **Install a Permission Collection central engine** - One or more central engines, installed using the server installer - **Create an Application in File Access Manager** - From the Business Website. The application is linked to central engines listed above. - **Add an Activity Monitor** - To collect activities for this application - run the Collector Installation Manager and add an application under Activity Monitoring. ## Install Permission Collectors and / or Data Classification Collector (optional) Optionally, you can install collectors that will run on a separate server and take some of the work from the central PC and DC engines (Where supported). When installing a collector, you attach it to an engine. If no collectors are installed, the central services act as both the engine and the collector. To install a collector, you must have the **RabbitMQ** service installed for communication between the central engines and the collectors. RabbitMQ is installed Note Some cloud connectors ignore collectors connected to the central engine. (Box, Dropbox, OneDrive, SharePointOnline, Exchange Online, GoogleDrive) . In these applications the task will be done entirely by the engine, and not relegated to its collectors. Note For further details, see section **Application > Central Service > Collector Relations** in the File Access Manager Administrator Guide (**Add link**). # Installing Services: Activity Monitor and Collectors The Collector Installation Manager is part of the File Access Manager installation package. This tool is used to install the activity monitor, permission collector, and data classification collector. 1. Run the **Collector Installation Manager** as an Administrator. The installation files are in the installation package under the folder Collectors. The Collector Installation Manager window displays. 1. Enter the credentials to connect to File Access Manager. - ServerName/IP should be pointed to the Agent Configuration Manager service server. - An File Access Manager user with Collector Manager permission (permission to install collectors). For Active Directory authentication, use the format domain\\username. 1. Select **Next**.The Service Configuration window displays. 1. If you are installing the Activity Monitor, select the application, and select **Add**. 1. When installing a SharePoint Activity Monitor, you will be prompted for service account credentials. This service account will be used by the Activity Monitor service to run the service and authenticate against the SharePoint IIS servers to fetch the logs (“Log on as”). Make sure the service account provided has local administrator privileges on the local server (hosting the Activity Monitor service) and can access the activity logs on the IIS servers. 1. If you are installing the Permission Collector, select the Central Permission Collector to which to connect this service, and select **Add**. 1. If you are installing the Data Classification, select the Central Classification Collector to which to connect this service, and select **Add**. 1. Select **Next**.The Installation Folder window displays.If this is the first time you are installing collectors on this machine, you will be prompted to select an installation folder, in which all future collectors will also be installed. 1. Browse and select the location of the target folder for installation. 1. Browse and select the location of the folder for system logs. 1. Select **Next**. 1. The system begins installing the selected components. 1. Select **Finish**. The **Finish** button is displayed after all the selected components have been installed. Note The File Access Manager Administrator Guide provides more information on the collector services. # Prerequisites Make sure your system fits the descriptions below before starting the installation. ## Software Requirements File Access Manager requires the latest ASP.NET Core 8.0.x Hosting Bundle. This bundle consists of .NET Runtime and ASP .NET Core Runtime. You can download the latest 8.0.x Hosting Bundle version from [here.](https://dotnet.microsoft.com/en-us/download/dotnet/8.0) ## Supported Versions - Exchange 2013 - Exchange 2016 (including Exchange 2016 having a CAS installed on Windows server 2016) - Exchange 2019 ## Enable Remote PowerShell - Run the following command on one of the Exchange CAS to enable remote PowerShell: `shell winrm q` Important The Exchange environment on a 2019 server with an Activity Monitor must be configured to communicate with a 2019 CAS server. Note Previous versions of File Access Manager required the installation of an additional PowerShell endpoint on an Exchange CAS server that allowed unrestricted script execution. This requirement was removed beginning with SecurityIQ v5p1 to simplify the deployment of the connector. If your environment was upgraded from older versions, *it is recommended* that you delete the obsolete “WBXPowerShell” endpoint from the Exchange CAS server. ## Permissions - Create a designated domain user (for example, *siq_xch*). - Assign the following user Exchange groups: - Recipients Management - Records Management - Public Folders Management - From PowerShell on the CAS run the following: `Set-User [username] -RemotePowerShellEnabled $True` ### Fine-Grained Permissions Exchange allows for creating custom admin roles, and this can be used to grant File Access Manager service account the minimum privileges they need. Each of these admin roles will grant privileges to a specific set of cmdlets. Listed below are the cmdlets we use sorted by service type: **BAM** - Get-ExchangeServer - Set-AdminAuditLogConfig - Search-MailboxAuditLog - Set-Mailbox - Get-Mailbox - Get-User **Crawler** - Get-Mailbox - Get-MailboxStatistics - Get-MailboxFolderStatistics - Get-PublicFolder **PC** - Get-ExchangeServer - Get-Group - Get-User - Get-Mailbox - Get-MailboxPermission - Get-MailboxFolderPermission - Get-MailboxFolderStatistics - Get-ADPermission - Get-PublicFolder - Get-PublicFolderClientPermission Using those as reference and following PowerShell commands, create and assign the needed roles: **BAM** - `New-ManagementRole -Name "FIleAccessManager Activities View-Only Recipients" -Parent "View-Only Recipients" -EnabledCmdlets Get-User,Get-Mailbox` - `New-ManagementRole -Name "FileAccessManager Activities Audit Logs" -Parent "Audit Logs" -EnabledCmdlets Set-Mailbox,Search-MailboxAuditLog,Set-AdminAuditLogConfig` - `New-ManagementRole -Name "FileAccessManager Activities View-Only Config" -Parent "View-Only Configuration" -EnabledCmdlets Get-ExchangeServer` - `New-RoleGroup -Name "FileAccessManager Activities Role Group" -Roles "FIleAccessManager Activities View-Only Recipients","FileAccessManager Activities Audit Logs","FileAccessManager Activities View-Only Config"` - `Add-RoleGroupMember -Identity "FileAccessManager Activities Role Group" -Member ` **Crawler and PC** - `New-ManagementRole -Name "FileAccessManager Crawl And Permissions View-Only Recipients" -Parent "View-Only Recipients" -EnabledCmdlets Get-Mailbox,Get-MailboxStatistics,Get-MailboxFolderStatistics,Get-PublicFolder,Get-Group,Get-User,Get-MailboxPermission,Get-MailboxFolderPermission,Get-PublicFolderClientPermission` - `New-ManagementRole -Name "FileAccessManager Crawl And Permission View-Only Config" -Parent "View-Only Configuration" -EnabledCmdlets Get-ExchangeServer,Get-ADPermission` - `New-RoleGroup -Name "FileAccessManager Crawl And Permissions Role Group" -Roles "FileAccessManager Crawl And Permissions View-Only Recipients","FileAccessManager Crawl And Permission View-Only Config"` - `Add-RoleGroupMember -Identity "FileAccessManager Crawl And Permissions Role Group" -Member ` Another option to having all permissions assigned to a single user: **All** - `New-ManagementRole -Name "FIleAccessManager View-Only Recipients" -Parent "View-Only Recipients" -EnabledCmdlets Get-User,Get-Mailbox,Get-MailboxStatistics,Get-MailboxFolderStatistics,Get-PublicFolder,Get-Group,Get-MailboxPermission,Get-MailboxFolderPermission,Get-PublicFolderClientPermission` - `New-ManagementRole -Name "FileAccessManager Audit Logs" -Parent "Audit Logs" -EnabledCmdlets Set-Mailbox,Search-MailboxAuditLog,Set-AdminAuditLogConfig` - `New-ManagementRole -Name "FileAccessManager View-Only Config" -Parent "View-Only Configuration" -EnabledCmdlets Get-ExchangeServer,Get-ADPermission` - `New-RoleGroup -Name "FileAccessManager Group" -Roles FIleAccessManager View-Only Recipients","FileAccessManager Audit Logs","FileAccessManager View-Only Config"` - `Add-RoleGroupMember -Identity "FileAccessManager Group" -Member ` ## Audit Bypass The File Access Manager Connector for Exchange sets the mailbox audit for the selected mailboxes according to the configuration in the Application. However, there are application service accounts (for example, BlackBerry or IXOS) which create many mailbox audit log entries that overload the Exchange and create a lot of noise in File Access Manager. You can configure a user or computer account to bypass mailbox audit logging, so that actions taken by that user or account for any mailbox are not logged. By bypassing a trusted user or computer accounts that require frequent access to mailboxes, you can reduce the noise in mailbox audit logs. For more information, refer to [Bypassing a user account from mailbox audit logging in Exchange 2013]() Note It is recommended to set an alert on bypass commands to verify that users are not bypassed unexpectedly. ## Audit Age Log Limit By default, audit logging is configured to store audit log entries for 90 days. After 90 days, the audit log entry is cycled. You can change the audit log age limit using the *Set-Mailbox cmdlet with the AuditLogAgeLimit* parameter. You can specify the number of days, hours, minutes, and seconds to retain audit log entries. Logs need not be retained for a long time (more than a few days), since File Access Manager offloads the data from the exchange. For more information, refer to [Set-Mailbox]() Note It is not recommended to retain an audit for a long time, since doing so expands the Exchange DB. ## Communications Requirements | Requirement | Source | Destination | Port | | ---------------------------------- | ---------------------------------------- | --------------------------- | --------- | | File Access Manager Message Broker | Permissions Collector | RabbitMQ | 5671 | | File Access Manager Access | Activity Monitor / Permissions Collector | File Access Manager Servers | 8000-8008 | | Remote PowerShell | Activity Monitor / Permissions Collector | CAS server | 80 or 443 | # Verifying the Exchange Connector Installation ## Installed Services Verify that the services installed for the connector are available and active. Using windows Service manager, or other tool, look for the File Access Manager services, and see that they are running. **Example** - File Access Manager Central Permissions Collection - service is running. - File Access Manager Central Activity Monitor - service is running. ## Log Files Check the log files listed below for errors - `%SAILPOINT_HOME_LOGS%\ FilesMiniFilter_ .log` - `%SAILPOINT_HOME_LOGS%\PermissionCollection_.log` - `%SAILPOINT_HOME_LOGS%\DataClassification_.log` - `%SAILPOINT_HOME_LOGS%\Exchange2010BAM-.log` ## Monitored Activities 1. Simulate activities on Exchange. 1. Wait a minute (approximately). 1. Verify that the activities display in the File Access Manager website under\*Forensics > Activities\* ## Permissions Collection 1. Run the Crawler and Permissions Collector tasks (*Settings > Task Management > Scheduled Tasks*) 1. Verify that: - The tasks completed successfully - Business resources were created in the resource explorer (*Admin > Applications >* [application column] *> Manage Resources*) - Permissions display in the Permission Forensics page (*Forensics > Permissions*) # Adding an Exchange Application In order to integrate with Exchange, we must first create an application entry in File Access Manager. This entry includes the identification, connection details, and other parameters necessary to create the link. To add an application, use the New Application Wizard. 1. Navigate to *Admin > Applications*. 1. Click **Add New** to open the wizard. ## Select Wizard Type 1. Click **Standard Application** 1. Click **Next** to open the **General Details** page. ## General Details - **Application Type** - Exchange - **Application Name** - Logical name of the application - **Description** - Description of the application - **Tags** - Select tags for the application from the dropdown menu, and / or type a new name, and press **Enter** to create a new tag. The dropdown list of tags filters out matching tags as you type and displays up to 50 tags. Note The **tags** replace the **Logical container** field that was used when creating applications in releases before 8.2. - **Event Manager Server** - This option is available if there are more than one event manager servers configured in the system. Select an event manager from the drop down menu. - **Identity Collector** - Select from the Identity Collector dropdown menu. You can create identity collectors in the administrative client. **Applications > Configuration > Permissions Management > Identity Collectors**. See section "OOTB Identity Collection" in the Collector Installation File Access Manager Administrator Guide for further details. If adding a new identity collector, press the **Refresh** button to update the Identity Collector dropdown list. Select **Next**. to open the Connection Details page. ## Connection Details Complete the Connection Details fields: - **XCH Server Name** - Server Name of either the Exchange Server (or one of the Exchange servers), or the Cluster Logical Name. Do not use IP Addresses - **Domain NetBios Name** - Short domain name. - **PowerShell Port** - 80 if working with HTTP - 443 if working with HTTPS - **Username and Password** - The user defined in the prerequisites. - **WinRM/HTTPS User SSL** - Use SSL when connecting with WinRM/SSL. Select **Next**. # Configuring Activity Monitoring ## Configuring Activity Monitoring Process Frequency - **Polling Interval (sec)** - Activity fetching interval [in seconds]. Default is set to 60 seconds, - **Report Interval (sec)** - Activity Monitor Health reporting interval [in seconds]. Default is set yo 60 seconds. - **Local Buffer Size (MB)** - Local buffer size for activities [in MB]. Default is set to 200MB. - This cyclic buffer is used to store activities on the Application Monitor’s machine in case of network errors that prevent the activities from being sent. - **Activity Data Retention Period** - When selecting the Clear Activity Data option, a user is able to provide a time frame (1 to 100) in either months or years for all activity to be retained. Once that time period is met, all data will be removed. - A user can also select to backup the data before it is deleted by selecting the Backup Events Before Clearing option. Notes - By default, this feature is disabled. - The Backup Before Clearing Option will only be enabled if the backup option is set during the system installation. If a user has not selected the backup option during the installation nor provided a backup path, this option will not be enabled. ## Configuring Data Enrichment Connectors The Data Enrichment Connectors (DEC) configuration enables us to select data enrichment sources. These can be used to add information from other sources about identities. An enrichment source could be a local HR database that is used to combine users' job descriptions or departments to the information stored in the identity store. - Select the data enrichment connectors to enrich monitored activities from the Available DECs text box. - Use the **>** or **>>** arrows to move the selected DECs to the Current DECs text box. - The user can select multiple DECs. Simply select each desired DEC. - You can create a new DEC in the Administrative Client, **Applications > Configuration > ActivityMonitoring > DataEnrichmentConnectors**. - After creating a new DEC, select **Refresh** to refresh the dropdown list. The chapter Connectors of the File Access Manager Administrator Guide provides more information on Data Enrichment Connectors, including what they are, how to configure them, and how they fit in the Activity Flow. # Configuring and Scheduling the Permissions Collection Permissions can be analyzed to determine the application permissions of an out-of-the-box application, provided you have defined an identity store for File Access Manager to use in its analysis, and you have run a crawl for the application. The permission collector is a software component responsible for analyzing the permissions in an application. The Central Permission Collector Service is responsible for running the Permission Collector and Crawler tasks. If the “File Access Manager Central Permission Collector” wasn’t installed during the installation of the server, this configuration setting will be disabled. ## To configure the Permission Collection 1. Open the edit screen of the required application. 1. Go to **Admin > Applications**. 1. Scroll through the list, or use the filter to find the application. 1. Select the **Edit** icon on the line of the application. 1. Select **Next** until you reach the Crawler & Permissions Collection settings page. The actual entry fields vary according to the application type. When entering this page in edit mode, you can navigate between the various configuration windows using the **Next** and **Back** buttons. - **Central Permissions Collection Service** - Select a central permission collection service from the dropdown list. You can create permissions collection services as part of the service installation process. See section "Services Configuration" in the File Access Manager Administrator Guide for further details. - **Calculate Effective Permissions** - Calculate effective permissions during the permissions collection run. - **Calculate Riskiest Permissions** - Calculates the riskiest permission on a resource – for example, Full Control is riskier than Read permissions if both are on a resource. This option is available when selecting Calculate Effective Permissions - **Skip Identities Sync during Permission Collection** - Skip identity synchronization before running permission collection tasks when the identity collector is common to different connector. Note This option is checked by default. You can now [schedule a task](#scheduling-a-task). ## Scheduling a Task To create a schedule: 1. Select **Create a Schedule**. 1. The system will provide a Schedule Name in the format `{appName} - {type} Scheduler`. Choose to keep or override this suggestion. 1. Select a scheduling frequency from the dropdown list. Schedule Frequency Options - Run After - Create dependency of tasks. The task starts running only upon successful completion of the first task. - Hourly - Set the start time. - Daily - Set the start date and time. - Weekly - Set the day(s) of the week on which to run. - Monthly - Set the day of the month on which to run a task. - Quarterly - Set a monthly schedule with an interval of 3 months. - Half Yearly - Set a monthly schedule with an interval of 6 months. - Yearly - Set a monthly schedule with an interval of 12 months. 1. Fill the Date and Time field with scheduling times. These fields differ depending upon the scheduling frequency selected. 1. Select the **Active** checkbox to activate the schedule. 1. Select **Next**. ## Configuring and Scheduling the Crawler - **To set or edit the Crawler configuration and scheduling** 1. Open the edit screen of the required application. 1. Go to **Admin > Applications**. 1. Scroll through the list, or use the filter to find the application. 1. Select the **Edit** icon on the line of the application. 1. Select **Next** until you reach the **Crawler & Permissions Collection** settings page. The actual entry fields vary according to the application type. - **Crawl Mailboxes, Crawl Public Folders** - Select the types of folders to scan. - Select to open the [schedule](#scheduling-a-task) panel. ## Setting the Crawl Scope There are several options to set the crawl scope: - Setting explicit list of resources to include and / or exclude from the scan. - Creating a regex to define resources to exclude. ## Including and Excluding Paths by List **To set the paths to include or exclude in the crawl process for an application** 1. Open the edit screen of the required application. 1. Go to **Admin > Applications**. 1. Scroll through the list, or use the filter to find the application. 1. Select the **Edit** icon on the line of the application. 1. Select **Next** until you reach the **Crawler & Permissions Collection** settings page. The actual entry fields vary according to the application type. 1. Scroll down to the Crawl configuration settings. 1. Select **Advanced Crawl Scope Configuration** to open the scope configuration panel. 1. Select Include / Exclude Resources to open the input fields. 1. To add a resource to a list, type in the full path to include / exclude in the top field and select **+** to add it to the list. 1. To remove a resource from a list, find the resource from the list, and select the **x** icon on the resource row. When creating exclusion lists, excludes take precedence over includes. ## Excluding Paths by Regex **To set filters of paths to exclude in the crawl process for an application using regex** 1. Open the edit screen of the required application. 1. Go to **Admin > Applications**. 1. Scroll through the list, or use the filter to find the application. 1. Select the **Edit** icon on the line of the application. 1. Select **Next** until you reach the **Crawler & Permissions Collection** settings page. The actual entry fields vary according to the application type. 1. Select **Exclude Paths by Regex** to open the configuration panel. 1. Type in the paths to exclude by Regex, See regex examples in the section below. Since the system does not collect BRs that match this Regex, it also does not analyze them for permissions. ### Crawler Regex Exclusion Example The following are examples of crawler Regex exclusions: **Exclude all shares which start with one or more shares names:** | Example | Regex | | ------------------------------------------------------------------------- | ----------------------------------------------- | | Starting with Public Folders\\shareName | `Public Folders\\\\shareName$` | | Starting with Public Folders\\shareName or Public Folders\\OtherShareName | `Public Folders\\\\(shareName OtherShareName)$` | **Include ONLY shares which start with one or more shares names:** | Example | Regex | | ------------------------------------------------------------------------- | -------------------------------------------------------------------- | | Starting with Public Folders\\shareName | `^(?!Public Folders\\\\shareName($ \\.*)).*` | | Starting with Public Folders\\shareName or Public Folders\\OtherShareName | `^(?!Public Folders\\\\(shareName` | | Include ONLY one folder under a share: \\server\\share\\folderA | `^(?!\\\\Public Folders\\shareName\$($ \\folderA$ \\folderA\\.*)).*` | **Exclude all mailboxes which start with one or more user names:** | Example | Regex | | ---------------------------------- | --------------------------------- | | Starting with John.Doe | `^Mailboxes\\John\.Doe@.*` | | Starting with John.Doe or Jane.Doe | `^Mailboxes\\(John Jane)\.Doe@.*` | **Include ONLY mailboxes that start with one or more user names:** | Example | Regex | | ---------------------------------- | --------------------------------------- | | Starting with John.Doe | `^(?!Mailboxes\/John\.Doe@.*).*` | | Starting with John.Doe or Jane.Doe | `^(?!Mailboxes\/(John Jane)\.Doe@.*).*` | Note To write a backslash or a Dollar sign, add a backslash before it as an escape character. Note To add a condition in a single command, use a pipe character “|” . **Narrow down the selection:** | Example | Regex | | ----------------------------------------------------------------- | --------------------------------------- | | *Include ONLY* the C$ drive shares: \\server_name\*C$\* | `^(?!\\\\server_name\\*C*\$($ \\.*)).*` | | Include ONLY one folder under a share: \\server\\share\*folderA\* | \`^(?!\\\\server_name\\share$($ | | Include ONLY all administrative shares | ^(?!\\server_name[a-zA-Z]$($ )).\* | Note To write a backslash or a Dollar sign, add a backslash before it as an escape character. Note To add a condition in a single command, use a pipe character “|” . ## Excluding Top Level Resources Use the top level exclusion screen to select top level roots to exclude from the crawl. This setting is done per application. **To exclude top level resources from the crawl process** 1. Open the application screen **Admin > Applications**. 1. Find the application to configure and click the drop down menu on the application line. Select **Exclude Top Level Resources** to open the configuration panel. 1. **Run Task** The Run Task button triggers a task that runs a short detection scan to detect the current top level resources.Before running the task for the first time, the message above this button is:`Note: Run task to detect the top-level resources` If the top level resource list has changed in the application while yo u are on this screen, press this button to retrieve the updated structure.Once triggered, you can see the task status in **Settings > Task Management > Tasks**. Note This will only work if the user has access to the task page. When the task has completed, press **Refresh** to update the page with the list of top level resources. 1. Select the top level resource list, and select top level resources to exclude. 1. Select **Save** to save the change. 1. To refresh the list of top level resources, run the task again. Running the task will not clear the list of top level resources to exclude. ## Special Consideration for Long File Paths in Crawl If you need to support long file paths above 4,000 characters for the crawl, set the flag `excludeVeryLongResourcePaths` in the Permission Collection Engine App.config file to true. By default this value will be commented out and set to false. This key ensures, when enabled, that paths longer than 4,000 characters are excluded from the applications’ resource discovery (Crawl), to avoid issues while storing them in the SQLServer database. When enabled, business resources with full paths longer than 4000 characters, and everything included in the hierarchical structure below them, will be excluded from the crawl, and will not be collected by File Access Manager. This scenario is extremely rare. You should not enable exclusion of long paths, unless you experience an issue. **Background** File Access Manager uses a hashing mechanism to create a unique identifier for each business resource stored in the File Access Manager database. The hashing mechanism in SQLServer versions 2014 and earlier, is unable to process (hash) values with 4,000 or more characters. Though resources with paths of 4000 characters or longer are extremely rare, File Access Manager is designed to handle that limitation. **Identifying the Problem** When using an SQL Server database version 2014 and ealier The following error message in the Permission Collection Engine log file: `System.Data.SqlClient.SqlException (0x80131904): String or binary data would be truncated.` In all other cases, this feature should not be enabled. **Setting the Long Resource Path Key** The Permission Collection Engine App.config file is `RoleAnalyticsServiceHost.exe.config`, and can be found in the folder `%SailPoint_Home%\FileAccessManager\[Permission Collection instance]\` Search for the key **excludeVeryLongResourcePaths** and correct it as described above. ## Configuring Activity Monitoring Configure the activity monitoring process frequency. - **Polling Interval (sec)** - Activity fetching interval [in seconds]. Default is set to 60 seconds, - **Report Interval (sec)** - Activity Monitor Health reporting interval [in seconds]). Default is set yo 60 seconds. - **Local Buffer Size (MB)** - Local buffer size for activities [ in MB]. Default is set to 200MB. This cyclic buffer is used to store activities on the Application Monitor’s machine in case of network errors that prevent the activities from being sent. - **Activity Data Retention Period** Note By default, this feature is disabled. When selecting the Clear Activity Data option, a user is able to provide a time frame (1 to 100) in either months or years for all activity to be retained. Once that time period is met, all data will be removed. A user can also select to backup the data before it is deleted by selecting the Backup Events Before Clearing option. Note The Backup Before Clearing Option will only be enabled if the backup option is set during the system installation. If a user has not selected the backup option during the installation nor provided a backup path, this option will not be enabled. ## Configuring Data Enrichment Connectors The Data Enrichment Connectors (DEC) configuration enables us to select data enrichment sources. These can be used to add information from other sources about identities. An enrichment source could be a local HR database that is used to combine users' job descriptions or departments to the information stored in the identity store. Select the data enrichment connectors to enrich monitored activities from the Available DECs text box. Use the > or >> arrows to move the selected DECs to the Current DECs text box. The user can select multiple DECs. Simply select each desired DEC. You can create a new DEC in the Administrative Client(Applications>Configuration>ActivityMonitoring>DataEnrichmentConnectors). After creating a new DEC, click **Refresh** to refresh the dropdown list. The chapter Connectors of the File Access Manager Administrator Guide provides more information on Data Enrichment Connectors, including what they are, how to configure them, and how they fit in the Activity Flow. # Connector Overview File Access Manager connector for Generic Table queries a database table (either SQL Server or Oracle) for activity monitoring. ## Capabilities This connector enables you to use File Access Manager to access and analyze data stored in Generic Table and do the following: - Analyze the structure of your stored data. - Monitor user activity in the resources. - Classify the data being stored. - Verify user permissions on the resources, and compare them against requirements. - Manage access fulfillment - automated granting and revoking of access - according to rules set in File Access Manager. - Identity collector – collect IAM users, groups and roles and the connections between them. ## Generic Table Installation Flow Overview To install the Generic Table connector: 1. Configure all the prerequisites. 1. Add a new Generic Table application in the Business Website. 1. Install the relevant services: - **Activity Monitor** - This is the activity collection engine, used by all connectors that support activity monitoring. - **Permissions Collector** - If you are using EC2 login, the collector should be installed on the EC2 instance. - **Data Classification Collector** Important Installing the permissions collector and data classification services is optional and should only be installed by someone with a full understanding of File Access Manager deployment architecture. The File Access Manager Administrator Guide has additional information on the architecture. # Collecting Data Stored in an External Application ## Terminology - **Connector** - The collection of features, components and capabilities that comprise File Access Manager support for an endpoint. - **Collector** - The “Agent” component or service in a Data Classification and or Permission Collection architecture. - **Engine** - The core service counterpart of this architecture. - **Identity Collector** - A logical component used to fetch identities from an identity store and holds the configuration, settings for that identity store, and the relations between these identities. The identity collector has no “physical” manifest. Note The actual work is done by the Collector Synchronizer. The list below describes the high level installation process required to collect and analyze data from an external application. Most of these should already be set up in your File Access Manager installation. See the server Installation guide for further details. - **Install a Data Classification central engine** - One or more central engines, installed using the server installer - **Install a Permission Collection central engine** - One or more central engines, installed using the server installer - **Create an Application in File Access Manager** - From the Business Website. The application is linked to central engines listed above. - **Add an Activity Monitor** - To collect activities for this application - run the Collector Installation Manager and add an application under Activity Monitoring. ## Install Permission Collectors and / or Data Classification Collector (optional) Optionally, you can install collectors that will run on a separate server and take some of the work from the central PC and DC engines (Where supported). When installing a collector, you attach it to an engine. If no collectors are installed, the central services act as both the engine and the collector. To install a collector, you must have the **RabbitMQ** service installed for communication between the central engines and the collectors. RabbitMQ is installed Note Some cloud connectors ignore collectors connected to the central engine. (Box, Dropbox, OneDrive, SharePointOnline, Exchange Online, GoogleDrive) . In these applications the task will be done entirely by the engine, and not relegated to its collectors. Note For more information, refer to **Application > Central Service > Collector Relations** in the File Access Manager Administrator Guide. # Installing Services: Collector Installation The Collector Installation Manager is part of the File Access Manager installation package. This tool is used to install the activity monitor, permission collector, and data classification collector. 1. Run the **Collector Installation Manager** as an Administrator.The installation files are in the installation package under the folder Collectors. 1. Enter the credentials to connect to File Access Manager. - ServerName/IP should be pointed to the Agent Configuration Manager service server. - A File Access Manager user with Collector Manager permission (permission to install collectors). For Active Directory authentication, use the format `domain\username`. 1. Select **Next**. 1. If you are installing the Activity Monitor, select the application, and then select **Add**. 1. When installing a SharePoint Activity Monitor, you will be prompted for service account credentials. This service account will be used by the Activity Monitor service to run the service and authenticate against the SharePoint IIS servers to fetch the logs (“Log on as”). Make sure the service account provided has local administrator privileges on the local server (hosting the Activity Monitor service) and can access the activity logs on the IIS servers. 1. If you are installing the Permission Collector, select the Central Permission Collector to which to connect this service. Select **Add**. 1. If you are installing the Data Classification, select the Central Classification Collector to which to connect this service. Select **Add**. 1. Select **Next**.The Installation Folder window displays. Note If this is the first time you are installing collectors on this machine, you will be prompted to select an installation folder. All future collectors will be installed in this folder. 1. Browse and select the location of the target folder for installation. 1. Browse and select the location of the folder for system logs. 1. Select **Next**. The system begins installing the selected components. 1. Select **Finish**. The Finish button is displayed after all the selected components have been installed. The File Access Manager Administrator Guide provides more information on the collector services. (**Add Link**) # Prerequisites Make sure your system fits the descriptions below before starting the installation. ## Software Requirements File Access Manager requires the latest ASP.NET Core 8.0.x Hosting Bundle. This bundle consists of .NET Runtime and ASP .NET Core Runtime. You can download the latest 8.0.x Hosting Bundle version from [here.](https://dotnet.microsoft.com/en-us/download/dotnet/8.0). ## Communications Requirements | Requirement | Source | Destination | Port | | -------------------------- | ---------------- | --------------------------- | ------------- | | File Access Manager Access | Activity Monitor | File Access Manager servers | 8000-8008 | | Activity Monitoring | Activity Monitor | Monitored database table | Database port | # Verifying the Generic Table Connector Installation ## Installed Services Verify that the services installed for the connector are available and active. Using windows Service manager, or other tool, look for the File Access Manager services, and see that they are running. Example - File Access Manager Central Activity Monitor - service is running. ## Log Files Check the log files listed below for errors - `%SAILPOINT_HOME_LOGS%\ FilesMiniFilter_ .log` - `%SAILPOINT_HOME_LOGS%\PermissionCollection_.log` - `%SAILPOINT_HOME_LOGS%\DataClassification_.log` - `%SAILPOINT_HOME_LOGS%\GenericDBTable-.log` ## Monitored Activities 1. Simulate activities by inserting them into the Generic Table on the database selected during the connector configuration. 1. Wait a minute (approximately). 1. Verify that the activities display in the File Access Manager website - **Forensics > Activities**. # Adding an NFS Application In order to integrate with General Table, we must first create an application entry in File Access Manager. This entry includes the identification, connection details, and other parameters necessary to create the link. To add an application, use the New Application Wizard. 1. Go to **Admin > Applications**. 1. Select **Add New** to open the wizard. ## Select Wizard Type 1. Select **Standard Application** 1. Select **Next** to open the **General Details** page. ## General Details - **Application Type** - Generic Table - **Application Name** - Logical name of the application - **Description** - Description of the application - **Tags** - Select tags for the application from the dropdown menu, and / or type a new name, and select **Enter** to create a new tag. The dropdown list of tags filters out matching tags as you type and displays up to 50 tags. Note The **tags** replace the **Logical container** field that was used when creating applications in releases before 8.2. - **Event Manager Server** - This option is available if there are more than one event manager servers configured in the system. Select an event manager from the drop down menu. Select **Next**. to open the Connection Details page. ## Connection Details Complete the Connection Details fields: - **Database Type** - The type of database, either SQL Server or Oracle. **SQL Server Only Fields** - **Server Name** - The SQL Server. - **Database Name** - The SQL database. - **Use Windows Authentication** - The default is not to use Windows authentication **Oracle Only Fields** - **Oracle Data Source Name** - The Oracle data source to connect to. - **Username / Password** - The user to connect to the database. - **Activities Query** - This query will periodically run to fetch new activities. - **Activity ID Column Name** - The column name in the *Activities Query* which identifies the unique id of the activity. This column is used to query for new activities periodically. - **Business Resource Column Name** - The column name in the *Activities Query* which will be displayed to the user as the Business Resource Full Path in the Activities Forensics. - **Username Column Name** - The column name in the *Activities Query* which will be displayed to the user as the User Name in the Activities Forensics. - **Action Column Name** - The column name in the *Activities Query* which represents the action - **Activities Timestamp Column Name** - The column name in the *Activities Query* which represents the time the activity occurred. - **Sample Event Column Name** - Either by Event ID or by date Note The Generic Table connector adds a condition for each query to fetch only new events. This condition is created with the Sample Event Column. - **Query Timeout (min)** - In minutes, the default being 0, which means wait indefinitely Select **Next** # Configuring Activity Monitoring Configure the activity monitoring processes frequency. - **Polling Interval (sec)** - Activity fetching interval [in seconds]. Default is set to 60 seconds, - **Report Interval (sec)** - Activity Monitor Health reporting interval [in seconds]. Default is set yo 60 seconds. - **Local Buffer Size (MB)** - Local buffer size for activities [ in MB]. Default is set to 200MB. This cyclic buffer is used to store activities on the Application Monitor’s machine in case of network errors that prevent the activities from being sent. - **Activity Data Retention Period** Note By default, this feature is disabled. When selecting the Clear Activity Data option, a user is able to provide a time frame (1 to 100) in either months or years for all activity to be retained. Once that time period is met, all data will be removed. A user can also select to backup the data before it is deleted by selecting the Backup Events Before Clearing option. Note The Backup Before Clearing Option will only be enabled if the backup option is set during the system installation. If a user has not selected the backup option during the installation nor provided a backup path, this option will not be enabled. ## Configuring Data Enrichment Connectors The Data Enrichment Connectors (DEC) configuration enables us to select data enrichment sources. These can be used to add information from other sources about identities. An enrichment source could be a local HR database that is used to combine users' job descriptions or departments to the information stored in the identity store. Select the data enrichment connectors to enrich monitored activities from the Available DECs text box. Use the > or >> arrows to move the selected DECs to the Current DECs text box. The user can select multiple DECs. Simply select each desired DEC. You can create a new DEC in the Administrative Client(Applications>Configuration>ActivityMonitoring>DataEnrichmentConnectors). After creating a new DEC, select **Refresh** to refresh the dropdown list. The chapter Connectors of the File Access Manager Administrator Guide provides more information on Data Enrichment Connectors, including what they are, how to configure them, and how they fit in the Activity Flow. # Capabilities This connector enables you to use File Access Manager to access and analyze data stored in Linux and do the following: - Analyze the structure of your stored data. - Monitor user activity in the resources. - Classify the data being stored. - Verify user permissions on the resources, and compare them against requirements. - Manage access fulfillment - automated granting and revoking of access - according to rules set in File Access Manager. - Identity collector – collect IAM users, groups and roles and the connections between them. ## Linux Permission Types The supported permission types are: - Read - Write - Execute - None **None permission** - The “None” permission is used when a user or group has no permissions. **“Others” group** - The “Others” group, which is part of the Unix permissions, is represented in File Access Manager as a calculated Everyone group. When a resource has permissions for the “Others” group, this group contains all users except the users and groups that have explicit permissions. ## Supported Linux Distributions - Ubuntu versions 18.04 and 20.04. - Red Hat Enterprise Linux versions 7 and 8. - CentOS versions 7 and 8. # Installing Services: Collector Installation The Collector Installation Manager is part of the File Access Manager installation package. This tool is used to install the activity monitor, permission collector, and data classification collector. 1. Run the **Collector Installation Manager** as an Administrator. The installation files are in the installation package under the folder Collectors. 1. Enter the credentials to connect to File Access Manager. - ServerName/IP should be pointed to the Agent Configuration Manager service server. - A File Access Manager user with Collector Manager permission (permission to install collectors). For Active Directory authentication, use the format `domain\username`. 1. Select **Next**. 1. If you are installing the Permission Collector, select the Central Permission Collector to which to connect this service. Select **Add**. 1. If you are installing the Data Classification, select the Central Classification Collector to which to connect this service. Select **Add**. 1. Select **Next**.The Installation Folder window displays. Note If this is the first time you are installing collectors on this machine, you will be prompted to select an installation folder. All future collectors will be installed in this folder. 1. Browse and select the location of the target folder for installation. 1. Browse and select the location of the folder for system logs. 1. Select **Next**. The system begins installing the selected components. 1. Select **Finish**. The Finish button is displayed after all the selected components have been installed. The File Access Manager Administrator Guide provides more information on the collector services. (**Add Link**) # Prerequisites Make sure your system fits the descriptions below before starting the installation. ## Software Requirements File Access Manager requires the latest ASP.NET Core 8.0.x Hosting Bundle. This bundle consists of .NET Runtime and ASP .NET Core Runtime. You can download the latest 8.0.x Hosting Bundle version from [here.](https://dotnet.microsoft.com/en-us/download/dotnet/8.0) SSH and SFTP must be available on the Linux server. ## Permissions File Access Manager connects to the Linux server using SFTP and SSH. A user with elevated permissions is required in order to read directories with restricted permissions. We recommend granting the required permissions as described in [Granting Read Permissions](#recommended-granting-read-permissions). This method grants File Access Manager the minimal required permissions to read any file or directory. Alternatively, it is possible to skip Granting Read Permissions and allow File Access Manager to use root instead. Using a user other than root and not granting the permission as described in Recommended: Granting Read Permissions is not recommended. The fetched information will be limited to the permissions that the given user possesses. For instance, if the given user is not allowed to read the permissions of a directory, then the information of that directory will not be collected. ### Mandatory Permissions - **Permissions to run the commands:** - `cat` - `getent` - Only if you plan to use Active Directory as an Identity Collector. - `ypcat` - Only if you plan on using NIS as an Identity Collector. - **Permissions to read:** - `/etc/passwd` - `/etc/group` In order to verify that a user has the required permissions, run the following commands with the desired user and make sure they succeed: ```text cat /etc/passwd  cat /etc/groupgetent passwd 0 (Only if you plan on using Active Directory as an Identity Collector) ypcat passwd (Only if you plan on using NIS as an Identity Collector) ``` ### Recommended: Granting Read Permissions The method of acquiring the required permissions is to use the `cap_dac_read_search` capability. This capability allows us to bypass file read permission checks and directory read and execute permission checks. Since Linux capabilities can be applied to files, but not to users, we will create dedicated executables that will only be used by File Access Manager. Warning If the SSH, SFTP or ACL packages are updated after following these steps, then the duplicated executables should be recreated, and the steps below should be repeated (except for creating the user for File Access Manager). **Using root, perform the following operations in the Linux server:** 1. Create a user for File Access Manager 1. Create the user famuser `adduser famuser` 1. Set password for the new user `passwd famuser` 1. Make sure that `famuser` has the permissions as described in [Mandatory Permissions](#mandatory-permissions). 1. Create a variable that contains the path of the sftp server executable: - For RHEL or CentOS distributions`sftpsrv=/usr/libexec/openssh/sftp-server` - For Ubuntu`sftpsrv=/usr/lib/openssh/sftp-server` Note The sftp-server location could be different depending on the OS 1. Copy the sftp executable: `cp -a ${sftpsrv} ${sftpsrv}-fam` 1. Make File Access Manager’s user the only user that can read and execute it. `chmod 500 ${sftpsrv}-fam` `chown famuser ${sftpsrv}-fam` 1. Grant capability to bypass file read permission checks and directory read and execute permission checks `/sbin/setcap cap_dac_read_search+ep ${sftpsrv}-fam` 1. Next, we will create a new SSH Subsystem.Open your SSH configuration, For OpenSSH, use the following: `nano /etc/ssh/sshd_config` 1. Add the following line to the file. Make sure the path of the sftp executable matches the path described above, according to the distribution type. Note There will probably be a section for subsystems, look for a line that begins with “Subsystem” near the end of the file. it is best to add the line after the other subsystems. - For RHEL or CentOS distributions - `Subsystem sftp-fam /usr/libexec/openssh/sftp-server-fam` - For Ubuntu - `Subsystem sftp-fam /usr/lib/openssh/sftp-server-fam` 1. Restart the ssh service: `systemctl restart sshd` ### Optional - Grant Read Permissions for ACLs This section should only be followed if you wish to read ACL permissions. 1. Copy the `getfacl` executable: `cp -a /bin/getfacl /bin/getfacl-fam` 1. Make File Access Manager’s user the only user that can read and execute it. `chmod 500 /bin/getfacl-fam` `chown famuser /bin/getfacl-fam` 1. Grant the executable the capability to bypass file read permission checks and directory read and execute permission checks `/sbin/setcap cap_dac_read_search+ep /bin/getfacl-fam` ## Communications Requirements | Requirement | Source | Destination | Port | | ----------------------------------- | ------------------------------ | --------------------------- | --------------------- | | File Access Manager Internal Access | Application | File Access Manager Servers | 8000-8008 | | File Access Manager Message Broker | Permissions Collector | RabbitMQ | 5671 | | Permissions Collection | Permissions Collection service | Target Linux server | Configurable SSH port | ## Configuration Requirements File Access Manager supports reading permissions of users from Active Directory only if the display format of Active Directory users in the Linux machine is user@domain (which is the default format). # Troubleshooting Check the issues below for common problems and suggested ways of handling them. ## Dedicated SFTP System Not Found **Case** Tasks fail with the following error: “Dedicated sftp system was not found, and 'use dedicated executables' is enabled, Please make sure you created the subsystem as instructed in the Linux connector installation guide” **Resolution / Suggestion** The cause of this error is that **Use Dedicated Executables** is selected in the connection details page in the application wizard, but the dedicated executables cannot be used. Please make sure you follow the [Prerequisites](https://documentation.sailpoint.com/fam-connectors/help/on_prem/linux/prereqs.html) section in this guide. ## Get ACLs Command Not Found **Case** Tasks fail with the following error: “get acls command not found”. **Resolution / Suggestion** “**Anaylze ACL Permissions**” is turned on in the connection details section of the application wizard, but the Permissions collector was unable to find the `getfacl` command. It is possible that ACLs are not enabled in the Linux server. ## Get ACLs Command Not Found and 'Use Dedicated Executeables' is Enabled **Case** Tasks fail with the following error: `get acls command not found.` Use dedicated executables' is enabled, make sure you followed the installation guide and created the dedicated executables for File Access Manager in the Linux server” **Resolution / Suggestion** The dedicated executable for getting ACLs cannot be found. Please make sure you followed the section [Optional - Grant Read Permissions for ACLs](https://documentation.sailpoint.com/fam-connectors/help/on_prem/linux/prereqs.html#optional-grant-read-permissions-for-acls). # Verifying the Windows Server Connector Installation ## Installed Services Verify that the services installed for the connector are available and active. Using Windows Service Manager, or other tool, look for the File Access Manager services, and see that they are running. **Example** - File Access Manager Central Permissions Collection - ## Log Files Check the log files listed below for errors - `%SAILPOINT_HOME_LOGS%\ FilesMiniFilter_ .log` - `%SAILPOINT_HOME_LOGS%\PermissionCollection_.log` - `%SAILPOINT_HOME_LOGS%\DataClassification_.log` ## Permissions Collection 1. Go to **Settings > Task Management > Scheduled Tasks**. 1. Run the Crawler and Permissions Collector tasks. 1. Verify that: - The tasks completed successfully - Business resources were created in the resource explorer (*Admin > Applications >* [application column] *> Manage Resources*) - Permissions display in the Permission Forensics page (*Forensics > Permissions*) # Adding an NFS Application In order to integrate with Linux, we must first create an application entry in File Access Manager. This entry includes the identification, connection details, and other parameters necessary to create the link. To add an application, use the New Application Wizard. 1. Go to **Admin > Applications**. 1. Select **Add New** to open the wizard. ## Select Wizard Type 1. Select **Standard Application** 1. Select **Next** to open the **General Details** page. ## General Details - **Application Type** - Linux - **Application Name** - Logical name of the application - **Description** - Description of the application - **Tags** - Select tags for the application from the dropdown menu, and / or type a new name, and select **Enter** to create a new tag. The dropdown list of tags filters out matching tags as you type and displays up to 50 tags. Note The **tags** replace the **Logical container** field that was used when creating applications in releases before 8.2. - **Event Manager Server** - This option is available if there are more than one event manager servers configured in the system. Select an event manager from the drop down menu. Select **Next** to open the Connection Details page. ## Connection Details Enter the login details and credentials - Server Address - Shell Port **Shell Username** If you followed the section [Recommended: Granting Read Permissions](https://documentation.sailpoint.com/fam-connectors/help/on_prem/linux/prereqs.html#recommended-granting-read-permissions) in this guide, enter “famuser”. Otherwise, enter another username as described in the [Permissions](https://documentation.sailpoint.com/fam-connectors/help/on_prem/linux/prereqs.html#permissions) section in this guide. Select the login method, and either enter the user password, or upload a private key and passphrase - Use Shell Password - User Private Key **Use Dedicated Executables** Check this option if you followed the section [Recommended: Granting Read Permissions](https://documentation.sailpoint.com/fam-connectors/help/on_prem/linux/prereqs.html#recommended-granting-read-permissions) and you have created dedicated executables for File Access Manager. # Selecting and Scheduling the Data Classification Settings To associate an application with a data classification service, and set the schedule 1. Open the edit screen of the required application 1. Go to **Admin > Applications** 1. Scroll through the list, or use the filter to find the application 1. Select the edit icon **Edit** icon on the line of the application 1. Select **Next** till you reach the **Data Classification** settings page. The actual entry fields vary according to the application type 1. **Central Data Classification Service** - Associate the application with a Central Data Classification Service. This service is responsible for running the Data Classification tasks. If the “Central Data Classification” wasn’t installed during the installation of the server, this field is disabled. - **Disabling Data Classification** - To disable data classification, delete the entry from the central data classification field. Disabling data classification can also be achieved by setting the scheduler to be inactive (which is the default setting for data classification). - **Create a Schedule** - This option is enabled only if a central data classification service is selected. See Scheduling a Task. Note See the chapter “Data Classification” in the File Access Manager Administrator Guide for more information. Select **Next** or **Finish**. ## Data Privacy A user can associate the application with a Central Data Classification Engine Service. This engine will be responsible for executed Data Privacy tasks. Though using different processes for each, the Data Classification engine service is in charge for both Data Privacy and Data Classification discovery tasks. You may choose the same service for both, or use a different one for each, to run them in parallel. Note The fields on the Data Privacy step are the same as the Data Classification step. # Configuring and Scheduling the Permissions Collection Permissions can be analyzed to determine the application permissions of an out-of-the-box application, provided you have defined an identity store for File Access Manager to use in its analysis, and you have run a crawl for the application. The permission collector is a software component responsible for analyzing the permissions in an application. The Central Permission Collector Service is responsible for running the Permission Collector and Crawler tasks. If the “IdentityIQ FAM Central Permission Collector” wasn’t installed during the installation of the server, this configuration setting will be disabled. ## To configure the Permission Collection 1. Open the edit screen of the required application. 1. Go to **Admin > Applications**. 1. Scroll through the list, or use the filter to find the application. 1. Select the **Edit** icon on the line of the application. 1. Select **Next** until you reach the **Crawler & Permissions Collection** settings page. The actual entry fields vary according to the application type. When entering this page in edit mode, you can navigate between the various configuration windows using the **Next** and **Back** buttons. - **Central Permissions Collection Service** - Select a central permission collection service from the dropdown list. You can create permissions collection services as part of the service installation process. - Analyze ACL Permissions - Select to fetch and analyze ACL-type Permissions. This option is checked by default. !!! note If ACL is not supported by your server, verify this field is unchecked. - **Skip Identities Sync during Permission Collection** - Skip identity synchronization before running permission collection tasks when the identity collector is common to different connectors. You can now [schedule a task](#scheduling-a-task). ## Scheduling a Task To create a schedule: 1. Select **Create a Schedule**. 1. The system will provide a Schedule Name in the format `{appName} - {type} Scheduler`. Choose to keep or override this suggestion. 1. Select a scheduling frequency from the dropdown list. Schedule Frequency Options - Run After - Create dependency of tasks. The task starts running only upon successful completion of the first task. - Hourly - Set the start time. - Daily - Set the start date and time. - Weekly - Set the day(s) of the week on which to run. - Monthly - Set the day of the month on which to run a task. - Quarterly - Set a monthly schedule with an interval of 3 months. - Half Yearly - Set a monthly schedule with an interval of 6 months. - Yearly - Set a monthly schedule with an interval of 12 months. 1. Fill the Date and Time field with scheduling times. These fields differ depending upon the scheduling frequency selected. 1. Select the **Active** checkbox to activate the schedule. 1. Select **Next**. ## Configuring and Scheduling the Crawler To set or edit the Crawler configuration and scheduling: 1. Open the edit screen of the required application. 1. Navigate to **Admin > Applications**. 1. Scroll through the list, or use the filter to find the application. 1. Select the **Edit** icon on the line of the application. 1. Select **Next** until you reach the **Crawler & Permissions Collection** settings page. The actual entry fields vary according to the application type. 1. **Calculate Resource Size** - Determine when, or at what frequency, File Access Manager calculates the resources' size. Select one of the following: - Never - Always - Second crawl and on (This is the default) 1. Select to open the [schedule](#scheduling-a-task) panel. ## Setting the Crawl Scope There are several options to set the crawl scope: - Setting explicit list of resources to include and / or exclude from the scan. - Creating a regex to define resources to exclude. ## Including and Excluding Paths by List To set the paths to include or exclude in the crawl process for an application 1. Open the edit screen of the required application. 1. Go to **Admin > Applications**. 1. Scroll through the list, or use the filter to find the application. 1. Select the **Edit** icon on the line of the application. 1. Select **Next** until you reach the **Crawler & Permissions Collection** settings page. The actual entry fields vary according to the application type. 1. Scroll down to the Crawl configuration settings. 1. Select **Advanced Crawl Scope Configuration** to open the scope configuration panel. 1. Select Include / Exclude Resources to open the input fields. 1. To add a resource to a list, type in the full path to include / exclude in the top field and Select **+** to add it to the list. 1. To remove a resource from a list, find the resource from the list, and Select the **x** icon on the resource row. Note When creating exclusion lists, excludes take precedence over includes. ## Excluding Paths by Regex To set filters of paths to exclude in the crawl process for an application using regex. 1. Open the edit screen of the required application. 1. Go to **Admin > Applications**. 1. Scroll through the list, or use the filter to find the application. 1. Select the **Edit** icon on the line of the application. 1. Select **Next** until you reach the **Crawler & Permissions Collection** settings page. The actual entry fields vary according to the application type. 1. Select **Exclude Paths by Regex** to open the configuration panel. 1. Type in the paths to exclude by Regex, See regex examples in the section below. Since the system does not collect BRs that match this Regex, it also does not analyze them for permissions. ## Crawler Regex Exclusion Example **Exclude a path** | Example | Regex | | -------------- | ---------- | | The path /root | \`^/root($ | **Exclude multiple paths** | Example | Regex | | ---------------- | --------- | | /root and /media | \`^(/root | **Include only a path** Note The parent directories must also be added, in this example we added the path ‘/’. | Example | Regex | | ------- | -------- | | /home | \`^(?!(/ | **Include multiple paths** Note Their parent directories must also be added, in this example we added the path ‘/’. | Example | Regex | | --------------- | -------- | | /home and /boot | \`^(?!(/ | Note To write a slash or a Dollar sign, add a backslash before it as an escape character. Note To add a condition in a single command, use a pipe character “|” . ## Excluding Top Level Resources Use the top level exclusion screen to select top level roots to exclude from the crawl. This setting is done per application. To exclude top level resources from the crawl process 1. Open the application screen **Admin > Applications**. 1. Find the application to configure and Select the drop down menu on the application line. Select **Exclude Top Level Resources** to open the configuration panel. 1. Run Task The **Run Task** button triggers a task that runs a short detection scan to detect the current top level resources.Before running the task for the first time, the message above this button is: `Note Run task to detect the top-level resources` If the top level resource list has changed in the application while you are on this screen, select this button to retrieve the updated structure. Once triggered, you can see the task status in **Settings > Task Management > Tasks**. Note This will only work if the user has access to the task page.When the task has completed, press **Refresh** to update the page with the list of top level resources. 1. Select the top level resource list, and select top level resources to exclude. 1. Select **Save** to save the change. 1. To refresh the list of top level resources, run the task again. Running the task will not clear the list of top level resources to exclude. ## Special Consideration for Long File Paths in Crawl If you need to support long file paths above 4,000 characters for the crawl, set the flag: `excludeVeryLongResourcePaths` in the Permission Collection Engine App.config file to true. By default this value will be commented out and set to false. This key ensures, when enabled, that paths longer than 4000 characters are excluded from the applications’ resource discovery (Crawl), to avoid issues while storing them in the SQLServer database. When enabled, business resources with full paths longer than 4000 characters, and everything included in the hierarchical structure below them, will be excluded from the crawl, and will not be collected by File Access Manager. This scenario is extremely rare. Note You should not enable exclusion of long paths, unless you experience an issue. **Background** File Access Manager uses a hashing mechanism to create a unique identifier for each business resource stored in the File Access Manager database. The hashing mechanism in SQLServer versions 2014 and earlier, is unable to process (hash) values with 4,000 or more characters. Though resources with paths of 4000 characters or longer are extremely rare, File Access Manager is designed to handle that limitation. **Identifying the Problem** When using an SQL Server database version 2014 and earlier The following error message in the Permission Collection Engine log file: `System.Data.SqlClient.SqlException (0x80131904): String or binary data would be truncated.` In all other cases, this feature should not be enabled. **Setting the Long Resource Path Key** The Permission Collection Engine App.config file is `RoleAnalyticsServiceHost.exe.config`, and can be found in the folder `%SailPoint_Home%\FileAccessManager\[Permission Collection instance]\` Search for the key `excludeVeryLongResourcePaths` and correct it as described above. # Connector Overview File Access Manager NFS Connector supports Permissions Collection and Data Classification for Linux/Unix servers. ## NFS protocol versions The NFS agent supports the following NFS protocol versions: - NFSv3 - The agent uses the standard NFSv3 protocol to crawl NFS exports and directory structure. The agent retrieves and analyzes UNIX-style object permissions. - NFSv4.1 - The agent uses the standard NFSv4.1 protocol to crawl the NFS pseudo-filesystem. ## Identity Collection schemes The NFS agent supports the following Identity Collection schemes: - Unix/Linux local users and groups are retrieved through SSH (or Telnet, if SSH is not available). - For environments with UNIX-style permissions, identities can be gathered from: - NIS server. - List of local users and groups. - For environments with NFSv4-style ACL permissions, identities can be gathered from: - Active Directory domain. - NIS server. - List of local users. ## Capabilities This connector enables you to use File Access Manager to access and analyze data stored in NFS and do the following: - Analyze the structure of your stored data. - Monitor user activity in the resources. - Classify the data being stored. - Verify user permissions on the resources, and compare them against requirements. - Manage access fulfillment - automated granting and revoking of access - according to rules set in File Access Manager. - Identity collector – collect IAM users, groups and roles and the connections between them. ## Supported Versions - NFS v3 - NFS v4.1 (including Integrity and Privacy export security types) ## NFS Installation Flow Overview To install the NFS connector: 1. Configure all the prerequisites. 1. Add a new NFS application in the Business Website. 1. Install the required services: - **Activity Monitor**- This is the activity collection engine, used by all connectors that support activity monitoring. - **Permissions Collector** - If you are using EC2 login, the collector should be installed on the EC2 instance. - **Data Classification Collector** Important Installing the permissions collector and data classification services is optional and should only be installed by someone with a full understanding of File Access Manager deployment architecture. # Collecting Data Stored in an External Application ## Terminology - **Connector** - The collection of features, components and capabilities that comprise File Access Manager support for an endpoint. - **Collector** - The “Agent” component or service in a Data Classification and or Permission Collection architecture. - **Engine** - The core service counterpart of this architecture. - **Identity Collector** - A logical component used to fetch identities from an identity store and holds the configuration, settings for that identity store, and the relations between these identities. The identity collector has no “physical” manifest. Note The actual work is done by the Collector Synchronizer. The list below describes the high level installation process required to collect and analyze data from an external application. Most of these should already be set up in your File Access Manager installation. See the server Installation guide for further details. - **Install a Data Classification central engine** - One or more central engines, installed using the server installer - **Install a Permission Collection central engine** - One or more central engines, installed using the server installer - **Create an Application in File Access Manager** - From the Business Website. The application is linked to central engines listed above. - **Add an Activity Monitor** - To collect activities for this application - run the Collector Installation Manager and add an application under Activity Monitoring. # Install Permission Collectors and / or Data Classification Collector (optional) Optionally, you can install collectors that will run on a separate server and take some of the work from the central PC and DC engines (Where supported). When installing a collector, you attach it to an engine. If no collectors are installed, the central services act as both the engine and the collector. To install a collector, you must have the **RabbitMQ** service installed for communication between the central engines and the collectors. RabbitMQ is installed Note Some cloud connectors ignore collectors connected to the central engine. (Box, Dropbox, OneDrive, SharePointOnline, Exchange Online, GoogleDrive) . In these applications the task will be done entirely by the engine, and not relegated to its collectors. Note For more information, refer to **Application > Central Service > Collector Relations** in the File Access Manager Administrator Guide. # Installing Services: Collector Installation 1. Run the **Collector Installation Manager** as an Administrator.The installation files are in the installation package under the folder Collectors. 1. Enter the credentials to connect to File Access Manager. - ServerName/IP should be pointed to the Agent Configuration Manager service server. - A File Access Manager user with Collector Manager permission (permission to install collectors). For Active Directory authentication, use the format `domain\username`. 1. Select **Next**. 1. If you are installing the Permission Collector, select the Central Permission Collector to which to connect this service. Select **Add**. 1. If you are installing the Data Classification, select the Central Classification Collector to which to connect this service. Select **Add**. 1. Select **Next**.The Installation Folder window displays. Note If this is the first time you are installing collectors on this machine, you will be prompted to select an installation folder. All future collectors will be installed in this folder. 1. Browse and select the location of the target folder for installation. 1. Browse and select the location of the folder for system logs. 1. Select **Next**. 1. The system begins installing the selected components. 1. Select **Finish**.The Finish button is displayed after all the selected components have been installed. The File Access Manager Administrator Guide provides more information on the collector services. (**Add Link**) # Prerequisites Make sure your system fits the descriptions below before starting the installation. ## Software Requirements File Access Manager requires the latest ASP.NET Core 8.0.x Hosting Bundle. This bundle consists of .NET Runtime and ASP .NET Core Runtime. You can download the latest 8.0.x Hosting Bundle version from [here.](https://dotnet.microsoft.com/en-us/download/dotnet/8.0). ## Required Permissions Local users and groups are gathered within the context of a proprietary Unix/Linux user, which requires the following permissions: - SSH (or Telnet) access to the NFS file server - Permissions to read the /etc/passwd and /etc/group files (using the cat shell command) - Crawling and Permission Analysis is within the context of a proprietary NFS user, which requires permissions that vary in accordance with the file-system permission type being used: - **Unix-style permissions** - Read - Execute - **NFSv4-style ACL permissions** - **r** - read-data (files) / list-directory (directories) - **x** - execute (files) / change-directory (directories) - **t** - read-attributes - read the attributes of the file/directory. - **n** - read-named-attributes - read the named attributes of the file/directory. - **c** - read-ACL - read the file/directory NFSv4 ACL - **y** - synchronize - allow clients to use synchronous I/O with the server. ## Communications Requirements | Requirement | Source | Target | Ports Protocol | | --------------------------------------------------- | ----------------------------------------------------- | --------------- | ------------------------------------- | | File Access Manager Message Broker | Permissions Collector / Data Classification Collector | RabbitMQ | 5671 | | NFSv3 | Permissions Collector / Data Classification service | NFS file server | Port 111 - portmapper Port 2049 - NFS | | NFSv4 | Permissions Collector / Data Classification service | NFS file server | Port 2049 - NFS | | Permissions Collection – get local users and groups | Permissions Collector | NFS file server | SSH/Telnet | # Verifying the NFS Connector Installation ## Installed Services Verify that the services installed for the connector are available and active. Using windows Service manager, or other tool, look for the File Access Manager services, and see that they are running. Example - File Access Manager Central Permissions Collection - `` - File Access Manager Central Data Classification - `` ## Log Files Check the log files listed below for errors - `%SAILPOINT_HOME_LOGS%\ FilesMiniFilter_ .log` - `%SAILPOINT_HOME_LOGS%\PermissionCollection_.log` - `%SAILPOINT_HOME_LOGS%\DataClassification_.log` ## Permissions Collection 1. Run the Crawler and Permissions Collector tasks - **Settings > Task Management > Scheduled Tasks**. 1. Verify that: - The tasks completed successfully. - Business resources were created in the resource explorer - **Admin > Applications > [Application Column] > Manage Resources**. - Permissions display in the Permission Forensics page - **Forensics > Permissions**. # Adding an NFS Application In order to integrate with NFS, we must first create an application entry in File Access Manager. This entry includes the identification, connection details, and other parameters necessary to create the link. To add an application, use the New Application Wizard. 1. Go to **Admin > Applications**. 1. Select **Add New** to open the wizard. ## Select Wizard Type 1. Select **Standard Application** 1. Select **Next** to open the **General Details** page. ## General Details - **Application Type** - NFS - **Application Name** - Logical name of the application - **Description** - Description of the application - **Tags** - Select tags for the application from the dropdown menu, and / or type a new name, and select **Enter** to create a new tag. The dropdown list of tags filters out matching tags as you type and displays up to 50 tags. Note The **tags** replace the **Logical container** field that was used when creating applications in releases before 8.2 - Event Manager Server - This option is available if there are more than one event manager servers configured in the system. Select an event manager from the drop down menu. - **NIS Identity Collector** - You can choose to assign an identity collector that’s configured over a Linux NIS server. Select an identity collector from the dropdown list. - **AD Identity Collector** - You can choose to assign an identity collector that’s configured over a Windows Active Directory service. Select an identity collector from the dropdown list. Note You can create identity collectors in the business website. Select the **Refresh** button to update the Identity Collector dropdown list after adding a new identity collector. Select **Next**. to open the Connection Details page. ## Connection Details - **Server Address** - The network address of the NFS server – any network-reachable address is valid - IP Address / WINS / DNS - **Shell Protocol** - Select whether to use SSH (default) or Telnet when connecting to the server to gather local users & groups - **Shell Port** - The target remote port for SSH/Telnet connection (Default: 22) - **Shell Username** - The username for interactive shell login. This field can contain: - NIS username - Local user’s UID - “root” (not recommended for security reasons) - **Shell Password** - The password to use when connecting to SSH/Telnet - **NFS Version** - Select from the dropdown list. (default: v3) - **Authentication Type (for NFS version v4)** - When you configure an NFSv4.1 server, this dropdown allows configuring the scheme of NFS authentication. - Select **Unix** for classic NFS authentication (using UID/GID) or **Kerberos** for NFSv4-style authentication (using RPCSEC_GSS over NFSv4.1). - **Default value** - Unix Note NFSv3 supports only Unix authentication. NFSv4.1 supports both Unix and Kerberos authentication. ### Unix Authentication For Unix authentication, fill in the following fields: - **Username** - When connecting to the NFS file server. This field can contain - NIS user name - Local user’s UID - “root” (not recommended for security reasons) - **Group Name** - When connecting to the NFS file server. This field can contain: - NIS group name - Local group’s GID - “root” (not recommended for security reasons) ### Kerberos Authentication For Kerberos authentication, fill in the following fields: **Server SPN** The NFS server’s *service principle name* as defined in your Active Directory (or other KDC). This value can be found in: - NFS server’s Computer Account in the Active Directory – under the *servicePrincipleName* attribute. - On the NFS server’s Unix/Linux machine, run the following commands: ```text – `ktutil` – `read_kt /etc/krb5.keytab` – `list` ``` Note `/etc/krb5.keytab` is the default location of the keytab file, but it may vary in your environment. - **Domain Name** - The NetBIOS domain name of the user when connecting to the NFS server - **Username** - When connecting to the NFS server - **Password** - The password when connecting to the NFS server Select **Next**. ## Selecting and Scheduling the Data Classification Settings To associate an application with a data classification service, and set the schedule 1. Open the edit screen of the required application. 1. Go to **Admin > Applications**. 1. Scroll through the list, or use the filter to find the application. 1. Select the **Edit** icon on the line of the application. 1. Select **Next** till you reach the **Data Classification** settings page. The actual entry fields vary according to the application type 1. **Central Data Classification Service** - Associate the application with a Central Data Classification Service. This service is responsible for running the Data Classification tasks. If the “Central Data Classification” wasn’t installed during the installation of the server, this field is disabled. - **Disabling Data Classification** - To disable data classification, delete the entry from the central data classification field. Disabling data classification can also be achieved by setting the scheduler to be inactive (which is the default setting for data classification). - **Create a Schedule** - This option is enabled only if a central data classification service is selected. See the chapter “Data Classification” in the File Access Manager Administrator Guide for more information. Select **Next** or **Finish**. ## Data Privacy A user can associate the application with a Central Data Classification Engine Service. This engine will be responsible for executed Data Privacy tasks. Though using different processes for each, the Data Classification engine service is in charge for both Data Privacy and Data Classification discovery tasks. You may choose the same service for both, or use a different one for each, to run them in parallel. Note The fields on the Data Privacy step are the same as the Data Classification step. # Configuring and Scheduling the Permissions Collection Permissions can be analyzed to determine the application permissions of an out-of-the-box application, provided you have defined an identity store for File Access Manager to use in its analysis, and you have run a crawl for the application. The permission collector is a software component responsible for analyzing the permissions in an application. The Central Permission Collector Service is responsible for running the Permission Collector and Crawler tasks. If IdentityIQ FAM Central Permission Collector wasn’t installed during the installation of the server, this configuration setting will be disabled. ## To configure the Permission Collection 1. Open the edit screen of the required application. 1. Go to **Admin > Applications**. 1. Scroll through the list, or use the filter to find the application. 1. Select the **Edit** icon on the line of the application. 1. Select **Next** until you reach the **Crawler & Permissions Collection** settings page. The actual entry fields vary according to the application type. When entering this page in edit mode, you can navigate between the various configuration windows using the **Next** and **Back** buttons. - **Central Permissions Collection Service** - Select a central permission collection service from the dropdown list. You can create permissions collection services as part of the service installation process. See section "Services Configuration" in the File Access Manager Administrator Guide for further details. - **Skip Identities Sync during Permission Collection** - Skip identity synchronization before running permission collection tasks when the identity collector is common to different connector. Note This option is checked by default. You can now [schedule a task](#scheduling-a-task). ## Scheduling a Task To create a schedule: 1. Select **Create a Schedule**. 1. The system will provide a Schedule Name in the format `{appName} - {type} Scheduler`. Choose to keep or override this suggestion. 1. Select a scheduling frequency from the dropdown list. Schedule Frequency Options - Run After - Create dependency of tasks. The task starts running only upon successful completion of the first task. - Hourly - Set the start time. - Daily - Set the start date and time. - Weekly - Set the day(s) of the week on which to run. - Monthly - Set the day of the month on which to run a task. - Quarterly - Set a monthly schedule with an interval of 3 months. - Half Yearly - Set a monthly schedule with an interval of 6 months. - Yearly - Set a monthly schedule with an interval of 12 months. 1. Fill the Date and Time field with scheduling times. These fields differ depending upon the scheduling frequency selected. 1. Select the **Active** checkbox to activate the schedule. 1. Select **Next**. ## Configuring and Scheduling the Crawler To set or edit the Crawler configuration and scheduling 1. Open the edit screen of the required application. 1. Go to **Admin > Applications**. 1. Scroll through the list, or use the filter to find the application. 1. Select the **Edit** icon on the line of the application. 1. Select **Next** until you reach the **Crawler & Permissions Collection** settings page.The actual entry fields vary according to the application type. 1. **Calculate Resource Size** - Determine when, or at what frequency, File Access Manager calculates the resources' size. Select one of the following: - Never - Always - Second crawl and on (This is the default) 1. Select to open the [schedule](#scheduling-a-task) panel. ## Setting the Crawl Scope There are several options to set the crawl scope: - Setting explicit list of resources to include and / or exclude from the scan. - Creating a regex to define resources to exclude. ## Including and Excluding Paths by List To set the paths to include or exclude in the crawl process for an application 1. Open the edit screen of the required application. 1. Go to **Admin > Applications**. 1. Scroll through the list, or use the filter to find the application. 1. Select the **Edit** icon on the line of the application. 1. Select **Next** until you reach the **Crawler & Permissions Collection** settings page. The actual entry fields vary according to the application type. 1. Scroll down to the Crawl configuration settings. 1. Select **Advanced Crawl Scope Configuration** to open the scope configuration panel. 1. Select Include / Exclude Resources to open the input fields. 1. To add a resource to a list, type in the full path to include / exclude in the top field and Select **+** to add it to the list. 1. To remove a resource from a list, find the resource from the list, and Select the *x* icon on the resource row. Note When creating exclusion lists, excludes take precedence over includes. ## Excluding Paths by Regex To set filters of paths to exclude in the crawl process for an application using regex. 1. Open the edit screen of the required application. 1. Go to **Admin > Applications**. 1. Scroll through the list, or use the filter to find the application. 1. Select the **Edit** icon on the line of the application. 1. Select **Next** until you reach the **Crawler & Permissions Collection** settings page.The actual entry fields vary according to the application type. 1. Select **Exclude Paths by Regex** to open the configuration panel. 1. Type in the paths to exclude by Regex, See regex examples in the section below. Since the system does not collect BRs that match this Regex, it also does not analyze them for permissions. ## Crawler Regex Exclusion Example The following are examples of crawler Regex exclusions **Exclude all shares which start with one or more shares names** | Example | Regex | | -------------------------------------------------------------- | --------------------------------------------------- | | Starting with `/shareName` (Path `/exports/recent/Automation`) | `^\/shareName$` (`^\/exports\/recent\/Automation$`) | | Starting with `/shareName` or `/OtherShareName` | ^`\/(shareName OtherShareName)$` | **Include ONLY shares which start with one or more shares names** | Example | Regex | | --------------------------------------------- | --------------------------------------------- | | Starting with `/shareName` | `^(?!\/shareName($ \/.*)).*` | | Starting with `/shareName or /OtherShareName` | `^(?!\/(shareName OtherShareName)($ \/.*)).*` | ## Excluding Top Level Resources Use the top level exclusion screen to select top level roots to exclude from the crawl. This setting is done per application. To exclude top level resources from the crawl process: 1. Open the application screen **Admin > Applications**. 1. Find the application to configure and select the drop down menu on the application line. 1. Select **Exclude Top Level Resources** to open the configuration panel. 1. **Run Task** - The Run Task button triggers a task that runs a short detection scan to detect the current top level resources. Before running the task for the first time, the message above this button is: `Note: Run task to detect the top-level resources`. If the top level resource list has changed in the application while you are on this screen, select this button to retrieve the updated structure.Once triggered, you can see the task status in **Settings > Task Management > Tasks**. Note This will only work if the user has access to the task page. When the task has completed, select **Refresh** to update the page with the list of top level resources. 1. Select the top level resource list, and select top level resources to exclude. 1. Select **Save** to save the change. 1. To refresh the list of top level resources, run the task again. Running the task will not clear the list of top level resources to exclude. ## Special Consideration for Long File Paths in Crawl If you need to support long file paths above 4,000 characters for the crawl, set the flag `excludeVeryLongResourcePaths` in the Permission Collection Engine App.config file to true. By default this value will be commented out and set to false. This key ensures, when enabled, that paths longer than 4000 characters are excluded from the applications’ resource discovery (Crawl), to avoid issues while storing them in the SQLServer database. When enabled, business resources with full paths longer than 4000 characters, and everything included in the hierarchical structure below them, will be excluded from the crawl, and will not be collected by File Access Manager. This scenario is extremely rare. You should not enable exclusion of long paths, unless you experience an issue. **Background** File Access Manager uses a hashing mechanism to create a unique identifier for each business resource stored in the File Access Manager database. The hashing mechanism in SQLServer versions 2014 and earlier, is unable to process (hash) values with 4,000 or more characters. Though resources with paths of 4000 characters or longer are extremely rare, File Access Manager is designed to handle that limitation. **Identifying the Problem** When using an SQL Server database version 2014 and earlier The following error message in the Permission Collection Engine log file: `System.Data.SqlClient.SqlException (0x80131904): String or binary data would be truncated.` In all other cases, this feature should not be enabled. **Setting the Long Resource Path Key** The Permission Collection Engine App.config file is `RoleAnalyticsServiceHost.exe.config`, and can be found in the folder `%SailPoint_Home%\FileAccessManager\[Permission Collection instance]\` Search for the key `excludeVeryLongResourcePaths` and correct it as described above. # Connector Overview ## Activity Monitor Operation Principles Monitored activities can include activities from all Site Collections, Crawled Site Collections or from selected Site Collections, as described in Chapter Adding a SharePoint Application . File Access Manager Activity Monitor for SharePoint uses two separate mechanisms to audit user activities. 1. Fetch audits from SharePoint's audit facilities. 1. The SharePoint audit audits all events, except View. Since monitoring View events via the SharePoint audit may result in an extremely heavy load on the SharePoint content database, a different approach is needed. View activities are audited by reading and analyzing the IIS log files on the SharePoint front-end servers. Each Web Application in the farm has its own log file folder and can span across multiple front-end servers. The Activity Monitor can find IIS log file folders automatically or manually. ### Automatic Mode In this mode, the Activity Monitor performs the following discovery sequence: - Read the list of front-end servers in the farm by using direct access to SharePoint databases. - Read the Web Applications configured on each Front-end server. - Configure the Web Application’s IIS log fields by using the IIS Remote Management API. - Locate the Web Applications IIS log file folder in each front-end server and access it through the administrative share remotely to read the IIS log files. Unless the default IIS log folder was changed, the administrative share will be `\\frontend_server\c$`. ### Manual Mode In this mode, each Web Application IIS logging configuration on each SharePoint front-end server must be configured to include specific fields. The IIS log path folders also must be manually configured in the Application Configuration Wizard in the form of a remote UNC share. Use of Manual Mode is **not** recommended since it requires more manual work, which makes it more susceptible to mistakes. Important Only use this mode if the user running the Activity Monitor is not to be set as an administrator on all the front-end servers. See [Configure View Activities Monitoring (Manual Mode Only)](https://documentation.sailpoint.com/connectors/file_access_manager/sharepoint/_connectors/sharepoint/preconfigviewactmonit.html) (**Update link**) and the *IIS Log Configuration* field description in chapter Adding a SharePoint Application for information on configuring Manual Mode (**Add link**). ## Permissions Collector Operation Principle File Access Manager connects to SharePoint databases directly and analyzes the permissions for local and domain users and groups, including Site Collection administrators and Web Application Policy Rules. By default, permissions are analyzed to the folder level, but they can also be analyzed on the file level. If permissions are analyzed on the file level, the system will only display uniquely managed files in the Business Resource Tree. Chapter Adding a SharePoint Application describes how to analyze file level permissions. ## SharePoint Installation Flow Overview To install the SharePoint connector: 1. Configure all the prerequisites. 1. Add a new SharePoint application in the Business Website. 1. Install the relevant services: - Activity Monitor - This is the activity collection engine, used by all connectors that support activity monitoring. - Permissions Collector - If you are using EC2 login, the collector should be installed on the EC2 instance. - Data Classification Collector Important Installing the permissions collector and data classification services is optional and should only be installed by someone with a full understanding of File Access Manager deployment architecture. The File Access Manager Administrator Guide has additional information on the architecture. ## Capabilities This connector enables you to use File Access Manager to access and analyze data stored in SharePoint and do the following: - Analyze the structure of your stored data. - Monitor user activity in the resources. - Classify the data being stored. - Verify user permissions on the resources, and compare them against requirements. - Manage access fulfillment - automated granting and revoking of access - according to rules set in File Access Manager. - Identity collector – collect IAM users, groups and roles and the connections between them. ## Supported Versions - SharePoint Server 2013, 2016, and 2019 - 32-bit and 64-bit # Collecting Data Stored in an External Application ## Terminology - **Connector** - The collection of features, components and capabilities that comprise File Access Manager support for an endpoint. - **Collector** - The “Agent” component or service in a Data Classification and or Permission Collection architecture. - **Engine** - The core service counterpart of this architecture. - **Identity Collector** - A logical component used to fetch identities from an identity store and holds the configuration, settings for that identity store, and the relations between these identities. The identity collector has no “physical” manifest. The actual work is done by the Collector Synchronizer. The list below describes the high level installation process required to collect and analyze data from an external application. Most of these should already be set up in your File Access Manager installation. See the server Installation guide for further details. - **Install a Data Classification central engine** - One or more central engines, installed using the server installer - **Install a Permission Collection central engine** - One or more central engines, installed using the server installer - **Create an Application in File Access Manager** - From the Business Website. The application is linked to central engines listed above. - **Add an Activity Monitor** - To collect activities for this application - run the Collector Installation Manager and add an application under Activity Monitoring. ## Install Permission Collectors and / or Data Classification Collector (optional) Optionally, you can install collectors that will run on a separate server and take some of the work from the central PC and DC engines (Where supported). When installing a collector, you attach it to an engine. If no collectors are installed, the central services act as both the engine and the collector. To install a collector, you must have the **RabbitMQ** service installed for communication between the central engines and the collectors. Note Some cloud connectors ignore collectors connected to the central engine. (Box, Dropbox, OneDrive, SharePointOnline, Exchange Online, GoogleDrive) . In these applications the task will be done entirely by the engine, and not relegated to its collectors. Note For further details, see section **Application > Central Service > Collector Relations** in the File Access Manager Administrator Guide. # Installing Services: Activity Monitor and Collectors The Collector Installation Manager is part of the File Access Manager installation package. This tool is used to install the activity monitor, permission collector, and data classification collector. 1. Run the **Collector Installation Manager** as an Administrator. The installation files are in the installation package under the folder Collectors.The Collector Installation Manager window displays. 1. Enter the credentials to connect to File Access Manager. - ServerName/IP should be pointed to the Agent Configuration Manager service server. - An File Access Manager user with Collector Manager permission (permission to install collectors). For Active Directory authentication, use the format domain\\username. - Select **Next**.The Service Configuration window displays. 1. If you are installing the Activity Monitor, select the application, and select **Add**. 1. When installing a SharePoint Activity Monitor, you will be prompted for service account credentials. This service account will be used by the Activity Monitor service to run the service and authenticate against the SharePoint IIS servers to fetch the logs (“Log on as”). Make sure the service account provided has local administrator privileges on the local server (hosting the Activity Monitor service) and can access the activity logs on the IIS servers. 1. If you are installing the Permission Collector, select the Central Permission Collector to which to connect this service, and click **Add**. 1. If you are installing the Data Classification, select the Central Classification Collector to which to connect this service, and click **Add**. 1. Select **Next**.The Installation Folder window displays. Note If this is the first time you are installing collectors on this machine, you will be prompted to select an installation folder, in which all future collectors will also be installed. 1. Browse and select the location of the target folder for installation. 1. Browse and select the location of the folder for system logs. 1. Select **Next**. 1. The system begins installing the selected components. 1. Select **Finish**. The Finish button is displayed after all the selected components have been installed. Note The File Access Manager Administrator Guide provides more information on the collector services (**Add link**). # Prerequisites Make sure your system fits the descriptions below before starting the installation. ## Software Requirements File Access Manager requires the latest ASP.NET Core 8.0.x Hosting Bundle. This bundle consists of .NET Runtime and ASP .NET Core Runtime. You can download the latest 8.0.x Hosting Bundle version from [here.](https://dotnet.microsoft.com/en-us/download/dotnet/8.0) ## Permissions You will need users with the following permissions to interact with SharePoint: 1. Create a designated domain user in the domain in which SharePoint works (for example, siq_wss). - For Access Fulfillment support, assign that user as a “Site Collection Administrator” for all Site Collections, using the Web Application Policy Rule to assign these permissions. - If the IIS log file configuration is set to Automatic, the user must be an Administrator on all the front-end servers to access the IIS remote management API and the administrative shares. If the IIS log file configuration is set to Manual, assign the user Read permissions to access all IIS Logs on all front-end servers through the dedicated UNC share. See [Configure View Activities Monitoring (Manual Mode Only)](#configure-view-activities-monitoring-manual-mode-only) (**Update link**) for further details. 1. In the installation package you can find the script called **SIQGrantSharePointDBPermissions.sql** under `Collectors\scripts`. This script can be used to generate a new user login with the required database permissions. To run the script: - Open the Collectors\\scripts folder in the installation package. - Copy the script to one of the SharePoint servers. - Follow the instructions at the top and run the script in the SharePoint SQL Server. - Verify that the permissions were granted successfully. The script should have the following messages: - `Successfully granted permissions to [Configuration DB]` - For each content database, a message `Successfully granted permissions to content db [Content DB Name]` - `Script execution completed successfully` ## Configure View Activities Monitoring (Manual Mode Only) Note: The following step can be skipped when automatic IIS log configuration is enabled in the Add New Application Wizard. Enable Host field logging on all Front-end IIS servers. For each Web Application in each Front-end server: 1. Open the IIS management console. 1. Locate the SharePoint Web Application site in the IIS. 1. Open the "Logging" options on the IIS management console. 1. Select **Select Fields** to open the Logging sub-window. 1. Select **cs-host** to select the field. 1. Select **Apply** under **Action** so the changes will take effect. Note If the CS-host field was not defined for logging before, View events might take a few hours to start collecting. To make the connector start collecting new view events, stop the IIS, delete the last IIS log file and start the IIS again. Important When running in a SharePoint farm with multiple Front-end servers, create a dedicated share on each Front-end for each Web Application IIS log directory, and give Read permissions to the user defined in the Permissions section above to access the share. These shares must be configured manually in the Application Configuration Wizard, as described in chapter Adding a SharePoint Application. ## Add the IIS Management Console Role for Activity Monitoring The SharePoint Activity Monitoring agent requires the “**IIS Management Console**” role to gather all view logs paths. Enable the role on the server where the Activity Monitor service is installed: 1. Open the **Server Manager**. 1. Select **Manage** and then **Add roles and features**. 1. Select **Next** until reaching the **Server Roles** screen. 1. Select **Web Server (IIS)** and then select **Add Features** on the confirmation dialog. 1. Select **Next** until reaching the **Role Services** window of **Web Server Role (IIS)**. 1. Scroll to the bottom and under **Management Tools** make sure the required **IIS Management Console** role is selected. 1. Select **Next** and then Select **Install** on the **Confirmation** window. ## Communications Requirements | Requirement | Source | Destination | Port | | -------------------------- | --------------------------------------------- | -------------------------------- | ---------------------------------------- | | Database Access | Permissions Collector | File Access Manager DB | According to the specific DB definitions | | File Access Manager Access | Activity Monitor/Permission Collector server | File Access Manager Servers | 8000-8008 | | SharePoint Database Access | Activity Monitor/Permission Collector service | SharePoint Databases | According to the specific DB definitions | | Data Classification | Data Classification Server | SharePoint Farm | http & https as required | | Access to IIS Logs | Activity Monitor | All SharePoint Front-end servers | 139/445 | # Troubleshooting Check the issues below for common problems and suggested ways of handling them. ## Collector Installation File Access Manager does not verify the credentials provided in the collector installation stage. If incorrect credentials are provided, the permission collector installation will fail, and an error message displays in the [Application_Name]. RA.install file under the log directory: `Error 1920. “Service SecurityIQ Permissions Collection – SharePoint” (SIQSPRA_SharePoint) failed to start` - Verify that you have sufficient privileges to start system services. ## Crawler Fails With "Unable to Connect to Content Databases When using a non-default port, there are cases in which File Access Manager fails to connect to the SharePoint databases using the existing configuration. In the log file, you can see that the Crawler connected to the SharePoint_config DB using the server,port address: `DEBUG,WBX.Common.SharepointDataAccess.DataAccessCore,executeStoredProcedure,connectionString = Data Source=[Server Name]\[Instance Name],3123;Initial Catalog=PR_SharePoint_Config;Integrated Security=True` but fails to connect to the SharePoint content DB, and the log shows that the connection is attempted without using the port `DEBUG,WBX.Common.SharepointDataAccess.DataAccessCore,executeStoredProcedure,connectionString = Data Source=[Server Name];Initial Catalog=WSS_Content[_DBNAME];Integrated Security=True` **Error message** `2019-08-01 09:17:15,851,18,ERROR,WBX.Common.SharepointDataAccess.DataAccessCore,executeStoredProcedure,Execution of 'proc_GetTpWebMetaDataAndListMetaData' failed` `System.Data.SqlClient.SqlException (0x80131904): A network-related or instance-specific error occurred while establishing a connection to SQL Server. The server was not found or was not accessible.` Verify that the instance name is correct and that SQL Server is configured to allow remote connections. (provider: Named Pipes Provider, error: 40 - Could not open a connection to SQL Server) ---> System.ComponentModel.Win32Exception (0x80004005): The system cannot find the file specified **Suggestion** Using the Windows SQL Server Client Network Utility, create aliases for each SharePoint database server, to point to the server address including the port, in the format [Server name], [port] To set the aliases: 1. Open the Windows CMD as administrator. 1. Select confg.exe. 1. Select the *Alias* tab. 1. Select **Add** to create a new alias. 1. Select TCP/IP 1. Set the parameters: - **Server Alias** - The SharePoint database sever name - **Server Name** - If the database has an instance name, the address should be in the format `[Server Name]\[Instance Name]` - **Dynamically Determine Port** - If not using the default port, unselect this option, and enter the port number.If the port is non-default, and this isn’t the default instance of the database, then you should create two aliases: - Server/Instance - portServer,port 1. Restart the server, and retry the Crawl. # Verifying the SharePoint Connector Installation ## Verifying Application Configuration After the configuration of one of the following applications is complete, verify it was properly configured by running the Test Connection task. The Test Connection will run and validate a series of validations to see if the application was configured correctly. ### Common SharePoint Validations The following is a list of common validations that run when the test connection is run with a SharePoint application. - Server responsiveness. - Verifying there is a connection with the SharePoint configuration database. - Verifying user permissions to the SharePoint configuration database. - Verifying connection to the SharePoint content databases. - Verifying user permissions to the SharePoint content databases. - Verifying the SharePoint content databases exist. - Checking if there is access to the Activity Monitoring log paths. - Verifying connection to the IIS management site. - Verifying access to the registry on the SharePoint servers. ## Installed Services Verify that the services installed for the connector are available and active. Using windows Service manager, or other tool, look for the File Access Manager services, and see that they are running. for example: - File Access Manager Central Activity Monitor - `` - File Access Manager Central Permissions Collection - `` - File Access Manager Central Data Classification - `` ## Log Files Check the log files listed below for errors - `%SAILPOINT_HOME_LOGS%\ FilesMiniFilter_ .log` - `%SAILPOINT_HOME_LOGS%\PermissionCollection_.log` - `%SAILPOINT_HOME_LOGS%\DataClassification_.log` - `%SAILPOINT_HOME_LOGS%\WSSBAM-.log` ## Monitored Activities 1. Simulate activities on SharePoint. 1. Wait a minute (approximately). 1. Verify that the activities display in the File Access Manager website under **Forensics > Activities** ## Permissions Collection 1. Run the Crawler and Permissions Collector tasks (*Settings > Task Management > Scheduled Tasks*) 1. Verify that: - The tasks completed successfully - Business resources were created in the resource explorer (*Admin > Applications >* [application column] *> Manage Resources*) - Permissions display in the Permission Forensics page (*Forensics > Permissions*) # Adding a SharePoint Application In order to integrate with SharePoint, we must first create an application entry in File Access Manager. This entry includes the identification, connection details, and other parameters necessary to create the link. To add an application, use the New Application Wizard. 1. Navigate to **Admin > Applications**. 1. Select **Add New** to open the wizard. ## Select Wizard Type 1. Select **Standard Application** 1. Select **Next** to open the **General Details** page. ## General Details - **Application Type** - SharePoint - **Application Name** - Logical name of the application - **Description** - Description of the application - **Tags** - Select tags for the application from the dropdown menu, and / or type a new name, and select **Enter** to create a new tag. The dropdown list of tags filters out matching tags as you type and displays up to 50 tags. Note The **tags** replace the **Logical container** field that was used when creating applications in releases before 8.2. - **Event Manager Server** - This option is available if there are more than one event manager servers configured in the system. Select an event manager from the drop down menu. - **Identity Collector** - Select from the Identity Collector dropdown menu. - You can create identity collectors in the administrative client. **Applications > Configuration > Permissions Management > Identity Collectors**.See section "OOTB Identity Collection" in the Collector Installation ManagerFile Access Manager Administrator Guide for further details. - If adding a new identity collector, press the **Refresh** button to update the Identity Collector dropdown list. Select **Next** to open the Connection Details page. ## Connection Details - **Database Server** - The address of the SharePoint server containing the configuration database - If you're using a non-default port number, add it, separated by a comma - `[Server Name],[Port]` The default port number is 1433 - If the database has an instance name the address should be in a format of `[Server Name]\[Instance Name]` - To enter a database with an instance name on a server with a non-default port number, use the format `[Server Name]\[Instance Name],[port]` !!! note There are cases in which you will have configure an alias for Windows to support this non-default database name format. See the Troubleshooting section below. - **Domain Name / Username** - The user defined in the prerequisites. This field is used by the Data Classification service. The Permissions Collector and Activity Monitor services will use it for impersonation to allow a connection via windows authentication to the SharePoint database - **Password** - The user defined in the prerequisites - **Leave Audit On** - Whether to leave the SharePoint audit on when the service is off - **Analyze permissions on files** - Check this box to display files that break permissions inheritance. Analyze the permissions of those files. - **Purge Old Audit Events / Days to Keep Events** - Deletes audits older than a given number of days from the SharePoint Content database, using the SharePoint API - **IIS Log Configuration** - Determines whether to specify IIS log folders manually or automatically, as explained in [Connector Overview](https://documentation.sailpoint.com/fam-connectors/help/on_prem/sharepoint/index.html) and [Add the “IIS Management Console” Role for Activity Monitoring](https://documentation.sailpoint.com/fam-connectors/help/on_prem/sharepoint/prereqs.html#add-the-iis-management-console-role-for-activity-monitoring). - **Manual**: Configure access to the IIS log folders manually through UNC shares. This is defined in [Add the “IIS Management Console” Role for Activity Monitoring](https://documentation.sailpoint.com/fam-connectors/help/on_prem/sharepoint/prereqs.html#add-the-iis-management-console-role-for-activity-monitoring).Fill in the IIS Log Folder Paths list with the UNC path for each Web Application on each Front-end server. - **Automatic**: Let the monitor identify all front-end servers, web applications, and IIS log folder locations. (This is the default setting).This mode also sets the IIS Host field logging for each Web application in each front-end server if it was not previously set. - **Servers to Exclude: If there are front-end servers that do not require monitoring, fill in this list.** - Each entry may be a server name or address. - Type in a server name to exclude, and Select **+** to add it to the list. - To remove an item from the list, Select the **x** icon on the item row. - **Specify configuration database name?** - Determines whether to specify a name for the configuration database in case it differs from the default “SharePoint_Config” name. Select **Next**. # Enabling Access Fulfillment for an Application Access fulfillment is enabled per application in the application setting screen, for applications that support fulfillment (see the compatibility table in Compass for the full list). To enable Access Fulfillment for an application: 1. Open the configuration screen of the required application. 1. Go to **Admin > Applications**. 1. Scroll through the list, or use the filter to find the application. 1. Select the **Edit** icon on the line of the application. 1. Select **Next** till you reach the **Access Fulfillment** settings page.!!! note The setting pages and entry fields vary according to the application type. 1. For non-normalized resources, you can Select **Enable Access Fulfillment for Revoking Explicit Permissions** . See Access Fulfillment for Removal of Explicit Permissions (**Add link**). 1. Select **Enable Access Fulfillment for Normalized Groups**. - **Identity Collector** Fulfillment requires an identity collector in order to run. If you did not select an identity collector in the General Details configuration page, you can select one from the drop down list now. If there is no identity collector defined for this application, or if you want to use a different identity collector than the ones in the dropdown list, you can create a new identity collector in the Administrative Client (*Applications > Configuration > Permissions Management > Identity Collectors*). See Create/Edit an Active Directory Identity Collector for more details (**Add link**) on creating an identity collector. - **Managed Group OU (DN)** The organizational unit in which the managed permission groups will be created. Make sure that the chosen identity collector’s user has permissions to create groups under this location (e.g. OU=FileAccessManagerManaged, DC=SailPoint, DC=COM) OU refers to an Organizational Unit, and DN refers to a Distinguished Name. - **How to Handle Inexact Permissions Matches** During the normalization process, the application has to decide what to do with permissions that do not match the normalized permissions. - Fail the normalization process - Elevate to the nearest permission match - Revoke the permission 1. Open the Advanced Settings panel for additional settings: - **Group Cache Sync Interval(sec)** This setting will add a pause to the process of setting normalize permissions on the resource. This will allow the endpoint's local AD groups cache to sync the newly created managed groups. The default Is 0 - signifying the process will not pause by default. - **Use Template Permission Group** Template groups are created per application and added as a template to every managed resource. These groups are not managed by File Access Manager, and are usually used to ensure that users who need application-wide access such as backup or archiving users have access. Select for each permission group whether File Access Manager should create a group or whether to use an existing group, for the following groups: - List Folder Contents - Read & Execute - Modify - Full Control If you select **Use an Existing Group**, select the required group to use from the dropdown list. Once an application is enabled for access fulfillment, you can set specific resources to be normalized using the Manage Normalized Resources page. # Configuring Activity Monitoring Configure the activity monitoring processes frequency. - **Polling Interval (sec)** - Activity fetching interval [in seconds]. Default is set to 60 seconds, - **Report Interval (sec)** - Activity Monitor Health reporting interval [in seconds]. Default is set yo 60 seconds. - **Local Buffer Size (MB)** - Local buffer size for activities [in MB]. Default is set to 200MB. This cyclic buffer is used to store activities on the Application Monitor’s machine in case of network errors that prevent the activities from being sent. - **Activity Data Retention Period** Note By default, this feature is disabled. When selecting the Clear Activity Data option, a user is able to provide a time frame (1 to 100) in either months or years for all activity to be retained. Once that time period is met, all data will be removed. A user can also select to backup the data before it is deleted by selecting the Backup Events Before Clearing option. Note The Backup Before Clearing Option will only be enabled if the backup option is set during the system installation. If a user has not selected the backup option during the installation nor provided a backup path, this option will not be enabled. # Configuring Data Enrichment Connectors The Data Enrichment Connectors (DEC) configuration enables us to select data enrichment sources. These can be used to add information from other sources about identities. An enrichment source could be a local HR database that is used to combine users' job descriptions or departments to the information stored in the identity store. Select the data enrichment connectors to enrich monitored activities from the Available DECs text box. Use the > or >> arrows to move the selected DECs to the Current DECs text box. The user can select multiple DECs. Simply select each desired DEC. You can create a new DEC in the Administrative Client: **Applications > Configuration > ActivityMonitoring > DataEnrichmentConnectors**. After creating a new DEC, select **Refresh** to refresh the dropdown list. The chapter Connectors of the File Access Manager Administrator Guide (**Add link**)provides more information on Data Enrichment Connectors, including what they are, how to configure them, and how they fit in the Activity Flow. # Selecting and Scheduling the Data Classification Settings - **To associate an application with a data classification service, and set the schedule** - Open the edit screen of the required application - Go to **Admin > Applications** - Scroll through the list, or use the filter to find the application - Select the **Edit** icon on the line of the application - Select **Next** till you reach the **Data Classification** settings page. The actual entry fields vary according to the application type - **Central Data Classification Service** - Associate the application with a Central Data Classification Service. This service is responsible for running the Data Classification tasks. If the “Central Data Classification” wasn’t installed during the installation of the server, this field is disabled. - **Disabling Data Classification** - To disable data classification, delete the entry from the central data classification field. Disabling data classification can also be achieved by setting the scheduler to be inactive (which is the default setting for data classification). - **Create a Schedule** - This option is enabled only if a central data classification service is selected. See Scheduling a Task. Note See the chapter “Data Classification” in the File Access Manager Administrator Guide for more information. Select **Next** or **Finish**. ## Data Privacy A user can associate the application with a Central Data Classification Engine Service. This engine will be responsible for executed Data Privacy tasks. Though using different processes for each, the Data Classification engine service is in charge for both Data Privacy and Data Classification discovery tasks. You may choose the same service for both, or use a different one for each, to run them in parallel. Note The fields on the Data Privacy step are the same as the Data Classification step. # Configuring and Scheduling the Permissions Collection Permissions can be analyzed to determine the application permissions of an out-of-the-box application, provided you have defined an identity store for File Access Manager to use in its analysis, and you have run a crawl for the application. The permission collector is a software component responsible for analyzing the permissions in an application. The Central Permission Collector Service is responsible for running the Permission Collector and Crawler tasks. If the “IdentityIQ FAM Central Permission Collector” wasn’t installed during the installation of the server, this configuration setting will be disabled. ## To configure the Permission Collection 1. Open the edit screen of the required application. 1. Navigate to **Admin > Applications**. 1. Scroll through the list, or use the filter to find the application. 1. Select the **Edit** icon 1. Select **Next** until you reach the **Crawler & Permissions Collection** settings page. The actual entry fields vary according to the application type. When entering this page in edit mode, you can navigate between the various configuration windows using the **Next** and **Back** buttons. - **Central Permissions Collection Service** - Select a central permission collection service from the dropdown list. You can create permissions collection services as part of the service installation process. See section "Services Configuration" in the File Access Manager Administrator Guide for further details. - **Skip Identities Sync during Permission Collection** - Skip identity synchronization before running permission collection tasks when the identity collector is common to different connector. Note This option is checked by default. You can now [schedule a task](#scheduling-a-task). ## Scheduling a Task To create a schedule: 1. Select **Create a Schedule**. 1. The system will provide a Schedule Name in the format `{appName} - {type} Scheduler`. Choose to keep or override this suggestion. 1. Select a scheduling frequency from the dropdown list. Schedule Frequency Options - Run After - Create dependency of tasks. The task starts running only upon successful completion of the first task. - Hourly - Set the start time. - Daily - Set the start date and time. - Weekly - Set the day(s) of the week on which to run. - Monthly - Set the day of the month on which to run a task. - Quarterly - Set a monthly schedule with an interval of 3 months. - Half Yearly - Set a monthly schedule with an interval of 6 months. - Yearly - Set a monthly schedule with an interval of 12 months. 1. Fill the Date and Time field with scheduling times. These fields differ depending upon the scheduling frequency selected. 1. Select the **Active** checkbox to activate the schedule. 1. Select **Next**. ## Configuring and Scheduling the Crawler To set or edit the Crawler configuration and scheduling: 1. Open the edit screen of the required application. 1. Navigate to **Admin > Applications**. 1. Scroll through the list, or use the filter to find the application. 1. Select the **Edit** icon on the line of the application. 1. Select **Next** until you reach the **Crawler & Permissions Collection** settings page. The actual entry fields vary according to the application type. 1. **Calculate Resource Size** - Determine when, or at what frequency, File Access Manager calculates the resources' size. Select one of the following: - Never - Always - Second crawl and on (This is the default) 1. Select to open the [schedule](#scheduling-a-task) panel. ## Setting the Crawl Scope There are several options to set the crawl scope: - Setting explicit list of resources to include and / or exclude from the scan. - Creating a regex to define resources to exclude. ## Including and Excluding Paths by List To set the paths to include or exclude in the crawl process for an application 1. Open the edit screen of the required application. 1. Go to **Admin > Applications**. 1. Scroll through the list, or use the filter to find the application. 1. Select the **Edit** icon on the line of the application. 1. Select **Next** until you reach the **Crawler & Permissions Collection** settings page. The actual entry fields vary according to the application type. 1. Scroll down to the Crawl configuration settings. 1. Select **Advanced Crawl Scope Configuration** to open the scope configuration panel. 1. Select Include / Exclude Resources to open the input fields. 1. To add a resource to a list, type in the full path to include / exclude in the top field and Select **+** to add it to the list. 1. To remove a resource from a list, find the resource from the list, and Select the **x** icon on the resource row. Note When creating exclusion lists, excludes take precedence over includes. ## Excluding Paths by Regex To set filters of paths to exclude in the crawl process for an application using regex. 1. Open the edit screen of the required application. 1. Go to **Admin > Applications**. 1. Scroll through the list, or use the filter to find the application. 1. Select the **Edit** icon on the line of the application. 1. Select **Next** until you reach the **Crawler & Permissions Collection** settings page. The actual entry fields vary according to the application type. 1. Select **Exclude Paths by Regex** to open the configuration panel. 1. Type in the paths to exclude by Regex, See regex examples in the section below. Since the system does not collect BRs that match this Regex, it also does not analyze them for permissions. ## Crawler Regex Exclusion Example The following are examples of crawler Regex exclusions: **Exclude all resources which start with one or more resource names** | Example | Regex | | ------------------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------- | | Starting with `https://www.mysharepoint.com/resourceName` | `https:\/\/www.mysharepoint.com\/resourceName$` | | Starting with `https://www.mysharepoint.com\resourceName` or `//www.mysharepoint.com/OtherResourceName` | `https:\/\/www.mysharepoint.com\/(resourceName OtherResourceName)$` | | SharePoint resources starting with `https://www.mysharepoint.com/sites/mySiteCollection` | `https:\/\/www.mysharepoint.com\/sites\/mySiteCollection$` | | SharePoint resources starting with `http://www.mysharepoint.com/*sites/mySiteCollection*` or `http://www.mysharepoint.com/*other site/Different Site*` | `https:\/\/www.mysharepoint.com\/(sites\/mySiteCollection other_site\/Different_Site)$` | **Include ONLY resources which start with one or more resources names** | Example | Regex | | ---------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------ | | Starting with `https://www.mysharepoint.com/resourceName` | `^(?!https:\/\/www.mysharepoint.com\/resourceName($ \/.*)).*` | | Starting with `https://www.mysharepoint.com/resourceName` or `https://www.mysharepoint.com/OtherResourceName` | `^(?!https:\/\/www.mysharepoint.com\/(resourceName OtherResourceName)($ \/.*)).*` | | SharePoint resources starting with `https://www.mysharepoint.com/sites/mySiteCollection` | `^(?!https:\/\/www.mysharepoint.com\/sites\/mySiteCollection($ \/.*)).*` | | SharePoint resources starting with `https://www.mysharepoint.com/sites/mySiteCollection` or `https://www.mysharepoint.com/other site/Different_Site` | `^(?!https:\/\/www.mysharepoint.com\/(sites\/mySiteCollection other_ site\/Different_Site)($ \/.*)).*` | ## Excluding Top Level Resources Use the top level exclusion screen to select top level roots to exclude from the crawl. This setting is done per application. To exclude top level resources from the crawl process 1. Open the application screen **Admin > Applications**. 1. Find the application to configure and Select the drop down menu on the application line. Select **Exclude Top Level Resources** to open the configuration panel. 1. Run Task The **Run Task** button triggers a task that runs a short detection scan to detect the current top level resources.Before running the task for the first time, the message above this button is: `Note Run task to detect the top-level resources` If the top level resource list has changed in the application while you are on this screen, select this button to retrieve the updated structure. Once triggered, you can see the task status in **Settings > Task Management > Tasks**. Note This will only work if the user has access to the task page.When the task has completed, press **Refresh** to update the page with the list of top level resources. 1. Select the top level resource list, and select top level resources to exclude. 1. Select **Save** to save the change. 1. To refresh the list of top level resources, run the task again. Running the task will not clear the list of top level resources to exclude. ## Special Consideration for Long File Paths in Crawl If you need to support long file paths above 4,000 characters for the crawl, set the flag: `excludeVeryLongResourcePaths` in the Permission Collection Engine App.config file to true. By default this value will be commented out and set to false. This key ensures, when enabled, that paths longer than 4000 characters are excluded from the applications’ resource discovery (Crawl), to avoid issues while storing them in the SQLServer database. When enabled, business resources with full paths longer than 4000 characters, and everything included in the hierarchical structure below them, will be excluded from the crawl, and will not be collected by File Access Manager. This scenario is extremely rare. Note You should not enable exclusion of long paths, unless you experience an issue. **Background** File Access Manager uses a hashing mechanism to create a unique identifier for each business resource stored in the File Access Manager database. The hashing mechanism in SQLServer versions 2014 and earlier, is unable to process (hash) values with 4,000 or more characters. Though resources with paths of 4000 characters or longer are extremely rare, File Access Manager is designed to handle that limitation. **Identifying the Problem** When using an SQL Server database version 2014 and earlier The following error message in the Permission Collection Engine log file: `System.Data.SqlClient.SqlException (0x80131904): String or binary data would be truncated.` In all other cases, this feature should not be enabled. **Setting the Long Resource Path Key** The Permission Collection Engine App.config file is `RoleAnalyticsServiceHost.exe.config`, and can be found in the folder `%SailPoint_Home%\FileAccessManager\[Permission Collection instance]\` Search for the key `excludeVeryLongResourcePaths` and correct it as described above. # Connector Overview File Access Manager Windows FS Activity Monitor uses a Microsoft certified mini-filter driver (). The driver intercepts all I/O calls to determine which users have access to which files/folders, and also audits Changes to local users and groups. There is therefore no need for Windows auditing, and no performance overhead is introduced on the monitored server. The activity monitor detects which share was used to perform each operation . Local access is a special cases, as detailed below: **Local Access** - The system reports local access to a file/folder (for example, by using Remote Desktop) on the administrative share (C$), and a special field on the activity (“Is Local Access”) is set to “True.” ## Capabilities This connector enables you to use File Access Manager to access and analyze data stored in Windows File Server and do the following: - Analyze the structure of your stored data. - Monitor user activity in the resources. - Classify the data being stored. - Verify user permissions on the resources, and compare them against requirements. - Manage access fulfillment - automated granting and revoking of access - according to rules set in File Access Manager. - Identity collector – collect IAM users, groups and roles and the connections between them. See the File Access Manager documentation for a full description. ## Supported Versions The File Access Manager Microsoft Windows Server Connector supports the following versions of MS Windows Server: - 2012 R2, 2016, 2019, 2022 - 32 and 64-bit support for all versions Note This document describes connecting to an MS Windows server as an application containing business resources. It should not be confused with the list of supported MS Windows server versions on which we can install the File Access Manager. ## Windows File Server Installation Flow Overview To install the Windows File Server connector: 1. Configure all the prerequisites. 1. Add a new Windows File Server application in the Business Website. 1. Install the relevant services: - Activity Monitor - This is the activity collection engine, used by all connectors that support activity monitoring. - Permissions Collector - If you are using EC2 login, the collector should be installed on the EC2 instance. - Data Classification Collector Important Installing the permissions collector and data classification services is optional and should only be installed by someone with a full understanding of File Access Manager deployment architecture. The File Access Manager Administrator Guide has additional information on the architecture. ## Monitored Activities - **Create File** - A new file was created. - **Create Folder** - A new folder was created. - **Create from Move** - A “Create Folder” event generates this event on the newly created folder. - **Create from Rename** - A “Rename Folder” event generates this event on the newly created folder. - **Delete File** - A file was deleted. - **Delete Folder** - A folder was deleted. - **Move File** - A file was moved. - **Move Folder** - A folder was moved. - **Permission Add File** - A permission was added to a file. - **Permission Add Folder** - A permission was added to a folder. - **Permission Remove File** - A permission was removed from a file. - **Permission Remove Folder** - A permission was removed from a folder. - **Read File** - A file (its content or security properties) was read. - **Rename File** - A file was renamed. - **Rename Folder** - A folder was renamed. - **Write File** - A file was modified. - **Add Member** - A local user/domain group was added to a local group. - **Remove Member** - A local user/domain group was removed from a local group. - **Create User** - A local user was created. - **Delete User** - A local user was deleted. - **Rename Object** - A local user/group name as changed. - **Create Group** - A local group was created. - **Delete Group** - A local group was deleted. - **Remove Audit Account Management** - The Account Management Auditing was disabled in windows. ## Permissions Collection Operation Principle File Access Manager connects to the Windows file server through CIFS, collects the local users and groups, and analyzes the share and NTFS permissions on all the folders. ## Path of Business Resource The full path of the business resources is the UNC shared path, rather than the physical path of the folder. The physical paths display since they are represented by the administrative shares (c, d...) and are treated in the same way as any other share on the server. - **Crawler** - The crawler crawls through all the shares and creates business resources with the share’s full path `\\server_name\share\folder`. - **Permissions Collector** - The permissions collector analyzes share permissions, as well as NTFS permissions. - **Activity Monitor** - The full path of activities is the share used to access the file/folder. Section 2.2 provides a more detailed explanation. ## Windows Server Failover Cluster Windows Server Failover Cluster is an Active Passive Cluster based on Windows Server. ### Basic Terminology The following definitions apply to the Windows Server Failover Cluster: - **Node** - A physical server that is part of a Cluster. All the nodes in a cluster must be configured when the “Is Cluster”’ field in the application configuration wizard is checked. - **Server Name** - A logical layer on top of the Node layer. Shares in a Cluster belong to a Server Name, which is the name used when shares in the cluster are accessed. A Server Name (discovered automatically, as part of the crawling task) is active on only one Node at a time. - **File Share Scoping** - Shares located on a cluster node can only be through the Server Name – not through the cluster node name in which they are currently active. The example below is used in Section [Resource Tree Structure](#resource-tree-structure): - There is a cluster application in File Access Manager, called ClusterApp. - ClusterApp consists of node1 and node2. - ServerName1 is currently active in node1, while ServerName2 is currently active in node2. - ServerName1 has one share: Share1 `\\ServerName1\Share1`. - “Share1” is mapped to physical path `E:\folder1`. - ServerName2 consists of Share2 and Share3 `\\ServerName2\Share2 and \\ServerName2\Share3`. - “Share2” is mapped to physical path `E:\folder2`. - “Share3” is mapped to physical path `E:\folder2\folder3`. ### Windows Failover Cluster Share Scoping File Access Manager supports Windows Failover Cluster Share Scoping. The Server Names and their corresponding shares are discovered as part of the crawl task, and the business resource tree is built with the Server Names at the first level. ## Resource Tree Structure File Access Manager manages Business Resources that belong to a share only a Server Name in a Windows Server Failover Cluster. Physical paths that do not belong to a share on a Server Name are not displayed in File Access Manager. The Business Resources tree is represented as follows: - [Cluster Application] - [Admin Audit] - [Server Name] - [Share] - [Share] - [Server Name] - [Share] - [Share] The business resource tree for the above example is: - ClusterApp - Admin Audit - [Server1] - [Share1] - [Share2] - [Server2] - [Share3] - [Share4] # Adding New Windows Server Bulk Application To add Windows Server applications in bulk, use the New Application Wizard in the File Access Manager Administrative Client. 1. Go to **Applications > New > Bulk Application**. The New Bulk Application Wizard window displays under the Welcome tab. 1. Select **Windows File Server**. 1. Select **Download Template** and download the bulk installation Excel template. Note Each application type has a different template. 1. Fill in a new row in the template for each application to be installed. In the multiple selection fields, such as **Central DC Service**, and **Central PC Service**, you can select valid options from the drop down list in the Excel file. 1. Save the template file. 1. In the wizard, select **Browse** and select the template you filled. 1. Select **Upload** to upload the template. 1. Once the template is uploaded, the Upload Status table contains a row for each application in the template. If there are errors displayed in the Upload Status table, correct the parameters and upload the template again. - This stage is for validation only. - Applications with errors will be ignored, and won't be created. 1. Select **Next**. Note You can navigate among the Permissions Collection and Crawler scheduling windows (under the Scheduling tab) with the Next and Back buttons. The Permissions Collection window of the New Bulk Applications Wizard displays under the Scheduling tab. Note A schedule is created for each application with the name: PermissionCollection\_ Task, with the same details. ## Scheduling Tasks In the next configuration screens you can schedule tasks to collect and analyze the BRs in the connected servers. The scheduling includes: - Permissions Collector - Crawler – automatic application crawling to find new resources - Data Classification – to classify your results Fill in the scheduling fields for each scheduling screen: **Create a Schedule** Select on this option to view the schedule setting parameters. - **Schedule Task Name** - A name for this scheduling task When creating a new schedule, the system generates a default name in the following format: `{appName} - {type} Scheduler` You can override or keep this name suggestion. - **Schedule** - Select a scheduling frequency from the dropdown menu. Schedule Types and Intervals: | Schedule Types and Intervals | Description | | ---------------------------- | ------------------------------------------------------------------------------------------------------ | | Once | Single execution task runs. | | Run After | Create dependency of tasks. The task starts running only upon successful completion of the first task. | | Hourly | Set the start time. | | Daily | Set the start date and time. | | Weekly | Set the day(s) of the week on which to run. | | Monthly | The start date defines the day of the month on which to run a task. | | Quarterly | A monthly schedule with an interval of 3 months. | | Half Yearly | A monthly schedule with an interval of 6 months. | | Yearly | A monthly schedule with an interval of 12 months. | - **Date and time fields** - Fill in the scheduling times. These fields differ, depending upon the scheduling frequency selected. - **Active check box** - Check this to activate the schedule. Note See the chapter “Crawling” in the File Access Manager Administrator Guide for more information on the crawling mechanism. Select **Next** and **Back** to navigate between the screens. ## Completing the Installation After the Data Classification screen: 1. Select **Next**. Note The applications are created at this stage. The Application Creation Status window of the New Bulk Applications Wizard displays under the Status tab. A table lists the creation status of each application. 1. Select **Next**. The **Installation File** window of **New Bulk Applications Wizard** displays. 1. Browse to select the destination for the .zip file, which contains the files required to install the Activity Monitor / Permissions Collector / Data Classification services for each application. A text file with the command line for remote installation of the Activity Monitor connector is also created. This file can be used for unattended installations of the Activity Monitor. 4. Select **Finish**. # Collecting Data Stored in an External Application ## Terminology - **Connector**- The collection of features, components and capabilities that comprise File Access Manager support for an endpoint. - **Collector** - The “Agent” component or service in a Data Classification and or Permission Collection architecture. - **Engine** - The core service counterpart of this architecture. - **Identity Collector** - A logical component used to fetch identities from an identity store and holds the configuration, settings for that identity store, and the relations between these identities. Note The identity collector has no “physical” manifest. The actual work is done by the Collector Synchronizer. The list below describes the high level installation process required to collect and analyze data from an external application. Most of these should already be set up in your File Access Manager installation. See the server Installation guide for further details. **Install a Data Classification central engine** - One or more central engines, installed using the server installer **Install a Permission Collection central engine** - One or more central engines, installed using the server installer **Create an Application in File Access Manager** - From the Business Website. The application is linked to central engines listed above. **Add an Activity Monitor** - To collect activities for this application - run the Collector Installation Manager and add an application under Activity Monitoring. ## Install Permission Collectors and / or Data Classification Collector (optional) Optionally, you can install collectors that will run on a separate server and take some of the work from the central PC and DC engines (Where supported). When installing a collector, you attach it to an engine. If no collectors are installed, the central services act as both the engine and the collector. To install a collector, you must have the **RabbitMQ** service installed for communication between the central engines and the collectors. RabbitMQ is installed Note Some cloud connectors ignore collectors connected to the central engine. (Box, Dropbox, OneDrive, SharePointOnline, Exchange Online, GoogleDrive) . In these applications the task will be done entirely by the engine, and not relegated to its collectors. Note For further details, see section **Application > Central Service > Collector Relations** in the File Access Manager Administrator Guide. # Installing Services: Activity Monitor and Collectors The Collector Installation Manager is part of the File Access Manager installation package. This tool is used to install the activity monitor, permission collector, and data classification collector. 1. Run the **Collector Installation Manager** as an Administrator. The installation files are in the installation package under the folder Collectors. The Collector Installation Manager window displays. 1. Enter the credentials to connect to File Access Manager. - ServerName/IP should be pointed to the Agent Configuration Manager service server. - An File Access Manager user with Collector Manager permission (permission to install collectors). For Active Directory authentication, use the format domain\\username. - Select **Next**. The Service Configuration window displays. 1. If you are installing the *Activity Monitor*, select the application, and select **Add**. 1. When installing a SharePoint Activity Monitor, you will be prompted for service account credentials. This service account will be used by the Activity Monitor service to run the service and authenticate against the SharePoint IIS servers to fetch the logs (“Log on as”). Make sure the service account provided has local administrator privileges on the local server (hosting the Activity Monitor service) and can access the activity logs on the IIS servers. 1. If you are installing the *Permission Collector*, select the Central Permission Collector to which to connect this service, and click **Add**. 1. If you are installing the *Data Classification*, select the Central Classification Collector to which to connect this service, and click **Add**. 1. Select **Next**. The Installation Folder window displays. Note If this is the first time you are installing collectors on this machine, you will be prompted to select an installation folder, in which all future collectors will also be installed. 1. Browse and select the location of the target folder for installation. 1. Browse and select the location of the folder for system logs. 1. Select **Next**. The system begins installing the selected components. 1. Select **Finish**. The **Finish** button is displayed after all the selected components have been installed. Note The File Access Manager Administrator Guide provides more information on the collector services. # Prerequisites Make sure your system fits the descriptions below before starting the installation. ## Software Requirements File Access Manager requires the latest ASP.NET Core 8.0.x Hosting Bundle. This bundle consists of .NET Runtime and ASP .NET Core Runtime. You can download the latest 8.0.x Hosting Bundle version from [here](https://dotnet.microsoft.com/en-us/download/dotnet/8.0). ## Backup Operator Privileges The user configured in the permissions perquisites section must be a member of the local Backup Operator group of the file server. It eliminates the need to grant explicit permissions to the File Access Manager user to all the folders on the file server. By using the Backup Operator privilege, File Access Manager can crawl, collect permissions, and classify data even if the user does not have explicit permissions to the folder. ## Permissions File Access Manager requires different permissions, based on the tasks that require those permissions. The user configured in the Application configuration wizard must have the following permissions on the file server: - Share Read permissions to all shares on the file server - Full Control permission for each normalized folder - Member of the local Backup Operators group on the file server - Member of the local Administrators group on the file server ### Why do we need this access? The following detailed explanation describes required permissions by each File Access Manager task: **Activity Monitoring** - No special permission is required, since the Activity Monitor service runs locally on the monitored service with Local System privileges. **Crawling** - The user must have Share Read permissions to all the shares on the file server. - The user must be a member of the local Backup Operators group on the file server. **Permission Collection** - The user must have Share Read permissions to all the shares on the server. - The user must be member of the local Backup Operators group on the server. - The user must be a member of the local Administrators group to read the Share Permissions, and the local Users and Groups of the server. **Access Fulfillment** - The user must have Full Control permission on the normalized folders to be able to set the permissions. **Data Classification** - The user must have Share Read permissions for all the shares on the server. - The user must be member of the local Backup Operators group on the server. ## Communications Requirements | Requirement | Source | Destination | Port | | ---------------------------------------------------- | --------------------------------------------------- | --------------------------- | ------------------- | | File Access Manager Message Broker | Permissions Collector/Data Classification Collector | RabbitMQ | 5671 | | File Access Manager Access | Activity Monitor | File Access Manager Servers | 8000-8008 | | Permissions Collector & Data Classification Analysis | Permissions Collector/Data Classification Server | Monitored server | CIFS/SMB (139, 445) | # Troubleshooting Check the issues below for common problems and suggested ways of handling them. ## Unable to See Events **Symptom** The following error displays in a log file while you attempt to install the monitoring connector: `ERROR, WBX.whiteOPS.Agents.FilesMiniFilterActivity Monitor.FileMiniFilterActivity MonitorManager,connect, An unexpected error occurred while you attempt to start the mini-filter` `System.DllNotFoundException: Unable to load DLL 'wbapi.dll': The specified module could not be found. (Exception from HRESULT: 0x8007007E)—at WBX.whiteOPS.Agents.FilesMiniFilterActivity Monitor.SafeNativeMethods64.start(UInt32 bufferSizeInBytes, UInt32 trustedProcessId)—at WBX.whiteOPS.Agents.FilesMiniFilterActivity Monitor.FileMiniFilterActivity MonitorManager.connect()` **Reason** Visual C++ 2010 redistributable package was not installed as part of the Activity Monitor service installation. **Solution Steps** See step 3 of Windows Server Core. ## The Application is not in the List of the Collector Installation Manager **Symptom** The application does not appear in dropdown list of the Collector Installation Managers in the Activity Monitoring. **Reason** Either the application was not defined or the Host Name as defined in the (as defined when adding the application) does not match the server’s short name on which the Collector Installation Manager was opened on. **Solution Steps** Verify that the Windows Server application was in fact created. In case it exists, make sure the Host Name is correct. # Verifying the Windows Server Connector Installation ## Installed Services Verify that the services installed for the connector are available and active. Using Windows Service Manager, or other tool, look for the File Access Manager services, and see that they are running. **Example** - File Access ManagerActivity Monitor - - File Access ManagerCentral Permissions Collection - - File Access ManagerCentral Data Classification - ## Log Files Check the log files listed below for errors - `%SAILPOINT_HOME_LOGS%\ FilesMiniFilter_ .log` - `%SAILPOINT_HOME_LOGS%\PermissionCollection_.log` - `%SAILPOINT_HOME_LOGS%\DataClassification_.log` - `%SAILPOINT_HOME_LOGS%\FilesMiniFilter-.log` ## Monitored Activities 1. Simulate activities on Windows File Server. 1. Wait a minute (approximately). 1. Verify that the activities display in the File Access Manager website under **Forensics > Activities**. ## Permissions Collection 1. Go to **Settings > Task Management > Scheduled Tasks**. 1. Run the Crawler and Permissions Collector tasks. 1. Verify that: - The tasks completed successfully - Business resources were created in the resource explorer (*Admin > Applications >* [application column] *> Manage Resources*) - Permissions display in the Permission Forensics page (*Forensics > Permissions*) # Adding a Microsoft Windows Server Application In order to integrate with Windows File Server, we must first create an application entry in File Access Manager. This entry includes the identification, connection details, and other parameters necessary to create the link. To add an application, use the New Application Wizard. 1. Go to **Admin > Applications**. 1. Select **Add New** to open the wizard. ## Select Wizard Type 1. Select **Standard Application** 1. Select **Next** to open the **General Details** page. ## General Details - **Application Type**- Windows File Server (Agent) - **Application Name**- Logical name of the application - **Description** - Description of the application - **Tags** - Select tags for the application from the dropdown menu, and / or type a new name, and press **Enter** to create a new tag. The dropdown list of tags filters out matching tags as you type and displays up to 50 tags. Note The **tags** replace the **Logical container** field that was used when creating applications in releases before 8.2. ## Event Manager Server This option is available if there are more than one event manager servers configured in the system. Select an event manager from the drop down menu. ## Identity Collector Select from the Identity Collector dropdown menu. - You can create identity collectors in the administrative client. **Applications > Configuration > Permissions Management > Identity Collectors**. - If adding a new identity collector, select the **Refresh** button to update the Identity Collector dropdown list. Select **Next** to open the Connection Details page. ## Connection Details - **Server Name** - Name of the server which is monitored - **Domain Name** - Credentials which will be used by the Permission Collector, Crawler, and Data Classifications - **Username** - Credentials which will be used by the Permission Collector, Crawler, and Data Classifications - **Password** - Credentials which will be used by the Permission Collector, Crawler, and Data Classifications - **Is Cluster Mode** - Click this checkbox to configure the Windows servers as a cluster. - **Cluster Nodes** - This option is available for cluster mode only. Click the button to type in physical cluster nodes to the dropdown list. This will create multiple XML configuration files, one for each physical node in the cluster. Type in a cluster node, and select the **+** icon to add this item to the list To delete an item from the list, select the **Delete** icon on the line. Select **Next**. # Enabling Access Fulfillment for an Application Access fulfillment is enabled per application in the application setting screen, for applications that support fulfillment (See the compatibility table in Compass for the full list) **To enable Access Fulfillment for an application** 1. Open the configuration screen of the required application. 1. Go to **Admin > Applications**. 1. Scroll through the list, or use the filter to find the application. 1. Select the **Edit** icon on the line of the application. 1. Select **Next** until you reach the **Access Fulfillment** settings page. Note The setting pages and entry fields vary according to the application type. 1. For non-normalized resources, you can select **Enable Access Fulfillment for Revoking Explicit Permissions** . See Access Fulfillment for Removal of Explicit Permissions. 1. Select **Enable Access Fulfillment for Normalized Groups**. - **Identity Collector** - Fulfillment requires an identity collector in order to run. If you did not select an identity collector in the General Details configuration page, you can select one from the drop down list now. If there is no identity collector defined for this application, or if you want to use a different identity collector than the ones in the dropdown list, you can create a new identity collector in the Administrative Client **Applications > Configuration > Permissions Management > Identity Collectors**. (**Add link**) See Create/Edit an Active Directory Identity Collector for more details on creating an identity collector. - **Managed Group OU (DN)** - The organizational unit in which the managed permission groups will be created. Make sure that the chosen identity collector’s user has permissions to create groups under this location (e.g. OU=FileAccessManagerManaged, DC=SailPoint, DC=COM)OU refers to an Organizational Unit, and DN refers to a Distinguished Name. - **How to Handle ‘List Folder Contents’ Permissions** - Not relevant for SharePoint - Create and manage a dedicated permissions group for it - this is the default value - Revoke these permissions - **How to Handle Inexact Permissions Matches** - During the normalization process, the application has to decide what to do with permissions that do not match the normalized permissions. - Fail the normalization process - Elevate to the nearest permission match - Revoke the permission 1. Open the Advanced Settings panel for additional settings: - **Group Cache Sync Interval(sec)** - This setting will add a pause to the process of setting normalize permissions on the resource. This will allow the endpoint's local AD groups cache to sync the newly created managed groups. The default Is 0 - signifying the process will not pause by default. - **Use Template Permission Group** - Template groups are created per application and added as a template to every managed resource. These groups are not managed by File Access Manager, and are usually used to ensure that users who need application-wide access such as backup or archiving users have access. Select for each permission group whether File Access Manager should create a group or whether to use an existing group, for the following groups: - List Folder Contents - Read & Execute - Modify - Full Control If you select **Use an Existing Group**, select the required group to use from the dropdown list. Once an application is enabled for access fulfillment, you can set specific resources to be normalized using the Manage Normalized Resources page. # Configuring Activity Monitoring - **To configure the activity monitoring polling parameters** 1. Open the edit screen of the required application. 1. Go to **Admin > Applications**. 1. Scroll through the list, or use the filter to find the application. 1. Select the **Edit** icon on the line of the application. 1. Select **Next** until you reach the Activity Configurations & Decs settings page. - **Polling Interval (sec)** - Activity fetching interval [in seconds]. Default is set to 60 seconds, - **Report Interval (sec)** - Activity Monitor Health reporting interval [in seconds]. Default is set yo 60 seconds. - **Local Buffer Size (MB)**- Local buffer size for activities [ in MB]. Default is set to 200MB. This cyclic buffer is used to store activities on the Application Monitor’s machine in case of network errors that prevent the activities from being sent. - **Activity Data Retention Period** Note By default, this feature is disabled. When selecting the Clear Activity Data option, a user is able to provide a time frame (1 to 100) in either months or years for all activity to be retained. Once that time period is met, all data will be removed. A user can also select to backup the data before it is deleted by selecting the Backup Events Before Clearing option. Note The Backup Before Clearing Option will only be enabled if the backup option is set during the system installation. If a user has not selected the backup option during the installation nor provided a backup path, this option will not be enabled. ## Configuring Data Enrichment Connectors The Data Enrichment Connectors (DEC) configuration enables us to select data enrichment sources. These can be used to add information from other sources about identities. An enrichment source could be a local HR database that is used to combine users' job descriptions or departments to the information stored in the identity store. Select the data enrichment connectors to enrich monitored activities from the Available DECs text box. Use the > or >> arrows to move the selected DECs to the Current DECs text box. The user can select multiple DECs. Simply select each desired DEC. You can create a new DEC in the Administrative Client(Applications>Configuration>ActivityMonitoring>DataEnrichmentConnectors). After creating a new DEC, select **Refresh** to refresh the dropdown list. The chapter Connectors of the File Access Manager Administrator Guide (**Add link**) provides more information on Data Enrichment Connectors, including what they are, how to configure them, and how they fit in the Activity Flow. ## Monitoring Exclusions To add an exclusion: 1. Select the dropdown list. 1. Type in an exclusion (file extension, user, folder, etc. as relevant). 1. Select the **+** icon to add this item to the list. 1. After completing the list, select **Next** or **Cancel** to close the panel. To edit or remove an exclusion from the list: 1. Select the dropdown list. 1. On the extension to edit or remove Select the delete or edit icon. 1. Select **Next** or **Cancel** to close the panel. To clear the entire list: 1. Select **Clear Selection** to clear the entire list. 1. **Excluded File Extensions**- List of file extensions that are not monitored. e.g. : txt, exe Enter one value at a time as described above. - **Exclude Folders** - List of folders that are not monitored, e.g., C:\\folder1\\subfolder2. Enter one value at a time as described above. - **Exclude Users** - List of users whose activities are not monitored, e.g., user1, domain\\user2, [user3@domain.com](mailto:user3@domain.com). Enter one value at a time as described above. Note The user format to be used depends on how the activity is logged by the endpoint. If you are not sure which of the user formats above to use, either specify all of them, or leave the list empty for now and navigate to the Forensics > Activities screen in the File Access Manager Website after some activities flow in to see how the user is depicted in them and use that depiction in the exclusion list. ## When an activity from a new resource is detected (Modes of Storing Activities) - **Full Auto-Learning Mode** – Will audit everything (every action) on every resource. - **Semi Auto-Learning Mode** – Will monitor activities on resources nested under the top-level resources that are marked for Monitoring. This operation mode will also allow the user to select what type of activities are being monitored. ## Monitored Actions The user has the ability set monitored actions within Manage Resources. 1. Go to **Admin > Applications**. 1. Under the Actions column, select the **ellipsis** icon on the desired application. 1. Select Manage Resources. The Manage Resources will display with all resources listed. 1. Select Manage Monitored Actions. 1. Toggle the Enable Activity Monitoring for this Resource Hierarchy. The user can now select the type of actions they want monitored. Note All actions are automatically selected initially. ## Activity Monitoring Setup Notes for Windows File Server Warning **For Windows File Server**- The excluded folders must be in the physical path format (for example, C:\\Windows), and not in the share path of the folder. The exclusion of a folder will result in an event not being sent to any of the shares mapped to the physical folder. Note It is strongly recommended that the following users in Windows be excluded: - Local System - NT Authority # Selecting and Scheduling the Data Classification Settings To associate an application with a data classification service, and set the schedule 1. Open the edit screen of the required application 1. Go to **Admin > Applications** 1. Scroll through the list, or use the filter to find the application 1. Select the edit icon **Edit** icon on the line of the application 1. Select **Next** till you reach the **Data Classification** settings page. The actual entry fields vary according to the application type 1. **Central Data Classification Service** - Associate the application with a Central Data Classification Service. This service is responsible for running the Data Classification tasks. If the “Central Data Classification” wasn’t installed during the installation of the server, this field is disabled. - **Disabling Data Classification** - To disable data classification, delete the entry from the central data classification field. Disabling data classification can also be achieved by setting the scheduler to be inactive (which is the default setting for data classification). - **Create a Schedule** - This option is enabled only if a central data classification service is selected. See Scheduling a Task. Note See the chapter “Data Classification” in the File Access Manager Administrator Guide for more information. Select **Next** or **Finish**. ## Data Privacy A user can associate the application with a Central Data Classification Engine Service. This engine will be responsible for executed Data Privacy tasks. Though using different processes for each, the Data Classification engine service is in charge for both Data Privacy and Data Classification discovery tasks. You may choose the same service for both, or use a different one for each, to run them in parallel. Note The fields on the Data Privacy step are the same as the Data Classification step. # Configuring and Scheduling the Permissions Collection Permissions can be analyzed to determine the application permissions of an out-of-the-box application, provided you have defined an identity store for File Access Manager to use in its analysis, and you have run a crawl for the application. The permission collector is a software component responsible for analyzing the permissions in an application. The Central Permission Collector Service is responsible for running the Permission Collector and Crawler tasks. If the File Access Manager Central Permission Collector wasn’t installed during the installation of the server, this configuration setting will be disabled. ## To configure the Permission Collection - Open the edit screen of the required application. - Go to **Admin > Applications**. - Scroll through the list, or use the filter to find the application. - Select the **Edit** icon on the line of the application. - Select **Next** until you reach the **Crawler & Permissions Collection** settings page. The actual entry fields vary according to the application type. When entering this page in edit mode, you can navigate between the various configuration windows using the **Next** and **Back** buttons. - **Central Permissions Collection Service** - Select a central permission collection service from the dropdown list. You can create permissions collection services as part of the service installation process. See section "Services Configuration" in the File Access Manager Administrator Guide for further details. - **Calculate Effective Permissions** - Calculate effective permissions during the permissions collection run. - **Calculate Riskiest Permissions** - Calculates the riskiest permission on a resource – for example, Full Control is riskier than Read permissions if both are on a resource. This option is available when selecting **Calculate Effective Permissions** - **Skip Identities Sync during Permission Collection** - Skip identity synchronization before running permission collection tasks when the identity collector is common to different connector. Note This option is checked by default. You can now [schedule a task](#scheduling-a-task). ## Scheduling a Task To create a schedule: 1. Select **Create a Schedule**. 1. The system will provide a Schedule Name in the format `{appName} - {type} Scheduler`. Choose to keep or override this suggestion. 1. Select a scheduling frequency from the dropdown list. Schedule Frequency Options - Run After - Create dependency of tasks. The task starts running only upon successful completion of the first task. - Hourly - Set the start time. - Daily - Set the start date and time. - Weekly - Set the day(s) of the week on which to run. - Monthly - Set the day of the month on which to run a task. - Quarterly - Set a monthly schedule with an interval of 3 months. - Half Yearly - Set a monthly schedule with an interval of 6 months. - Yearly - Set a monthly schedule with an interval of 12 months. 1. Fill the Date and Time field with scheduling times. These fields differ depending upon the scheduling frequency selected. 1. Select the **Active** checkbox to activate the schedule. 1. Select **Next**. ## Configuring and Scheduling the Crawler To set or edit the Crawler configuration and scheduling 1. Open the edit screen of the required application. 1. Go to **Admin > Applications**. 1. Scroll through the list, or use the filter to find the application. 1. Select the **Edit** icon on the line of the application. 1. Select **Next** until you reach the **Crawler & Permissions Collection** settings page. The actual entry fields vary according to the application type. 1. Calculate Resource Size - Determine when, or at what frequency, File Access Manager calculates the resources' size. Select one of the following: - Never - Always - Second crawl and on (this is the default) 1. Select to open the [schedule](#scheduling-a-task) panel. ## Setting the Crawl Scope There are several options to set the crawl scope: - Setting explicit list of resources to include and / or exclude from the scan. - Creating a regex to define resources to exclude. ## Including and Excluding Paths by List To set the paths to include or exclude in the crawl process for an application 1. Open the edit screen of the required application. 1. Go to **Admin > Applications**. 1. Scroll through the list, or use the filter to find the application. 1. Select the **Edit** icon on the line of the application. 1. Select **Next** until you reach the **Crawler & Permissions Collection** settings page. The actual entry fields vary according to the application type. 1. Scroll down to the Crawl configuration settings. 1. Select **Advanced Crawl Scope Configuration** to open the scope configuration panel. 1. Select Include / Exclude Resources to open the input fields. 1. To add a resource to a list, type in the full path to include / exclude in the top field and Select **+** to add it to the list. 1. To remove a resource from a list, find the resource from the list, and select the **X** icon on the resource row. Note When creating exclusion lists, excludes take precedence over includes. ## Excluding Paths by Regex To set filters of paths to exclude in the crawl process for an application using regex. 1. Open the edit screen of the required application. 1. Go to **Admin > Applications**. 1. Scroll through the list, or use the filter to find the application. 1. Select the **Edit** icon on the line of the application. 1. Select **Next** until you reach the **Crawler & Permissions Collection** settings page.The actual entry fields vary according to the application type. 1. Select **Exclude Paths by Regex** to open the configuration panel. 1. Type in the paths to exclude by Regex, See regex examples in the section below. Since the system does not collect BRs that match this Regex, it also does not analyze them for permissions. ## Crawler Regex Exclusion Example The following are examples of crawler Regex exclusions: **Exclude all shares which start with one or more shares names** | Example | Regex | | ---------------------------------------------------------------------------- | ------------------------------------------------- | | Starting with `\\server_name\shareName` | `\\\\server_name\\shareName$` | | Starting with `\\server_name\shareName` or `\\server_name or OtherShareName` | `\\\\server_name\\(shareName or OtherShareName)$` | **Include ONLY shares which start with one or more shares names** | Example | Regex | | ------------------------------------------------------------------------- | ------------------------------------------------------ | | Starting with `\\server_name\shareName` | `^(?!\\\\server_name\\shareName($ \\.*)).*` | | Starting with `\\server_name\shareName` or `\\server_name\OtherShareName` | \`^(?!\\\\server_name\\(shareName or OtherShareName)($ | **Narrow down the selection** | Example | Regex | | ---------------------------------------------------------------- | ---------------------------------------- | | Include ONLY the C$ drive shares `\\server_name\*C$*` | `^(?!\\\\server_name\\*C*\$($ \\.*)).*` | | Include ONLY one folder under a share `\\server\share\*folderA*` | \`^(?!\\\\server_name\\share$($ | | Include ONLY all administrative shares | `^(?!\\\\server_name\\[a-zA-Z]\$($ )).*` | Note To write a backslash or a Dollar sign, add a backslash before it as an escape character. Note To add a condition in a single command, use a pipe character `|`. Note In Windows file server, the share `\\\Admin$` is excluded by default. **Excluding Top Level Resources** Use the top level exclusion screen to select top level roots to exclude from the crawl. This setting is done per application. **To exclude top level resources from the crawl process** 1. Open the application screen **Admin > Applications**. 1. Find the application to configure and Select the drop down menu on the application line. Select **Exclude Top Level Resources** to open the configuration panel. 1. **Run Task**- The Run Task button triggers a task that runs a short detection scan to detect the current top level resources. Before running the task for the first time, the message above this button is: "Note: Run task to detect the top-level resources". If the top level resource list has changed in the application while yo u are on this screen, press this button to retrieve the updated structure.Once triggered, you can see the task status in **Settings > Task Management > Tasks**. Note This will only work if the user has access to the task page. When the task has completed, press **Refresh** to update the page with the list of top level resources. 1. Select the top level resource list, and select top level resources to exclude. 1. Select **Save** to save the change. 1. To refresh the list of top level resources, run the task again. Running the task will not clear the list of top level resources to exclude. ## Special Consideration for Long File Paths in Crawl If you need to support long file paths above 4,000 characters for the crawl, set the flag `excludeVeryLongResourcePaths` in the Permission Collection Engine `App.config` file to true. By default this value will be commented out and set to false. This key ensures, when enabled, that paths longer than 4000 characters are excluded from the applications’ resource discovery (Crawl), to avoid issues while storing them in the SQLServer database. When enabled, business resources with full paths longer than 4000 characters, and everything included in the hierarchical structure below them, will be excluded from the crawl, and will not be collected by File Access Manager. This scenario is extremely rare. Note You should not enable exclusion of long paths, unless you experience an issue. - **Background** - File Access Manager uses a hashing mechanism to create a unique identifier for each business resource stored in the File Access Manager database. The hashing mechanism in SQLServer versions 2014 and earlier, is unable to process (hash) values with 4,000 or more characters. Though resources with paths of 4000 characters or longer are extremely rare, File Access Manager is designed to handle that limitation. - \*\*Identifying the Problem \*\*- When using an SQL Server database version 2014 and earlier. The following error message in the Permission Collection Engine log file: `System.Data.SqlClient.SqlException (0x80131904): String or binary data would be truncated.` In all other cases, this feature should not be enabled. - \*\*Setting the Long Resou\*\*rce Path Key - The Permission Collection Engine App.config file is `RoleAnalyticsServiceHost.exe.config`, and can be found in the folder. `%SailPoint_Home%\FileAccessManager\[Permission Collection instance]\` Search for the key `excludeVeryLongResourcePaths` and correct it as described above.