# SailPoint File Access Manager > SailPoint File Access Manager Help # SailPoint File Access Manager # File Access Manager 8.5 Overview Important This site covers the File Access Manager 8.5 features. View PDFs and documentation for [**past release versions**](https://community.sailpoint.com/t5/File-Access-Manager-Documents/File-Access-Manager-Documentation/ta-p/171244). File Access Manager protects sensitive regulated information across the cloud enterprise by securing against unwarranted access, highlighting risk factors, and placing governance controls over unstructured data. File Access Manager helps you securely manage access to your sensitive data and files in the cloud and on-premises. With File Access Manager, you can accelerate regulatory compliance by discovering and classifying sensitive data wherever it lives, enhance security by proactively monitoring for inappropriate or malicious file access, and reduce the burden on IT by empowering data owners to manage access to their own data File Access Manager extends SailPoint’s Identity Security Platform delivering visibility into unstructured data by discovering sensitive and regulated data, applying appropriate access controls and implementing governance processes. File Access Manager secures critical data assets in real-time, helps mitigate access-related risks and implement compliance and privacy workflows with greater efficiency across the organization on-premises and in the cloud. The exponential growth of data, and the infinite ways it is being shared in the age of digital transformation, cloud migration and remote work, challenges organization in ensuring the security and privacy of their most critical data. This exposes them to breaches and loss from fines, ransom, and reputational damage. File Access Manager helps enterprises identify sensitive and regulated data, mitigate risks from over-privileged access, take action in real-time against unwarranted access, and automate Governance and Privacy controls and workflows to ensure their compliance with today’s regulations – empowering organizations to take control over their unstructured data, wherever it may be. ## Where to Get More Information ### Compass User Community In [SailPoint’s user community](https://community.sailpoint.com/), you can engage with peers and experts to ask questions and share answers, submit ideas, read wiki articles and technical white papers, watch webinars, and more. ### SailPoint Developer Community The [Developer Community](https://developer.sailpoint.com/) contains everything you need to build, extend, and automate scalable identity solutions, including API documentation, developer tools, discussion forums, and a technical blog. ### Identity University At SailPoint's [Identity University](https://university.sailpoint.com/) you can enroll in self-paced e-learning or instructor-led training, watch short, targeted QuickLearns, and prepare for SailPoint certification exams. ### SailPoint Support [Get help](https://support.sailpoint.com/) with your SailPoint products by searching the knowledge base or contacting our Support team. # Access Certification Introduction Campaigns are procedures that complete access certification, starting with the creation of a Campaign Template. The purpose of these campaigns is to certify permissions or identities. You can create campaigns and define activities using the Campaign Template, the Identities and Permissions Forensics Template, or the Access Certification Template. Campaigns can be set to recur or be scheduled to check access certifications regularly. You can use existing campaign templates, create a template from an existing one, or create a new campaign template. Access Certification includes the following steps (in order): 1. Determine the identities/permissions to be certified. 1. Determine the review process to use. 1. Create an Access Certification Campaign. # Access Request To filter the default Access Request tasks, perform the following steps: 1. Select the **Access Request** tab. 1. Select one of the following options from the **Type** dropdown menu: - All - Request - Revoke 1. Select one of the following options from the **Status** dropdown menu: - All - Pending Creation - Pending Review - Pending Fulfillment - Closed 1. Select one of the following options from the **Applications** dropdown menu: - All - [Name of Relevant Application] 1. Select one of the following options from the **Origin** dropdown menu: - All - Self-Request - [Campaigns that generated access requests] 1. Select one of the following options from the **Due Date** dropdown menu: - All - Overdue - Due Today - Due in 7 days - No Due Date - Define Range... - If you select **Define Range...**, a two-month calendar view will display, as shown in **Viewing Access Certifications**. - Select a **start date**. - Select an **end date**. - The selected date range will display in the **Due Date** dropdown box. 1. Select **Reset** below the dropdown menus on the far right of the screen to reset all the filters. The filtered Access Request tasks will display in a table below the dropdown menus with the following columns: - **Due Date** - Displays "Expired" (in red), "Expires soon" (in yellow), or will be empty. - **Request ID** - A unique, system-provided ID for each access request. - **Request Type** - The access request type (for example, Request or Revoke). - **Requester** - The entity issuing the given access request. - **Application** - The application related to the access request (if there is one). - **Origin** - The origin of the access request (for example, Self-Request or a campaign that generated an access request). - **Request Date** - The date on which the access request was issued, in **mm/dd/yyyy** format. - **Current Status** - The current status selected from the **Current Status** dropdown menu. - **Progress** - A progress bar showing the relative progress made in the access request process. - **Actions** - Select **View** in the same row as a given access request to display the details of that access certification. ## Access Request Task Details All users can generate Access Requests using the New Access Request wizard in the File Access Manager website. Reviewers can also generate Access Requests to reject permissions in a campaign. If access is to be revoked, this can be considered a "Revoke" type of Access Request. To view Access Request details for a selected task, perform the steps indicated above. The Access Request detailed task screen shows permissions to review. This screen is similar for Access Certification and Access Request. Every screen features the **#** column and the **Actions** column. Other columns vary based on the administrator’s selections. # Campaign Management Navigate to **Compliance > Access Certification > Campaign Management**. Valid campaign statuses are: - Completed - Created - Creation Failed - Deletion Failed - In Progress - Pending Completion - Pending Creation - Pending Deletion - Pending Re-initialization - Pending Review in Progress ## Manage Existing Campaigns To manage existing campaigns, perform the following steps: 1. Navigate to **Compliance > Access Certification > Campaign Management**. The campaigns will display from left to right, sorted chronologically by the date of campaign creation. Each displayed campaign lists the following information: - **Template** - The template name displays as a link, which the user can select to edit the template. Any changes made to the template will only affect future campaigns. If the campaign was created without a template, "No Template" will display (but not as a link). - **Description** - The template description. - **Owner** - The template owner. - **Due Date** - The due date displays. If the status is **Creation in Progress** or **Created & Ready to Run**, then "Due date to be calculated during initial run" will show. When the campaign status is **Review in Progress**, the due date will be yellow for 0-7 days before the date or red if the due date has passed. - **Refresh** - This button refreshes the current campaign status and is located on the bottom left of the displayed campaign. - **Run Now** - This button only displays for a campaign whose status is **Created & Ready to Run**. When you select this tab, it creates a task that: - Runs the campaign - Sets a campaign due date - Sets the campaign reviewers - Sends email notifications to the reviewers, requesting them to approve or reject suggested user accesses. The menu button on the top right of each campaign display contains various options depending on the campaign status. Options include: - **Edit** - Edit the campaign. - **Save as Template** - Save the campaign as a template. - **Refresh** - Refresh the user’s view of the campaign status. - **Reinitialize** - Create a task that reinitializes the campaign. - **Delete** - Delete the campaign. - **Send Reminders** - Send reminder emails to reviewers to complete the campaign. - **Generate Report** - After you select this option, you can view the generated reports by navigating to **Reports > My Reports**. Note This report contains a detailed list of all records, including their process levels and a summary of their statuses. # Access Certification Flow: How to Create and Run a Campaign Campaigns have the following stages: 1. **Campaign Template** - Basic parameters from which you can create a campaign. 1. **Campaign Created and Ready to Run** - Campaigns that are waiting to be run. 1. **Campaign In Progress** - Campaigns in various stages of being run. Note For a complete list of campaign statuses, see **Campaign Management**. ## Run a Campaign You can run a campaign by any of the following methods: 1. Navigate to **Compliance > Access Certification > Campaign Management** and select a prepared campaign. Select **Run Now**. Select **+ New Campaign**, create a campaign, and run it. You can also save the created campaign as a template or schedule it to run later. 1. Navigate to **Compliance > Access Certification > Campaign Templates**, select **+ New Template**, and fill in the parameters. Select a template, then select **Create Campaign**. Fill in the parameters, and either select **Run Now** or schedule the campaign. # Creating an Access Certification Campaign Template If you created campaigns using a template and want to delete that template, you must first delete the campaigns from which it was created. If you attempt to delete the template, a notification will display the campaigns based on the template and request that you delete the campaigns before deleting the template. ## Actions for Compliance Managers and Administrators Compliance managers and administrators can select one of the following actions to manage campaign templates: - Create a new template - Edit an existing template - Duplicate an existing template - Delete an existing template - Create a campaign based on an existing template The templates will display from left to right, row by row, sorted chronologically by the date of template creation. ## Filtering Campaign Templates You can filter the display of current templates to find them more quickly. To filter the available campaign templates: 1. Select the **Filters** button. 1. Under **Filters**, type or select the relevant data in the following fields to narrow your search of campaign templates: - **Template Name** - Type the template name, or the first few characters of the name, then select the **Search** button next to that field. - **Owner** - Type the owner (user) name, or the first few characters of the name, then select the **Search** button next to that field. - **Type** - Select **All**, **Permissions**, or **Identities** from the drop-down menu. # Create a Template Based off Existing Template 1. Navigate to **Compliance > Access Certification > Campaign Templates**. 1. Select a template from those displayed. 1. Select **Create Campaign** on the bottom left of the selected template. The **Create Campaign** screen displays, with the **General Details** step displayed automatically. 1. In the **General Details** tab, fill in the following fields: - **Campaign Name** - Enter the name of the campaign. This is a mandatory field. - **Campaign Description** - Enter a description of the campaign. - **Instruction to Reviewers** - This instruction text displays to the reviewer in the approval screen. It can also be used in the campaign mail templates. - **Duration** - Select **Days**, **Weeks**, or **Months** from the dropdown menu, and type in the relevant number of days, weeks, or months. This is a mandatory field. The system sets the due date of a campaign based on the campaign duration. The due date is the date on which it is recommended that the campaign should end, but the campaign does not end automatically on that date. 1. Select **Next**. The **Save** step displays. 1. Under **Scheduling Campaign**, select one of the following options: - **Save & run manually** - This option saves the campaign for you to run manually in the future. - **Save & run automatically** - This option saves the campaign and runs it automatically when the template was set to run (in the **Create Template** or **Edit Template** steps). 1. Select **Save**. An Information pop-up window displays to indicate that the campaign has been saved successfully, and a task is created to create the campaign itself. 1. A **Campaign Management** link will display to redirect you to a screen to view the campaign. Alternatively, you can view the campaign by navigating to **Compliance > Access Certification > Campaign Management**. # Create a New Template 1. Navigate to **Compliance > Access Certification > Campaign Templates**. 1. Select **+New Template**. The **Create Template** screen displays, and includes the same steps in the same order as the [Create Campaign](https://documentation.sailpoint.com/fam/help/access_certification/creating_campaign/index.html) steps. 1. Select **Save**. The Save fields displayed in the Create Template process differ from the Save fields displayed in the Create Campaign process. Follow the process steps described in creating a campaign, from **General Details** to **Save**. When you reach the Save step, the Save tab is highlighted and the tab fields display. You may save the template with or without a schedule. - **Save the new template without a schedule** by leaving the **Enable Schedule** checkbox unchecked. - **Save the new template with a schedule** by checking the **Enable Schedule** checkbox, and then type or select the relevant data in the following fields: - **Frequency Type** - Select **Monthly** or **Yearly** from the drop-down menu. - **Starts On** - Select the calendar icon to the right of this field and select a start date from the calendar that displays. - **Ends On** - Select either the **Never** or **On** radio button. - To make the selection available indefinitely, select **Never**, and the end date selection will not be enabled. - To make the selection available for a set period, select **On**, then select the calendar icon to the right of this field, and select an end date from the calendar that displays. - **Interval Of** - Type the number of months or years (depending on the **Frequency Type** selection) to indicate how often to schedule the template. - **Summary** - This field summarizes the selections made in the previous fields (for example, "every 2 months on [start date] until [end date]"). - **Time** - Use the up and down arrows to select a schedule time, based on the 24-hour clock (for example, 1:05 p.m. displays as 13:05). - **Run the campaign manually** (not on a set schedule) by leaving the **Campaign will run automatically on the set schedule** checkbox unchecked. - **Run the campaign automatically on the set schedule** by checking the **Campaign will run automatically on the set schedule** checkbox. Note All campaigns created from this template and set to run automatically will continue to run until they are reset manually. 1. Select **Save**. An Information pop-up window displays to indicate that the template has been saved successfully, and a task is created to create the template. A **Template Management** link displays to redirect you to the Campaign Templates screen to view the template. Alternatively, view the campaign by navigating to **Compliance > Access Certification > Campaign Management**. ### Editing or Duplicating the Template - **Edit** the template to make changes to an existing template. - **Duplicate** the template to create a new template based on an existing one with some changes, if needed. # Delete an Existing Template 1. Navigate to **Compliance > Access Certification > Campaign Templates**. 1. Select a template from those displayed. 1. Select the **menu button** on the top right of the selected template. The **Edit**, **Duplicate**, and **Delete** options will display. 1. Select **Delete**. A question pop-up window displays asking if you are sure you want to delete the template. 1. Select **Yes** to delete the template or **No** to retain the template. # Duplicate Existing Template 1. Navigate to **Compliance > Access Certification > Campaign Templates**. 1. Select a template from those displayed. 1. Select the **menu button** on the top right of the selected template. The **Edit**, **Duplicate**, and **Delete** options will display. 1. Select **Duplicate**. The Duplicate Template screen displays, and includes the same steps (in order) as the Edit Template screen: - General Details - Filter Selection - Review Process - Summary - Save 1. Review each step and make any relevant changes. 1. Select **Next** to proceed to the next step. 1. Select **Previous** to return to the previous step. 1. An Information pop-up window displays to indicate that the template has been saved successfully. 1. Select **Close**. The duplicated template now displays as the newest template in the Campaign Templates display and has the same name as the original template, with "Copy of" before the name. Note If you no longer need a template, you can delete it. However, it is not possible to recover a template that has been deleted. # Edit an Existing Template 1. Navigate to **Compliance > Access Certification > Campaign Templates**. 1. Select a template from those displayed. 1. Select the **menu button** on the top right of the selected template. The **Edit**, **Duplicate**, and **Delete** options will display. 1. Select **Edit**. The Edit Template screen displays, and includes the same steps in the same order as in the Create Template screen: - General Details - Filter Selection - Review Process - Summary - Save 1. Review each step and make any relevant changes. 1. Select **Save** to save the changes. An information pop-up window will display to indicate that the template has been saved successfully. 1. Select **Close**. # Creating a Campaign to Certify Access Compliance Managers and Administrators, or anyone with the proper access rights, can create an access certification campaign, with or without an access certification template. You can create a one-off campaign, store the campaign definitions as a template to be reused in the future, or create a recurring or scheduled campaign. To create an Access Certification campaign without an Access Certification template: 1. Navigate to **Compliance > Access Certification > Campaign Management**. 1. Select **+ New Campaign**. The Create Campaign screen displays, and includes the following steps: - General Details - Filter Selection - Review Process - Summary - Save Note Fields marked with an asterisk are mandatory. # Adding General Details In **General Details**, type or select the relevant data in the following fields: **Name** - Enter the name of the campaign. This is a mandatory field. **Description** - Enter a description of the campaign. **Instruction to Reviewers** - This instruction text will display to the reviewer in the approval screen. It can also be used in the campaign mail templates. **Duration** - Select **Days**, **Weeks**, or **Months** from the drop-down menu, and type in the relevant number of days, weeks, or months. This is a mandatory field. The system sets the due date of a campaign based upon the campaign duration. The due date is the recommended end date of a campaign, although the campaign does not end automatically on that date. Note Select the information icon (letter “i” after the name of a field) under any of the Access Certification campaign steps listed above to view a more detailed explanation of that field. Select **Next**. # Sending a Campaign Invitation 1. Select **Edit** to modify this selection. 1. In the Edit screen, select **Use email template from setting screens** (recommended) or **Custom Email** to create an email that differs from the default email. # Campaign Reports The Campaign Summary Report provides an overview of the certification campaigns, including its execution statistics, the review process performed to certify or reject each individual access right, and additional information provided by the reviewers. Campaign Summary Reports are used to: - Share campaign results with stakeholders within the organization. - Be referenced in audit reviews. - Be archived for record-keeping, future audits, and to ensure continuous compliance. ## Generating the Report The Campaign Summary Report can be generated in two ways: - Using the **Campaigns Summary** report template. - Using the **Generate Report** action in the details section for each campaign, on the Campaign Management page. The report will be generated as an Excel spreadsheet (.xlsx file) and will contain several tabs with detailed information about the campaign: ## Report Tabs: - **Reports Summary** - Provides general information about the campaign, such as: - The time of creation. - The time it took to execute. - The distribution of results (records) included in the campaign. - Reviewers' decisions and resolutions. - **Reviewer Progress** - Provides an overview of the review process progress by each reviewer. This tab will display information as long as the campaign is in progress. Once the campaign is complete, no records will display in this section. - **Raw Data** - Lists all access rights records being certified in the campaign, containing similar information to the All Records tab under the Campaign Details page. - **Rejects Tab** - Provides information about access rights that were rejected during the certification campaign and should be revoked. # Edit the Display Columns 1. Select the drop-down list to display the selected columns. 1. Select **Edit** to modify this selection. The columns available are based on the filter selected in **Selecting Filters**. Therefore, if the filter has changed, the columns will also change accordingly. To add columns in the Edit screen, type free text in the **Add Display Columns** field. To delete items in the Edit screen, select the **x** to the right of the name of a display column in the fields. To change the order of items in a column, drag and drop the items to the desired location in the column. # Selecting Filters The Filter Selection tab is highlighted and the tab fields display. Type or select the relevant data in the following fields: - **Filter Type** - Select a filter type (**All**, **Permissions**, or **Identities**) from the drop-down list.\ You can update the filter selection in the Administrative Client if you have permission to do so, and then select the **Refresh** button. - **Filter List** - Select a filter from the drop-down list.\ Some of the filters are predefined, out-of-the-box **Permissions** and **Identities** filters. - **Filter Definition** - The displayed filter definition is based on the Administrative Client definitions.\ If there are several items included in the definition, select the number of items to display the items. Select **Next**. # Creating the Fulfillment Process Note The following is available only for a predefined review process. Select the drop-down list to display the selected reviewer(s). Select the **Edit** button to open the Fulfillment Process tab. The following are the options on the Fulfillment Process page: - **None** - No fulfillment process. - **Fulfill Permissions Revoke Requests** - Perform revoke requests that arise from this access campaign. Selecting this option will open the fulfillment option panel. - **Access revoke request should be viewed** - To review the access revoke request, check the checkbox. An access revoke request is created at the end of the campaign if any records were rejected. This request contains all the permissions that the campaign reviewers revoked. ## Fulfillment Options The fulfillment process could be either manual or automatic: - **Manual Fulfillment Review Process** - If an access request involves non-managed resources, a one-step review process is assigned to be fulfilled manually. The user responsible for the fulfillment will receive a fulfillment task. - **Execute Custom Script** - Automatic fulfillment using a customer-supplied script from the **Collector Synchronizer Service** folder. The script handles the fulfillment of the revoke requests. This process works on unmanaged Business Resources only. # Sending Reminder Emails 1. Select **Edit** to modify this selection. 1. In the Edit screen, select **Use email template from setting screens** (recommended) or **Custom Email** to create an email that differs from the default email. 1. Select the days and the time of day to send weekly reminders. 1. When you have completed all edits, select **Next**. The **Save** tab is highlighted, and the tab fields display. # Selecting the Review Process The **Review Process** tab is highlighted, and the tab fields are displayed. The predefined review process sources are **By Data Owner** or **By Selected Reviewer(s)**. If you select **By Data Owner**, the review process is only available for **Permission type** filters. In **Review Process**, type or select the relevant data in the following fields: - **Source** - Select a source (**All**, **Predefined**, or **Custom**) from the drop-down list. - **Review Process** - Select a review process from the drop-down list. The processes available depend on the **Source** you selected. You can update the review process list in the Administrative Client if you have permission to do so, and then select the **Refresh** button. - **Type of Account** - Select either **User Account** or **Group Account** from the drop-down list. This option is only displayed if you chose the **By Data Owner** review process or the **By Selected Reviewer(s)** review process. - **Default Reviewer(s)** - This option is only displayed for the **By Data Owner** predefined review process, since default reviewers are used when no data owner is found. This is a mandatory field. - **Selected Reviewer(s)** - This option is only displayed for the **By Selected Reviewer(s)** predefined review process to set a static list of reviewers. You can choose multiple users or groups. This is a mandatory field. Select **Next**. The Summary tab opens, showing a summary of the campaign. In this screen, you can view and edit the review parameters before saving and/or running the review. # Saving a Certification Campaign 1. Select one of the following options under **Scheduling Campaign**: - **Save & run manually** - Run the campaign when you choose, after the campaign has been created and is ready to run. - **Save & run automatically** - Run the campaign automatically after it has been created and is ready to run. If desired, check the **Save as template & add schedule recurrence** checkbox. Note You may create a campaign template with or without a scheduler. Also, you can either run the template-created campaign automatically after creating the template, or run it manually in the future. 1. Select **Save**. An information pop-up window will display to indicate that the campaign has been saved successfully, and a task is created to create the campaign itself. A **Campaign Management** link will redirect you to a screen to view the campaign. Alternatively, you can view the campaign by navigating to **Compliance > Access Certification > Campaign Management**. 1. Select **Close**. # Elasticsearch Backup Overview There are two types of Elasticsearch repositories, both of which are of the File System type. For more information, read [Elasticsearch File System Repository Documentation](https://www.elastic.co/guide/en/elasticsearch/reference/current/snapshots-filesystem-repository.html). The two repositories are: **Continuous_backup** Used for backing up the whole cluster. This repository holds snapshots that are taken every hour with the following name format: `fam-backup-yyyy.MM.dd-hh:mm:ss-UUID`. Every snapshot will be saved for 60 days. - This repository can contain up to 1500 snapshots (in case snapshots are also created manually). - It requires a minimum of 100 snapshots. **Retention_backup** Used for backing up the event indices that are deleted in the activity data retention process. A snapshot of the deleted indices will be created with the following name format: `retention_backup-yyyy.MM.dd-hh:mm:ss`. These snapshots will be saved forever. # Backup Elasticsearch Configuration 1. In the **Elasticsearch Configuration** window of the Server Installer, select the desired configuration. 1. Select **Use Elasticsearch Backup** to enable backup of elastic data. If this option is unchecked, there will be no backup of elastic data. This setting is also applied to the Elasticsearch disaster recovery backup. Without the backup, disaster recovery will not be possible. 1. If **Use Elasticsearch Backup** is selected, you must provide the Repository Path. This folder should be configured and have the appropriate permissions, as described in the previous section. Note Any change in the repository path will cause a restart of each elastic node. 1. Select **Enable Cluster Backup** to run the `continuous_backup` and take snapshots of the full cluster. This setting is also applied to the Elasticsearch disaster recovery backup. 1. If a disaster recovery environment is configured and **Use Elasticsearch Backup** was checked, you must provide the Repository Path for the disaster recovery Elasticsearch. This folder should be configured and have the appropriate permissions, as described in the previous section. Note The disaster recovery repository path must be different from the production repository path. 1. If any change occurs in the backup configuration, it is highly recommended to keep track of the continuous backup monitoring in the File Access Manager Admin Client Event Viewer. Ensure that no issues occurred and that snapshots are being created successfully. 1. Elasticsearch backup configuration changes are performed asynchronously by a task named **Update Elasticsearch Cluster Configuration** by the Scheduled Task Handler Service. # Continuous Backup Monitoring The continuous backup repository monitoring is run by the File Access Manager Scheduled Task Handler service. The monitoring starts 3 hours after the service begins and checks the `continuous_backup` snapshots once an hour. The results are displayed in the File Access Manager Admin Client Event Viewer. In case of errors, more detailed results can be found in the File Access Manager Scheduled Task Handler log and the Elasticsearch log. There is also an option to generate a report that provides more details in case of failures, including the name of the last successful snapshot. ## Elasticsearch Continuous Backup Monitoring Configurations Important The monitoring configurations should not be changed. However, if there is a temporary need to adjust them, this can be done in the **TaskScheduler’s App.config** file. - `elasticBackupHealthMonitoringPoolingIntervalInSeconds` – The interval to check the `continuous_backup` snapshots (default is 3600 seconds – 1 hour). - `elasticBackupHealthMonitoringDueTimeInSeconds` – The due time before starting to monitor the `continuous_backup` snapshots (default is 7200 seconds – 2 hours). Snapshots will start being taken one hour after enabling the backup. - `maxTimeSinceLastSuccessfulSnapshotInMinutes` – The period since the last successful snapshot before the backup status is set to **Failure** (default is 180 minutes – 3 hours). Note A useful command for manual monitoring is `‘GET _slm/policy/fam-backup’`. # Data Restoration More information about restoring Elasticsearch data can be found [here](https://www.elastic.co/guide/en/elasticsearch/reference/current/snapshots-restore-snapshot.html). ## Considerations Keep the following in mind when restoring data from a snapshot: - You can only restore an existing index if it’s closed and the index in the snapshot has the same number of primary shards. - You cannot restore an existing open index. - The restore operation automatically opens restored indices. To get a list of available snapshots ordered by descending start time, use the following commands: - `GET _snapshot/continuous_backup/*?order=desc` - `GET _snapshot/retention_backup/*?order=desc` To get a list of available snapshots from a specific date, use the following commands: - `GET _snapshot/continuous_backup/fam-backup-2022.08.02-*?verbose=false` - `GET _snapshot/retention_backup/retention_backup-2022.08.02-*?verbose=false` ## Restore a Deleted Index To restore a deleted index or indices, find the specific snapshots which contain the index you want to restore. ```text POST _snapshot/retention_backup/retention-backup-2022.08.01-00:10:00/_restore { "indices": "events_2022_07_2, events_2022_05_1" } ``` ## Restore an Existing Index If you need to restore an existing index, there are two preferable ways to do it: **1. Delete and Restore** For more information, refer to the [Elasticsearch documentation on delete and restore](https://www.elastic.co/guide/en/elasticsearch/reference/current/snapshots-restore-snapshot.html#delete-restore). In case you only need to restore a specific index, the simplest way to avoid conflicts is to delete the existing index before restoring it. **Example:** DELETE pii-1, pii-8 In the restore request, explicitly specify the repository name, snapshot name, and any indices to restore. ```text POST _snapshot/continuous_backup/fam-backup-2022.08.03-09:00:00-fv59i0lpqjipxdtcwirs8a/_restore { "indices": "pii-1", "pii-8" } ``` **2. Rename and Restore** For more information, refer to the [Elasticsearch documentation on rename on restore](https://www.elastic.co/guide/en/elasticsearch/reference/current/snapshots-restore-snapshot.html#rename-on-restore). If you want to avoid deleting existing data, you can instead rename the indices you restore. This method is typically used to compare existing data to historical data from a snapshot. For example, you can use this method to review documents after an accidental update or deletion. ```text POST _snapshot/my_repository/my_snapshot_2099.05.06/_restore { "indices": "my-index,logs-my_app-default", "rename_pattern": "(.+)", "rename_replacement": "restored-$1" } ``` When the restore operation is complete, you can compare the original and restored data. If you no longer need the original index, you can delete it and use a reindex operation to rename the restored one. To delete the original index: DELETE my-index To reindex the restored index and rename it: POST \_reindex ```text { "source": { "index": "restored-my-index" }, "dest": { "index": "my-index" } } ``` ## Restore an Entire Cluster Caution This should only be used in case of a failure. Note File Access Manager recommends reading the Elasticsearch guide first which can be accessed here. Temporarily stop indexing and turn off the following features: **GeoIP database downloader** ```text PUT _cluster/settings { "persistent": { "ingest.geoip.downloader.enabled": false } } ``` **ILM** ```text `POST _ilm/stop` ``` **Monitoring** ```text PUT _cluster/settings { "persistent": { "xpack.monitoring.collection.enabled": false } } ``` **Machine Learning** `POST _ml/set_upgrade_mode?enabled=true` **Watcher** `POST _watcher/_stop` Use the cluster update settings API to set **action.destructive_requires_name** to false. This allows you delete data streams and indices using wildcards. ```text PUT _cluster/settings { "persistent": { "action.destructive_requires_name": false } } ``` Delete all existing data streams on the cluster. ```text `DELETE _data_stream/*?expand_wildcards=all` ``` Delete all existing indices on the cluster. ```text `DELETE *?expand_wildcards=all` ``` Restore the entire snapshot, including the cluster state. By default, restoring the cluster state also restores any feature states in the snapshot. ```text POST _snapshot/my_repository/my_snapshot_2099.05.06/_restore { "indices": "*", "include_global_state": true } ``` Note Restore request return immediately. The restore happens in the background and the user needs to wait while it completes. The GET \_cluster/health request can be used to monitor Cluster Health and restore progress. When the restore operation is complete, resume indexing and restart any features you stopped: **GeoIP database downloader** ```text PUT _cluster/settings { "persistent": { "ingest.geoip.downloader.enabled": true } } ``` **ILM** `POST _ilm/start` \*\*\*Machine Learning\*\* `POST _ml/set_upgrade_mode?enabled=false` **Monitoring** ```text PUT _cluster/settings { "persistent": { "xpack.monitoring.collection.enabled": true } } ``` **Watcher** `POST _watcher/_start` Reset the `action.destructive_requires_name cluster` setting. ```text PUT _cluster/settings { "persistent": { "action.destructive_requires_name": null } } ``` # Elasticsearch Backup Installation Important Before you install the Elasticsearch backup, make sure that Elasticsearch has access and proper permissions to the backup folder. Note Some settings are applied through a task outside the Server Installer, which could result in a longer completion time. Verify that all changes were applied successfully. Note It is recommended not to change multiple settings at the same time. Change each setting separately and verify it was completed successfully before continuing with the next change. To set permissions to the backup folder, complete the following. 1. Navigate **Folder Properties** > **Sharing** > **Share...** > **Share** to set the folder as a share. 1. Navigate to **Folder Properties** > **Sharing** > **Advanced Sharing...** to share the backup base path with all master and data nodes 1. Check **Share this folder**. 1. Navigate to **Permissions** > **Add...** > **Object Types...**. 1. Check **Computers** and select **OK**. Add all the master and data nodes (`MACHINE_NAME$`). Note It is recommended to have an odd number of nodes, ideally 3 or more. 1. Select **OK**. 1. In the Permissions window, give each node a Change permission. 1. Select **OK** > **OK** > **Close**. 1. Set the shared folder’s NTFS security settings to **Modify** for all master and data nodes. 1. Navigate to **Folder Properties** > **Security** > **Advanced** > **Permissions tab** > **Add**. 1. Select a principal. 1. Navigate to **Object Types**. 1. Select **Computers** and then select **OK**. 1. Add one of the nodes (`MACHINE_NAME$`) and select **OK**. 1. Set basic permissions to **Modify** and select **OK**. Important Do this for all master and data nodes. **Domain Trust (if applicable):** If Elasticsearch and the backup folder are in different domains, the domains should have trust between them. # Retention Backup In case backup was enabled at the system level (see [Backup Elasticsearch Configuration](https://documentation.sailpoint.com/fam/help/activity_backup/backup_config.html)), snapshots of activity indices will be taken for any application that has **Activity Data Retention** configured. The snapshot will contain all the indices that should be deleted and will be created before the retention deletion process takes place. The snapshot repository and format are described in the [Elasticsearch Backup Overview](https://documentation.sailpoint.com/fam/help/activity_backup/index.html). To enable retention backup, complete the following steps: 1. In the **Server Installer**, select the **Use Elasticsearch Backup** option. 1. When setting up an application, on the Activity Configurations and DECs screen, enable **Clear Activity Data** and **Backup Events Before Clearing**. 1. Provide the time frame for keeping the backup data. 1. Within the Tasks screen, initiate the **Activity Data Retention Cleanup** task. Running this task will: - Mark indices for deletion for each configured application. - Back indices to the **"retention_backup"** folder. - Delete the backup indices. # Troubleshooting Activities The best way to troubleshoot activities is to follow their activity trail. Use a specific Collector Installation and Configuration Guide to troubleshoot a specific monitoring issue for a given Activity Monitor. Below are suggestions of what to look for in various services: ## Application - Ensure all prerequisites were completed successfully. - Activities should be generated when relevant. For example, check that relevant activities are generated in the Event Log in Active Directory or that they are included in the Exchange Audit log. ## Activity Monitor Log - Check if the log has errors. - View the **Monitor Statistics** file to ensure events were received. - Check the monitoring mode (full, semi, or discarded) to see events that were monitored but not sent. ## Event Manager - View Event Collector statistics for new events entered and then moved to the memory queue. - Ensure that events were saved in the Event Manager (one Connector at a time or through a dedicated Event Manager). - Check if the Event Manager log has errors. # Administrator Guide Overview Use the Administrator guide to understand how to use File Access Manager. ## Terms Used in File Access Manager The terms used in the File Access Manager website and File Access Manager Administrative Client refer to users and user permissions in two different contexts: - **Business Resource Users**\ Entities within the organization, their access permissions to various company resources, and the activities they perform on these resources. - **Users**\ Entities such as company employees and bots with access to company resources. - **User Permissions**\ Permissions or capabilities granted to a user to perform tasks such as reading and writing to a Windows file server, sending emails, writing to Google Drive, deleting files, etc. - **File Access Manager Website Users** Administrators and users of File Access Manager and their access permissions to various parts of the application. What reports they can run, what resources they are allowed to view, etc. The following terms are used to define the users and access permissions in these contexts: | **Context Term** | **Business Resource Users** **(#1 above)** | **File Access Manager Website Users** **(#2 above)** | **File Access Manager Administrative Client users** | | ----------------------------------- | ------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------- | | User | “User” | “User” | “User” | | Groups of users | “Group” Such as: - Active Directory group | “Group Account” | | | Permission | “Permission” Such as: - Read Full Access - Delete | “Right” Such as: - Run report - Access - Dashboard | “Permission” Such as: - Add Application - Load New Package - New Scheduled Task | | Group of permissions | | “Capability” Such as: - Administrator - Data Owner | “Role” Such as: - API User - Read Only | | Resources user is allowed to access | Part of “Permissions” | “User Scope” (\* The user can access these resources in the context of File Access Manager, and not the resources themselves) | “User Data Role” | Permissions define which users can access which files on a given application resource, such as permission to a given directory or message group. Rights define what which sections, screens, etc. users can access and what actions they can do there. Scope may refine rights further based on an entity's role within the organization or tasks they need to complete. ### Rebranding Note This section is relevant for upgrades from versions earlier than File Access Manager 8.0. With the rebranding of SecurityIQ to File Access Manager in release 8.0, the terms below have been converted. Some of the legacy terms might still appear in some of the application screens and the accompanying documentation. File Access Manager release 8.0 is the next release following SecurityIQ release 6.1. | File Access Manager term | Legacy SecurityIQ term | | ------------------------ | ---------------------- | | File Access Manager | SecurityIQ | | Capability | Role | | Right | Permission | # File Access Manager Initial Configuration With File Access Manager now fully installed, the user may now set up Identity Collectors, set up Data Enrichment Collector, add new applications, and more. To set these up: 1. Login into the Admin Client with WBXAdmin and add a user as the admin. 1. Create a Data Enrichment Connector (DEC). 1. Login into the website with WBXAdmin and create an Identity Collector associated to the DEC. ## Session Management Once the user data is retrieved from the DB, the user is stored in IIS sessions in-memory object. The sessions in the application are configured to store data for 10 minutes (sliding expiration). If there are any requests made to the server during the last 10 minutes, session objects are distracted and authentication flow will resume on the next access to the DB. The `iisreset` command deletes sessions objects immediately. Note In HA/DR configurations, each IIS server stores the sessions in each server separately. ## File Access Manager Website Authentication Only users defined in the authentication store can log into the web application, and only after the collector synchronizer task completed. When configuring File Access Manager for the first time, either wait for the initial scheduled time, or schedule the authentication store identity collection to **run now**. To check the Collector Synchronizer task status in the administrative client health center: 1. Open the Health Center. In the administrative client, select **Health Center** on the left menu. 1. Select the **Permission Collection** to open a permission collection related panel. 1. Select the **File Access Manger Collector Synchronizer** 1. Select the **Tasks** panel. 1. Select **Show Tasks from all users**. 1. Check the **Synchronize Identity Collector** task status. # Review Process The review process involves a review of permissions, access certification, access requests, or access fulfillments. A review process consists of one or more levels, each level containing one or more reviewers. The reviewed permissions and violations move through the process from the reviewers on the first level through the last level. Each reviewer decides whether to approve or revoke a given permission or violation. If there are multiple reviewers on a given level, the administrator can configure that level to require the approval of only one, or all, of the reviewers. There are two types of review processes: - Static - Defining all reviewers at each level statically, disregarding the groups to which they belong. - Dynamic - Defining all reviewers at each level dynamically, based on the content of a permission field. Reviewers can review many permissions during the review process. Each permission consists of several entities, consisting of these and other details: - User - Group - Business Resource - Permission Types The permissions in the table below can serve as a simple illustration of a review process. | User | Group | Business Resource | Permission Type | | ------ | ----------- | ----------------- | --------------- | | Fatima | Engineering | C:\\R&D | Read | | Lucas | Accounting | C:\\Finance | Full Control | | John | Legal | C:\\Legal | Read/Write | The determination of the identity of the reviewer for the permissions to review is based on the values in the Group Column, for example: - Chen will review the Engineering group - Ahmad will review the Accounting group - Emma will review the Legal group To accomplish this, we must provide File Access Manager with a Data Source having these conditions, mapped in a specific format. Mapping identifies: - Reviewer: User or Group - Reviewer Name - Reviewer Domain The Data Source must contain a list of conditions that map a value to one or more reviewers. A permission can consist of multiple fields, such as User Domain, User Type, Group Domain, Group Type, Permission Type, and the enriched fields of each basic entity. Dynamic review process types include: - Dynamic Applications - Includes permission entity fields (User, Group, Business Resource, and Permission Type) used in review decisions. These review processes are relevant to campaigns in which the scope contains either an application or a BR of a single application. - Dynamic Identity Collector- Includes User/Group entity fields used in review decision. These review processes are relevant to campaigns in which the scope contains multiple applications or BRs that share the same identity collector. Review process activities include: - Create a review process - Edit a review process - Delete a review process ## Creating a Review Process To create a review process, perform the following steps: 1. In the administrative client, go to **Review Processes**. The Review Processes window opens. 1. Select **New** to open the New Review Process Wizard. 1. Fill in a review name and description. 1. Select the source type: - Application - Identity Collector - Static Levels Only If multiple levels are involved, they can be a mixture of static and dynamic levels. - Application - Select the application to review from the Application Data Field dropdown list. - Identity Collector - Select the identity collector to be reviewed from the Identity Collector Data Field dropdown list. If you want to change the source type after passing this screen, select **Cancel**, and start the wizard again. 1. Select **Next** to open the Levels Definition window. ### New Review Process-Levels Definition The review process is composed of one or more approval levels. Each subsequent approver receives the approval request only if the previous level approvers have approved the request. As part of the configuration, you can set the number of required approves for a decision. Each approval level defines the user, users, or group selected as an approver of the request at this level, according to the following logic: - Dynamic Field - Approvers are selected according to various requestor parameters. - Static List of Users - A constant list of approvers. - Data Owners - The data owners of the resource being applied. 1. Select the **New Level** icon to open a new level. The default name is “Level 1." Each level receives an automatic sequenced name: Level 1, Level 2, and so on. 1. Select one of the following, depending upon the type of field desired for Level 1: Dynamic Field, Static list of users and groups, or Data Owners. - **Dynamic Field** - If you select the dynamic field, then select Data Source or Decision Table. A Data Source gathers data from a source outside of the system, while a Decision Table gathers data from within the system. - **Data Source** - If you select Data Source, fill in the following fields: **Data Source Name** Select a data source name from the dropdown menu to find the reviewer, and the following fields will be mapped with the data source: | **Field** | **Description** | | -------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Key Column | This field matches the data source with the relevant permission. Select a key column from the dropdown menu and enter a name for that key column. | | Object Domain Column | This entity conducts the review. Select an object domain column from the dropdown menu or enter a name for that object domain column. This corresponds to the Reviewer Domain Name (ACME) in the Data Source Wizard. | | Object Name Column | This column contains the name of the User or Group. Select an object name column from the dropdown menu or enter a name for that object name column. This corresponds to the Reviewer User/Group Name in the Data Source Wizard. | | Object Type Column | This column defines the type of reviewer (user or group). This corresponds to the Reviewer Type, or user, in the Data Source Wizard. | | Default | This is the default data source. Select either User or Group from the dropdown menu, and then enter the name of the default user or default group. The default user or group can be the same as the entity in the Key Column of the Data Source. While the default entity may also be one of the entities listed in Key or Value, the system selects the default entity if no other entity is available. | - **Decision Table** - If you select Decision Table, the following columns must be filled in: | **Field** | **Description** | | ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Key | What to look for in the field above. | | Object Type | The User or Group of reviewers. | | Value | The user or group to which to send the review. | | Actions | Select the **X** in this column to delete the corresponding row of the Decision Table. | | Default | This is the default reviewer. Select either User or Group from the dropdown menu, then enter the name of the default User or default Group. The default User or Group can be the same as the entity in the Key column of the Decision Table. While the default entity may also be one of the entities listed in Key or Value, the system selects the default entity from the authentication store if no other entity is available. For more information on the authentication store, see File Access Manager Initial Configuration Wizard. | 1. After completing the necessary values for either the Data Source or the Decision Table, under Per Node Conclusion, select either **First Reviewer** in every node or **All Reviewers** in every node. - **First Reviewer in Every Node** - The first reviewer’s approval of the review is sufficient. - **All Reviewers in Every Node** - The approval must be unanimous. If one reviewer revokes, the entire review is revoked. The choice of first review or all reviewers may differ at each level. a. If you select **Static list of users and groups**: - Click inside the Reviewers field. - Select each entity to serve as a reviewer. - Select the **+** at the right of the field to add that reviewer. b. If you select **Data Owner**, continue with step 4. 1. Select **Next**. The Review Process Permissions window opens. 1. Select **>** or **>** to associate available roles to review process roles. The review process must be associated with at least one role. If not, a warning displays. 1. Select **Next** to open the Review Process Summary Report window. 1. The Review Processes window displays with a list of all the review processes. 1. Select **Finish**. # Running and Viewing Reports File Access Manager provides advanced report generation capabilities. Reports can be generated using templates or initiating from tables in the File Access Manager website. Regardless of where reports are generated, all reports can be retrieved in the File Access Manager website. ## Editing Scheduled Reports in the Administrative Client Scheduled reports that are created in the Administrative Client can be edited in the Reports table. The following fields can be modified: | Field | Details | | ---------------- | --------------------------------------------------------------------------- | | Name | Name of the report | | Description | Description of the report | | Viewable by | Who can view the report | | Scheduling | Available to users who have the permission `Report Templates Administrator` | | Sharing | Available to users who have the permission `Report Templates Administrator` | | Displayed column | Available on certain types of reports | ## Using and Accessing Report Templates Report templates are templates for built-in reports, based on the user who accesses them. For example, administrators and users who have the permission `Report Templates Administrator` see all report templates, while data owners see only templates that are shared with data owners. Other users who are neither administrators nor data owners do not see any report templates. In the web client, go to the **Reports > Report Templates** screen to use the built-in report templates for standard and customized reports. ### Filter by Tags You can assign one or more tags per report to help find them later. The Filter by Tags panel on the left can be used to filter out relevant report templates. #### Search field 1. Enter the report tag. Available tags filter out as you type. 1. Select one of the available tags to filter out the report templates displayed. #### Created by me Select this checkbox to filter out your own report templates. ### Managing Tags 1. Select **Manage Tags** to open the tag management screen. This option is available by default to the Administrator capability only. Available options: - Hide system-defined tags by selecting the checkbox - Search for tags - Edit tags - Add customized tags The **Delete** option - trashcan icon - is disabled for system tags; they cannot be deleted. 1. Select the **Edit** option - a pencil icon - next to a non-system tag to edit that tag. You cannot use a name that already exists or use a blank tag. 1. Select **Save** to the right of the edited tag to save it. 1. Select **Save** at the bottom of the Manage Tags screen to save all changes. ### Running a Report 1. To run the report with settings other than the default parameters, select **Duplicate** from the template menu. This opens the **Duplicate Template** panel. 1. Set the desired report parameters, scheduling times, and other setup fields. 1. Select **Run Now** to run the report now. 1. Select **Save** to save the template for future use of this template. ## Report Mechanism File Access Manager sends reports to the recipients defined in the **Viewable by** section of the report. The system sends an email with a link to the report only to recipients with permission to download the report. If a recipient forwards that link to a user without permission to download a report, the recipient will not be able to download the report. ## Report Operations This section describes the operations you can perform on reports. To open the report management screen in the Administrative Client, go to Reports. 1. Double-click on a report to display report details. The Report Details window displays under the Reports window. 1. Select **Refresh** to refresh the Reports list. 1. Select **Delete** to delete a selected report. Note The Report Operations option is available only to users with the permission **System > Reports > Delete**. ### Editing Reports The following fields are available to edit a customized report: - Custom fields to display (where supported) - Recipients list - Name - Description - Scheduling Note It is not possible to change the query filter of a saved customized report. To edit report parameters in the Administrative Client, go to **Reports**. 1. Select a scheduled report from the list to edit. 1. Select **Edit**. The Welcome to the Schedule Report Wizard Screen displays. 1. Select **Next** on the Schedule Report Wizard welcome page. 1. The **Report Configuration** screen of the Schedule Report Wizard already displays the name in the **Name** field. 1. Enter a description in the **Description** field. 1. Double-click in the **Viewable By** field to view a list of users who can view the report. 1. Select a user’s name and the **+** sign. The user’s name appears in the box under the **Viewable By** field. 1. Select the **Send to Data Owners** checkbox to send the report to data owners. 1. Relevant queries appear in the **Query** section of the **Report Configuration** screen. 1. Select **Finish** to send the configuration to the system without configuring a report schedule. 1. If you select **Finish**, the following confirmation message displays:\ “You are creating a report without a scheduler. Do you wish to continue?” 1. Select **Yes** to save the report without configuring a report schedule, or **No** to return to the **Report Configuration** screen. 1. If you select **Yes** and the following warning message displays:\ “This action can only run by a File Access Manager user that is associated with a user from the authentication store. The action will not be executed,” this means that you logged into the client with a local File Access Manager user, rather than with an Active Directory user from the Authentication Store. Note Only Active Directory users can create reports, since File Access Manager needs the email address of the user and the user’s identity to generate the report. Otherwise: 1. If you select **No** in step 12, there is no additional message. Select **Next**. The Report Configuration screen displays. 1. Select the **Create a Schedule** checkbox to create a schedule, or **Finish** to send the report configuration to the system without a schedule. 1. If you select **Finish**, the following confirmation message displays:\ “You are creating a report without a scheduler. Do you wish to continue?” 1. Select **Yes** to send the configuration to the system without configuring a report schedule, or **No** to return to the **Report Configuration** screen. 1. If you select **Yes**, the following warning message displays:\ “This action can only run by a File Access Manager user that is associated with a user from the authentication store. The action will not be executed.” ### Report Actions Right click to see report options: - Run Now - run the report and send it to all recipients. - Run now and send only to me - run the report and send it to the current user who is active in the Administrative Client. Scheduled reports cannot be deleted. ## System Usage Report The system usage report aggregates information captured by the File Access Manager website audit mechanism in order to highlight usage statistics and highlight areas in the website that are the most and least used. It also has the ability learn about the usage habits of our customers - what flows are working better, where do we see flows taking longer or receive less traction. To ensure the privacy and anonymity of our users and customers, all private identifiable information is redacted and all particular user activity is abstracted or obscured. Usage statistics are aggregated to calculate averages and ranges, never information about particular users. # Web Localization - Editing Localization Files Localization is handled using JSON files that set an organization’s website text for each language. The row of each file contains both a key and a value, with the value containing text in the desired language. Edit the value portion of a localization file to change a word, phrase, or message on the website. 1. Identify the server on which the File Access Manager website is installed. 1. Open the following localization file folder: C:\\inetpub\\wwwroot\\cdn\\i18n 1. The translation files are named according to the language's local code as shown in the table below. | Language | Filename with Local Code | | --------------------- | ------------------------ | | Chinese (Simplified) | zh_CN.json | | Chinese (Traditional) | zh_TW.json | | Danish | da_DA.json | | Dutch | nl_NL.json | | English | en_US.json | | French (Canada) | fr_FR.json | | French (France) | fr_CA.json | | German | de_DE.json | | Hebrew | he_IL.json | | Italian | it_IT.json | | Japanese | ja_JA.json | | Portuguese (Brazil) | pt_BR.json | | Spanish | es_ES.json | | Swedish | sv_SE.json | 1. Edit the file with Notepad++, Textpad, or any online JSON viewer. 1. Each file row contains a key, which is the technical name of the word or expression, and a value, which is the actual text to be displayed on the website. 1. Edit the text, being careful to change only the value and **not** the key. 1. Save the file. 1. Refresh the website to view the edited text. Note Changes to the localization files will be overwritten by the next installation of File Access Manager. It is recommended to keep a backup of any updated translation file(s) and add in the corrections carefully after installation. In cases of errors in the translation, please notify your SailPoint representative so we can correct our files as well. # Access Certification (Campaigns) Access Certification is the process of verifying that the list of users and groups of users who currently have access to a particular resource should have access to that resource. Access Certification is performed by means of running campaigns, which match resources with users who have access to these resources, and sending these to reviewers for approval. Define the review in the File Access Manager Administrative Client A user can create a new campaign to certify permissions or identities, create a new campaign template, or use an existing campaign template to create new campaign. It saves a user time and effort to use a campaign template for recurring or scheduled campaigns, or to make small changes to the general configuration of a campaign. A user can also create a campaign template from an existing campaign for reuse in another campaign. Access Certification includes the following steps: 1. Determine the identities / permissions to be certified. 1. Determine the review process to use. 1. Create an Access Certification Campaign. # Campaign Management To manage existing campaigns Go to **Compliance > Access Certification > Campaign Management**. The campaigns display from left to right, row by row, sorted chronologically by date of campaign creation. You can filter the display of campaigns for easier viewing. ## Filtering Campaigns 1. Select **Filters**. 1. Under *Filters*, type or select the relevant data in the following fields to narrow your search of campaigns: - **Campaign Name** - Type the first letter or letters of the campaign name, and then select **Search** next to that field. - **Owner** - Type the first letter or letters of the owner (user), and then select **Search** next to that field. - **Status** - The dropdown list contains the following options: - Created - In Process - Completed - Pending Re-initialization - Pending Deletion - Pending Creation - Deletion Failed - Pending Review In Process - Pending Completion - Creation Failed - **Type** - Select **All**, **Permissions**, or **Identities** from the dropdown menu. - **Due Date** - Select **All**, **Overdue**, **Due Today**, **Due in 7 Days**, or **Define Range** from the dropdown menu. 1. If you select *Define Range* from the dropdown list, a calendar displays for you to select a date range. Each displayed campaign lists the following information: - **Template** - The template name displays as a link, which the user can select to edit the template. Any changes that the user makes to the template will only affect future campaigns. If the campaign was created without a template, “No Template” will display (but not as a link). - **Description** - The template description displays. - **Owner** - The template owner displays. - **Due Date** - The due date displays. If the status is Pending Creation (Creation in Progress) or Created (Created & ready to run), then “Due date to be calculated during initial run” displays. - **Color Code** - **Yellow** - Status is Pending Review in Progress, 0-7 days before the date. - **Red** - Status is Pending Review in Progress, due date has past. - **Refresh** - This button refreshes the current campaign status, and is located on the bottom left of the displayed campaign. - **Run Now** - This button only displays for a campaign whose status is Created (Created & ready to run). When you select this tab, it creates a task that: - Runs the campaign - Sets a campaign due date - Sets the campaign reviewers - Sends email notification to the reviewers, requesting them to approve or reject suggested user accesses. ### Menu Options The menu button, on the top right of each campaign display, contains various options, depending upon the campaign status. All options are available when the campaign status is Review in Progress, and include: - *Edit* - Edit the campaign. - *Save as Template* - Save the campaign as a template. - *Refresh* - Refresh the user’s view of the campaign status. - *Reinitialize* - Create a task that reinitializes the campaign. - *Delete* - Delete the campaign. - *Send Reminders* - Send reminder emails to reviewers to complete the campaign. - *Generate Report* - After you select this option, you can view the generated reports by navigating to **Reports > My Reports**. ## Campaign Management Reports A user can generate a report from the Campaign Management screen. This report contains a detailed list of all records, including their process levels and a summary of their statuses. ## Campaign Details The **Show Details** tab provides a variety of functions. 1. Select the **Show Details** tab to display campaign details, including the campaign name, template, owner, type, status, and other information. 1. Select **End Campaign** to end a campaign, or **Hide Details** to hide certain details. - End Campaign - Select this if you want to end a campaign in progress before all the reviewers have finished their tasks. The campaign will end automatically, and will remove all uncompleted tasks from the reviewers’ My Tasks lists. Once you end a campaign, all access requests that have not been rejected will be accepted, and the reviewers can no longer work on that campaign. In addition, it will create revoke requests for any records rejected during the campaign if the campaign was set to create those revoke requests. - Hide Details - Select this to hide the first three rows displayed. ### Campaign Detail Options - Pending Records Per Reviewers - This tab is activated by default. It is displayed with white letters on a blue background, and lists only the relevant campaign’s pending records by reviewer. - Reassign Records - Reassign pending records to different reviewer(s). - Send Reminders - Send reminders to reviewers regarding actions on pending records. - Bulk Actions - Reassign records in bulk or to send reminders in bulk. - Filter - Filter pending records by Reviewer or Level Name. - All Records - Display all a campaign’s records. You can reassign records, revert the review process, or show the review process if the campaign is in the In Progress status. - Reassign Records reassigns pending records to different reviewer(s). - Revert Review Process reverts the review process to a previous state. - Show Review Process shows all review process details at all levels. There is no **Show Details** button for a campaign whose status is Creation in Progress. ## Campaign Invitation This message is global to all campaigns but can be overridden for a specific campaign. It is sent to the reviewer with every new campaign pending that reviewer’s decision. To send a Campaign Invitation message, perform the following steps: 1. In the web client, go to **Settings > Message Templates > Access Certification > Campaign Invitation**. 1. Check **Enable Message**. 1. The checkbox turns green with a white check mark in it, and the fields under Subject and Message Template are enabled. ## Remove Direct Permissions in Campaigns When campaign reviewers reject access, this generates an access requests for permission removal. For additional information on access fulfillment and certification, see the Permissions chapter, and particularly [Access Fulfillment](https://documentation.sailpoint.com/fam/help/administrator_guide/permissions/access_fulfillment/index.html). 1. Create and save a Permissions Query, as described in [Creating and Editing a Forensics Query](https://documentation.sailpoint.com/fam/help/administrator_guide/forensics/index.html#creating-and-editing-a-forensics-query). 1. In the web client, go to **Compliance> Access Certification**: 1. Create a campaign using the Permission Query. 1. From **Summary > Fulfillment Process**, select **Edit**. 1. Select **Fulfill Permissions Revoke Requests**. 1. Select **Save and Run the Campaign**. 1. Once the review process for Access Requests is finished, the system removes all direct permissions on supported applications from the relevant BRs. ### Monitoring the Progress of Permission Removal Access Fulfillment is created for each direct permission marked for removal. To monitor progress, in the administrative client, go to Access Fulfillment in the administrative client and filter the Fulfillment Requests by Action “Remove Permission.” # Campaign Templates Compliance managers and administrators can manage campaign templates by selecting one of the following actions: - Create a new template - Edit an existing template - Duplicate an existing template - Delete an existing template - Create a campaign, based on an existing template The templates display from left to right, row by row, sorted chronologically by date of template creation. You can filter the display of current templates to find the templates more quickly. To filter the available campaign templates, perform the following steps: 1. Select **Filters**. 1. Under *Filters*, enter or select the relevant data in the following fields to narrow your search of campaign templates: - Template Name - Enter the first letter or letters of the template name, and then select **Search** next to that field. - Owner - Enter the first letter or letters of the owner (user), and then select **Search** next to that field. - Type - Select **All**, **Permissions**, or **Identities** from the dropdown list. ## Creating a Template To create a new Access Certification template, perform the following steps: 1. In the web client, go to **Compliance > Access Certification > Campaign Templates**. 1. Select **+New Template**. 1. The Create Template screen displays, and includes the same steps (in order) as described in [Creating Campaigns](https://documentation.sailpoint.com/fam/help/administrator_guide/access_certification_campaigns/create_campaign.html): - General Details - This step has the same fields as the Create Campaign step, except that the name field is for a template (not a campaign), and the description field is for a template (not a campaign). - Filter Selection - This step has the same fields as the Create Campaign step. - Review Process - This step has the same fields as the Create Campaign step. - Summary - This step has the same fields as the Create Campaign step. - Save - The Save fields displayed in the Create Template process differ from the Save fields displayed in the Create Campaign process. 1. Follow the process steps described in [Creating Campaigns](https://documentation.sailpoint.com/fam/help/administrator_guide/access_certification_campaigns/create_campaign.html), from *General Details* to *Save*. 1. When you reach the *Save* step, the *Save* tab is highlighted and the tab fields display. 1. You may save the template with or without a schedule. 1. Save the new template without a schedule by leaving the Enable Schedule checkbox unchecked, or 1. Save the new template with a schedule by checking the **Enable Schedule** checkbox, and then type or select the relevant data in the following fields: - Frequency Type - Select **Monthly** or **Yearly** from the dropdown menu. - Starts On - Select the calendar icon to the right of this field and select a start date from the calendar that displays. - Ends On - Select either the **Never** or the **On** radio button. - If you want the selection to be available indefinitely, select **Never**, and the end date selection will not be enabled. - If you want the selection to be available for a set period, select **On**, then select the calendar icon to the right of this field, and select an end date from the calendar that displays. Note The new campaign will be created from the Starts on date to the Ends on date, based on the selected frequency and interval in months or years. - Interval Of - Type the number of months or years (depending upon your Frequency Type selection above) to indicate how often you want to schedule the template. - Summary - This field is a display that summarizes the selections you made in the previous fields (for example, “every 2 months on [start date] until [end date]). - Time - Use the up and down arrows to select a schedule time, based on the 24-hour clock (for example, 1:05 p.m. displays as 13:05). 1. Run the campaign manually, and not per the schedule you just set, by leaving the Campaign will run automatically on the set schedule checkbox unchecked, or 1. Run the campaign automatically on the set schedule by checking the **Campaign will run automatically on the set schedule** checkbox. Note All campaigns created from this template that are set to run automatically will continue to run until they are reset manually. 1. Select **Save**. An Information pop-up window displays to indicate that the template has been saved successfully, and a task is created to create the template. A Template Management link displays to redirect you to a screen from where you can view the template. Alternatively, you can view the campaign by navigating to **Compliance > Access Certification > Campaign Management**. ## Editing a Template To make changes to an existing template, edit the template. To make a new template, based on an existing template with some changes, duplicate the template. Editing an existing Access Certification template: 1. In the web client, go to **Compliance > Access Certification > Campaign Templates**. 1. Select a template from the displayed templates. 1. Select **Menu** on the top right of the selected template. 1. The Edit, Duplicate, and Delete options display. 1. Select **Edit**. 1. The Edit Template screen displays, and includes the same steps (in order) as the Create Template screen: 1. General Details 1. Filter Selection 1. Review Process 1. Summary 1. Save 1. Review each step and make any relevant changes. 1. Select **Next** to proceed to the next step, or select **Previous** to return to the previous step. 1. When you select **Save**, an information pop-up window displays to indicate that the template has been saved successfully. 1. Select **Close**. ## Duplicating a Template To duplicate an existing Access Certification template: 1. Go to **Compliance > Access Certification > Campaign Templates**. 1. Select a template from the displayed templates. 1. Select **Menu** on the top right of the selected template. 1. The Edit, Duplicate, and Delete options display. 1. Select **Duplicate**. 1. The Duplicate Template screen displays, and includes the same steps (in order) as the Edit Template screen. 1. Review each step and make any relevant changes. 1. Select **Next** to proceed to the next step, or select **Previous** to return to the previous step. 1. When you select **Save**, an information pop-up window displays to indicate that the template has been saved successfully. 1. Select **Close**. The duplicated template will be the newest template in the Campaign Templates display, and will have the same name as the original template, with “Copy of” before the name. ## Deleting a Template If you no longer need a template, you can delete it. Once deleted, it cannot be recovered. To delete an existing Access Certification template 1. Go to **Compliance > Access Certification > Campaign Templates**. 1. Select a template from the displayed templates. 1. Select **Menu** on the top right of the selected template. 1. The Edit, Duplicate, and Delete options display. 1. Select **Delete**. 1. A question pop-up window displays, asking if you are sure you want to delete the template. 1. Select **Yes** to delete the template, or select **No** to retain the template. If you created campaigns using a template, you cannot delete that template without first deleting the campaigns from which it was created. If you attempt to delete the template, a notification will display those campaigns, requesting that you delete them before you delete the template. ## Creating a Campaign To create an Access Certification campaign, based upon an existing Access Certification template: 1. In the web client, go to **Compliance > Access Certification > Campaign Templates**. 1. Select a template from the displayed templates. 1. Select **Create Campaign** on the bottom left of the selected template. 1. The Create Campaign screen displays, with the General Details step displayed automatically. 1. In General Details, type or select the relevant data in the following fields: - Name - Enter the name of the campaign. This is a mandatory field. - Description - Enter a description of the campaign. - Instruction to Reviewers - This instruction text displays to the reviewer in the approval screen. It can also be used in the campaign email templates. - Duration - Select **Days**, **Weeks**, or **Months** from the dropdown menu, and type in the relevant number of days, weeks, or months. This is a mandatory field. The system sets the due date of a campaign, based upon the campaign duration. The due date is the date on which it is recommended that a campaign should end, but the campaign does not end automatically on that date. 1. Select **Next**. The Save step displays. 1. Under Scheduling Campaign, select one of the following options: - Save & run manually - This option saves the campaign for you to run manually in the future. - Save & run automatically - This option saves the campaign, and runs it automatically when the template was set to run (in the Create Template or Edit Template steps). 1. Select **Save**. An Information pop-up window displays to indicate that the campaign has been saved successfully, and a task is created to create the campaign. A Campaign Management link displays to redirect you to a screen to view the campaign. You can see the campaigns and campaign statuses on the Campaign Management screen. # Creating Campaigns Compliance managers and administrators can create an Access Certification campaign, with or without an Access Certification template. Creating an Access Certification campaign without an Access Certification template 1. In the web client, go to **Compliance > Access Certification > Campaign Management**. 1. Select **+ New Campaign**. 1. The Create Campaign screen displays, and includes the following steps: 1. General Details 1. Filter Selection 1. Review Process 1. Summary 1. Save An asterisk after the name of a field marks it as mandatory. 1. In *General Details*, type or select the relevant data in the following fields: - Name - Enter the name of the campaign. This is a mandatory field. - Description - Enter a description of the campaign. - Instruction to Reviewers - This instruction text will display to the reviewer in the approval screen. It can also be used in the campaign email templates. - Duration - Select **Days**, **Weeks**, or **Months** from the dropdown menu, and type in the relevant number of days, weeks, or months. This is a mandatory field. - The system sets the due date of a campaign, based upon the campaign duration. The due date is the recommended end date of a campaign, although the campaign does not end automatically on that date. Note If the access certification / access revoke request was created from a filter defined with a classification category, the classification category column is displayed in the access certification / access revoke request. 1. Select **Next**. 1. The *Filter Selection* tab is highlighted and the tab fields display. 1. In *Filter Selection*, type or select the relevant data in the following fields: - Filter Type - Select a filter type (All, Permissions, or Identities) from the dropdown list. You can update the filter selection in the administrative client (if you have permission to do so), and then select **Refresh**. - Filter List - Select a filter from the dropdown list. Some of the filters are predefined, out-of-the-box Permissions and Identities filters. - Filter Definition - The displayed filter definition is based on the administrative client definitions. Note If there are several items included in the definition, select the number of items (for example, **5 items**). 1. Select **Next**. 1. The *Review Process* tab is highlighted and the tab fields display. The predefined review process sources are “By Data Owner” or “By Selected Reviewer(s).” If you select “By Data Owner,” the review process is only available for Permission type filters. 1. In *Review Process*, type or select the relevant data in the following fields: - Source - Select a source (All, Predefined, or Custom) from the dropdown list. - Review Process - Select a review process from the dropdown list. The processes available depend upon the Source you selected. You can update the review process list in the File Access Manager administrative client (if you have permission to do so), and then select **Refresh**. - Type of Account - Select either **User Account** or **Group Account** from the dropdown list. This option is only displayed if you chose the By Data Owner review process or the By Selected Reviewer(s) review process - Default Reviewer(s) - This option is only displayed for the By Data Owner predefined review process, since default reviewers are the reviewers when no data owner was found. *-OR-* - Selected Reviewer(s) - This option is only displayed for the By Selected Reviewer(s) predefined review process to set a static list of reviewers. You can choose multiple users or groups. 1. Select **Next** The **Summary** tab is highlighted and its fields display. 1. In *Summary*, you can view a summary of your Create Campaign selections in the following fields: - Campaign Name - Campaign Duration - Filter Selected - Review Process Notes - When a campaign is complete, no records will display. Only when a campaign is in progress, will a record display. - This view is available for a predefined review process. Select the dropdown list to display the selected reviewer(s). - Fulfillment Process - select **Edit** to edit this selection. In the *Edit* screen, select: 1. **None** or 1. **Fulfill Permissions Revoke Requests**. This will open the fulfillment process panel. Note An access revoke request is created at the end of the campaign if any records were rejected. This request contains all the permissions that the campaign reviewers revoked. To review the access revoke request, select **Access revoke request should be reviewed**. - Manual Fulfillment Review Process - if an access request involves non-managed resources and identifies, a one-step review process is assigned to be fulfilled manually. - Display Columns - select the dropdown list to display the selected columns. Select **Edit** to edit this selection. The columns available are based on the filter selected in Step 2. Therefore, if the filter has changed, the columns will also change accordingly. 1. To add columns in the Edit screen, type free text in the Add Display Columns field. 1. To delete items in the Edit screen, select the **x** to the right of the name of a display column in the fields under Current Display Columns. 1. To change the order of items in a column, drag and drop the items to the desired location in the column. - Campaign Invitation - select **Edit** to edit this selection. 1. In the Edit screen, select **Use email template from setting screens (recommended)** or **Custom Email** to create an email that differs from the default email. - Reminder Emails - select **Edit** to edit this selection.\ In the *Edit* screen, select **Use email template from setting screens (recommended)** or **Custom Email** to create an email that differs from the default email. - You must select the days and the time of day to send weekly reminders. 1. When you have completed all edits, select **Next**. The *Save* tab is highlighted and the tab fields display. 1. Select one of the following options under **Scheduling Campaign**: - Save & run manually - Run the campaign when you choose after the campaign has been created and is ready to run - Save & run automatically - Run the campaign after it has been created and is ready to run. If desired, check the **Save as template & add schedule recurrence** checkbox. 1. You may create a campaign template with or without a scheduler. Also, you may either run the template-created campaign automatically after creating the template, or you may run it manually in the future. 1. Select **Save**. 1. An Information pop-up window displays to indicate that the campaign has been saved successfully, and a task is created to create the campaign, itself. A “Campaign Management” link displays to redirect you to a screen to view the campaign. Alternatively, you can view the campaign by navigating to **Compliance > Access Certification > Campaign Management**. 1. Select **Close**. # Activities This chapter describes the collecting and monitoring activities (events), as well as the File Access Manager services of the activity collection process. Note This section does not discuss how to monitor specific types of applications. The Collector Installation guides provide information on the installation and configuration of specific collectors. ## Monitoring Activities Monitoring activities in involves capturing information about events that users perform on monitored applications. An activity includes the following elements: | Element | Description | | ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- | | Who | A user performing the action | | Performed what action? | Read, write, or delete | | Where? | On what business resource, for example a file, a file folder, a SharePoint site, or an Exchange mailbox | | When? | Date and time. The timestamp is stored in UTC, and displayed to the user in its current time-zone, based on the computer from which they are connecting | ## Event Example 1. User jsmith, performed a write action on the \\file_server\\Finance\\2015\\cashflow.xlsx at 7:35 pm at 16 March 2015. 1. User contextual information for this activity are added from additional data sources, including: - Attributes from the user’s Active Directory, such as the user’s display name, groups to which the user belongs, the user’s company, title - The department of the user, normally obtained from the Human Resources system - Data classification information, for example, when information contains sensitive data about the business resource 1. Finally, activity monitoring sends alerts regarding suspicious activities, based upon sets of pre-defined rules. ## Terminology | Term | Description | | ------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Event | An event is anything that occurs in an application. | | Activity | An activity is a monitored File Access Manager event, such as the execution or modification of a file on a file system, enriched with security attributes (such as details of the executing user from the Active Directory). | | Alert | The system sends an alert when an activity violates a File Access Manager real-time rule. File Access Manager can issue alerts within the system or send them to other systems, such as SIEM for monitoring. | | Activity Monitor | Note: Each Collector Installation guide contains specific installation and configuration instructions. The Activity Monitor is a software module that monitors and collects events from an application. Most File Access Manager Activity Monitors work in an agentless architecture, and can monitor and capture events without having to install anything on the application itself. | | Event Manager | The Event Manager is a service, installed by the File Access Manager Server Installer, which: 1. Pulls events from RabbitMQ. 2. Uses Data Enrichment Connectors (DECs) to enrich events with security attributes. 3. Evaluates discard and alert rules. 4. Saves events to Elasticsearch. | | Data Enrichment Connector (DEC) | Note: The previous name for a DEC was Whitebox Policy Connector (WPC). The Data Enrichment Connector (DEC) is a software module that facilitates communication between File Access Manager and an organizational/security system. File Access Manager enables the definition of multiple DECs and uses them to enrich monitored activities with information retrieved from various organizational systems. File Access Manager offers DECs for many commonly used systems including Active Directory, SailPoint IdentityIQ, LDAP, and SQL DB. | # Activity Flow The system sends and analyzes all monitored application activities in the same way, regardless of the event’s origin. Since the event collection infrastructure is agnostic to event types, the system handles an event from a Windows File Server in the same way it handles an event from Microsoft SharePoint or Microsoft Exchange. The activity path diagram below shows a high-level process flow of events, through components, from the Activity Monitor to the Event Manager, with each blue square representing a separate component. ## Activity Path For Windows File Server, the path listed for the activity is always the physical path. This is to avoid duplication, and to avoid ambiguity of ownership and access rights. ## From Activity Monitor to Event Manager (Stage I to II) | Activity | Event | | --------- | ------------------------------------------------------------------------------------------------------------------ | | Monitor | Extract the events from the monitored system using the relevant technology (to be discussed later). | | Exclude | Raw exclusion of event is available per type of monitor. Exclusion at this level means the event will not be sent. | | Aggregate | Similar events within the same polling interval are unified into a single event. | | Send | Events are transformed into standard event format. The bulk is compressed, and then sent. | | Receive | The Event Collector (inside the Event Manager) receives the events. | ## From the Event Manager to the Elasticsearch and Database (Stage II to III) | Activity | Event | | ---------- | ------------------------------------------------------------------------------------------------------------------ | | Collect | Get the events from the various monitors. Verify the structure and validity, and send to a memory queue. | | Fetch | Get the events from the memory queue and start processing. | | Discard | Discard rules, based on event data only, are evaluated first. | | Enrich | If required, enrich the data with identity data. | | Evaluate | Access Rules, requiring identity data, are evaluated. Alert responses are sent. | | Save | Save events to Elasticsearch. | | Create BRs | For applications that do not support crawl - if the event is on a resource that is not listed - add this resource. | ## Application Level Indexing (Stage IV) After the system saves the event, Elasticsearch indexes the event data so users can construct queries on that data. By using Elasticsearch’s near real-time indexing capabilities, events are available for querying immediately after they are saved. # Alert Rules Alert Rules define activity-based criteria for generating system alerts, including notifications and customized responses, such as email, SysLog, or UserExit. For defining alert rules, go to **Compliance > Alert Rules**. For viewing and investigating alerts, Go to **Forensics > Activities** Examples of alert rules include: - A file under \\FileStorageApplication\\HR is deleted by a user who is not a member of the HR department. - A specific user reads more than 1000 files in one minute (considered a suspicious activity, regardless of whether the user or malware initiated the activity). To view existing alert rules: 1. Go to **Compliance > Alert Rules**. Note All alerts, including alerts in the Resources section, display in this screen. 1. Select **Include Resource-based Rules** to view alerts from Resources. 1. You can filter the screen by: - Rule Name - Status - activate or deactivate an alert rule from the main screen - there is no need to access the rule. ## Creating Alert Rules To create an alert rule: 1. Go to **Compliance > Alert Rules**. 1. Select **New Rule** at the top right of the screen to open the *New Alert Rule* screen. 1. Select the Rule Type in the Trigger section. 1. For a “Single Activity” trigger, a single activity matching the Rule Criteria creates an alert.\ For example, an Email notification will be sent for each Add Permission action on a Sensitive resource. 1. For a Threshold trigger, multiple activities matching the Rule Criteria, and occurring within a specific time window, create an alert.\ Users can configure threshold alerts, based on suspicious behavior, and not just based on a single action.\ For example, the fact that one user has performed 500 activities on a specific resource might be more suspicious than if the user had performed a single activity on that resource. 1. Save the rule. ## Managing Alert Rules To access the alert rules, Go to **Compliance > Alert Rules**. To edit an alert rule: 1. Select the alert rule. 1. Edit the General, Scope, Filters, Triggers, and Response sections of the Rule Criteria section as needed. Note An Administrator can define and customize response options in the administrative client. To duplicate an alert rule: 1. Select **Duplicate** from *Actions* in the alert rule to be edited. 1. The Duplicate Alert Rule screen displays, with all the definitions of the duplicated rule already filled in. 1. Make any required modifications. Note Duplicate a discard rule to create a new rule with definitions that resemble those of an existing discard rule. To delete an alert rule: 1. Select **Delete** from *Actions* in the alert rule to be deleted. 1. A delete confirmation question displays. ## Selecting Scope for Alert Rules Use Scope to select a relevant running target. - Scope inclusion enables users to specify application type, application, or specific business resource to run an alert rule. - Scope exclusion allows users to avoid running a rule on an irrelevant application type, application, or specific business resource. - If the same resource is selected for both inclusion and exclusion, the resource will be excluded since exclusions always overrule inclusions. - Resource scope selection allows users to select or unselect a subfolder to run a rule by checking the **Including subfolders** checkbox: - For example, if the business resource “Sensitive folder” has a sub-folder, called “Non-sensitive folder” if the user deselects the “Including subfolders” checkbox, the rule will only run on the main resource, which is “Sensitive folder." ## Filters Note If an application has a Data Enrichment Collector (DEC), the attributes of that DEC also display. However, you select more than one application from same application type, and the applications share the same DEC, only the DEC attributes common to all of the applications’ DECs display. If there are no DECs in common, only attributes relevant to the application type of the selected applications display. Filter criteria allows users to specify suspicious behavior, based on the selected filter criteria parameters. The available filter criteria attributes depend on the scope selected. The list below is the basic list of attributes: - Action Type - Category - Domain - Event Date - Event Time - Path - User Name If you limit the application selection by selecting an application type or one or more applications, only the attributes relevant to the selected application type display. Users can use queries saved in **Forensics > Activities** queries by selecting **Load Query**, to display a list of all saved queries. When the query is loaded, all the information in the Rule Criteria section (Scope and Filters) is overridden by the loaded query filters. If a query cannot be loaded, an error message displays. The following queries are not available: - Queries on alerts (since only existing queries on activities can be loaded) - Mismatched queries - Queries involving users from more than one domain ## Alert Rule Response The Response section allows users to define a response for an alert. For example, when a new permission is added to a sensitive resource, all the Data Owners of that resource can receive an email, notifying them that a new permission was added. To set an alert rule response: 1. Open the Alert Rules page, at **Compliance > Alert Rules**. 1. Double-click the alert rule to edit and scroll to the Response section. A Response may be one of the following: - Email to specific email addresses, and / or to the Data Owners who own the resource. Note The Data Owners option is available for Single Activity Alerts, but not for Threshold Alerts. - Syslog - User Exit 1. A Response object is created / edited in the File Access Manager administrative client. 1. Select **Advanced Settings** to select additional option responses. Notes Use the administrative client to define and customize response options. File Access Manager Alert Response is the automatic default, since it retains the alert in the database. A user cannot opt out of the File Access Manager Alert Response. ## Configuring a Response 1. Within the Administrative Client, go to **System > Configuration > Activity Monitoring > Responses > Manage Response Configurations**. 1. Select **Syslog** in the Showing Response Configuration of Type drop-down. 1. Select **New**. 1. Enter the syslog configuration. 1. Select **Save**. 1. Go to **System > Configuration > Activity Monitoring > Response > Manage Responses**. 1. Create a new Syslog response type. Use the selections on the right side to add variable information to the syslog message. 1. Select **Save**. The response is now available to use in **Advanced Settings > Other Responses** of Alert Rules in the Web interface under Compliance. ## Resource-Based Alert Rules Data Owners can activate Resource-Based Alert Rules (out-of-the-box alert rules) in the **Resource > Alerts** screen. Administrators can go to **Compliance > Alert Rules** to perform the following operations on Resource-Based rules that were created by Data Owners: - View the rule - Change the rule’s name/description - Change the rule’s status (active/inactive) - Delete the rule ## Troubleshooting Activities The best way to troubleshoot activities is to follow their activity trail. Use a specific Collector Installation and Configuration Guide to troubleshoot a specific monitoring issue for that Activity Monitor. The table below contains suggestions of what to look for in the various services. | Service | Suggestion | | -------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Application | - All prerequisites were completed successfully - Activities are generated when relevant (For example, check that relevant activities are generated in the Event Log in Active Directory or that they are included in the Exchange Audit log.) | | Activity Monitor Log | - The log has errors - Events were received (by viewing the Monitor Statistics file) - Events were monitored, but not sent (by checking the monitoring mode - full, semi, and discard) | | Event Manager | - New events were entered (by viewing Event Collector statistics) and then moved to the memory queue - Events were saved in the Event Manager (one Connector at a time, or through a dedicated Event Manager) - The Event Manager log has errors | | Events Backup | File Access Manager includes a backup mechanism for events streaming into the Event Manager. Incoming events are serialized to disk as compressed bulk events. - This backup mechanism allows for re-streaming the backed-up event bulks into the event manager in case of a failure in the events processing flow. - A separate file is created daily, containing the bulk events received that day. | The behavior of the Events Backup mechanism is defined by several parameters under the tag in the Event Manager’s app.config files: | Parameter | Type | Description | Default | | --------------------- | ----------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------ | | BackupEvents | True/ False | Enables / Disabled the Events Backup mechanism | True | | WaitForBackupSeconds | Number | Number of seconds the Event Managers service waits for the backup process to finish serializing in-memory events, on service shutdown, before it terminates the process | 5 (seconds) | | BackupEventsDir | Text | Directory path for the event backup files | EventsBackup in the service home dir | | RestoreBackedupEvents | True/False | Activates backed up events restore on service startup | False | | BackupRetentionDays | Number | Number of days to retain events backup files, before backup files are deleted. | 7 (days) | | CleanOldBackups | True/False | Enables/Disables automatic cleanup of expired backup files (older than *BackupRetentionDays*) | True | ### Enabling Events Backup - Set the **BackupEvents** to True (default). This will cause the Backup mechanism to start - The **BackupEventsDir** by default will be set to EventsBackup in the service’s home directory. This folder will be created by the service if it is not already there. If you wish events to be backed up to another location, change the **BackupEventsDir** parameter accordingly before the service is started, or restart it after the change. Make sure the drive containing the backup folder has enough space. (Space requirements depend on events traffic). - Make sure the **RestoreBackedupEvents** parameter is set to false - if you don’t wish to restore existing backups. - Ensure all other parameters suit your needs, or configure accordingly. ### Restoring Events from Previous Backup - Set the **RestoreBackedupEvents** to True before you start the service, or restart it after the change . - Once the service is running with **RestoreBackedupEvents** set to True, it will attempt to restore all backup files, and will stream all backed up events, back to the Event Manager, to be processed and stored. - If you do not wish to restore all the backup files, but only specific files (days), you should copy the unnecessary files to another location . - In case restoring the events fails, a new file contained the un-restored events will be created, with the .**recreated** suffix, indicating this file contains events that failed to be restored, and will not be re-attempted. ### Retaining Backups for Specific Dates or Periods - Either disable the automatic cleanup of backup files, by setting the **CleanOldBackups** parameter to True, or modify the **BackupRetentionDays** parameter to suit the retention policy you wish to configure. - When modifying app.config parameters, changes will take place only the next time the service is started, as app.config parameters are read on service startup. ## Threshold Alert Rules The Activity Analytics service is responsible for the threshold calculation and issuing threshold-based alerts. Activities are evaluated against threshold alert rules by the Event Manager during the processing of the activities, and if they match, they are marked as candidates for a threshold calculation. The Activity Analytics queries the Elasticsearch every defined interval to bring activities candidate for threshold alerts. It then aggregates the activities and when the threshold is met, issues an alert and a response according to the definition in the threshold alert rule. ### Limitations Activities received more than 15 min after the Activity time (as the result of a temporary disconnection between the Activity Monitoring and the Event Manager) will be kept in the Database with the original Activity time, but will not be included in the Threshold Alert Rules calculation. However, if an Alert has already been created, the Activities that originated in the Alert timeframe, but were received after the 15-minute time window, will be updated in the relevant existing Alert record. (As a result, the total number of Activities in the existing Alert record will increase.) The 15-minute time window helps limit the memory required for the Threshold Alert Rules calculation. Please review the Compass forum for best practices. If required, the PS team can change the time window in the Database. If Windows activities have more than one shared path, the system will send duplicate activities for a threshold alert calculation. For example, if Folder1 can be accessed by \\MyServer\\Folder1 and by \\MyServer\\C$\\Main\\Folder1, each activity performed in Folder1 will appear twice in the Database, each time, with a different shared path. To prevent duplicate activities from being calculated in the total number of activities required to create a threshold alert, select “Windows” as the application type in the scope, and set the following filter in the **Alert Rule > Rule Criteria Filter** section:\ Attribute = Original Access Path (OAP)\ Operator = Empty All duplicated Activities have the OAP field as part of the original path. Adding this filter causes the Threshold Alert Rule to ignore all duplicated Activities and to calculate only the original Activity. ### Creating and Editing Threshold Alert Rules Refer to [Creating Alert Rules](#creating-alert-rules). Only administrators (not data owners) can view threshold alerts in Activity Forensics or in Reports. # Defining a Data Enrichment Connector A Data Enrichment Connector (DEC) is a software module that facilitates communication between File Access Manager and an organizational / security system. File Access Manager enables the definition of multiple DECs and uses them to enrich monitored activities with information retrieved from various organizational systems, such as Human Resources or Security Infrastructure. To define a Data Enrichment Connector (DEC), perform the following steps: 1. Go to **Applications > Configuration > Activity Monitoring > Data Enrichment Connectors** The general Data Enrichment Connectors window displays. 1. Select **New**. The New Data Enrichment Connector window displays. 1. Type a Name for the new DEC in the **Name** field. 1. Select one of the following types from the **Type** field: - Active Directory (default) - File Access Manager - Database 1. The configuration fields displayed under the **Type** field vary, based upon the type of DEC selected. Note The configuration fields in the data enrichment connector configuration tab (above) depend upon the selection of the Active Directory as the DEC type. 1. If Active Directory is the DEC type, type in all the associated configuration fields, which for Active Directory, include: - Domain - Domain Net BIOS Name - Port - Username - Password - Optional configuration: - Check the **Is Specific Server** check box to bind to a specific server, and then provide the server’s name in the **Specific Server Name** field. - Check the **SSL** check box to connect with SSL. - Is Specific Server - connect to a specific server (domain controller) instead of using the domain name. - Specific Server Name - the name of the server to connect to if "Is Specific Server" is checked. Could be a short name or a FQDN as long as it's reachable. - SSL - connect using Secure Socket Layer / Transport Layer Security (SSL/TLS) or use unencrypted communication. - Base DN - the Distinguished Name of the Organizational Unit to use as the root of the tree. Defaults to the root of the domain. 1. The following properties are only used by the data enrichment connector (DEC) to enrich activities, not by an Identity Collector that uses the DEC as a reference: - Groups Fetch - whether to fetch the names of groups that users are members of (memberOf information). - Groups Receive - whether to fetch memberOf information recursively. - Groups Recursive Levels - how many recursive levels of memberOf information to fetch. - User Account Control Fetch - whether to fetch user account control information. - Pool Size - number of Active Directory connection objects to keep open (effectively the number of queries that can be run in parallel). - Timeout - Active Directory connection attempt timeout in seconds. - Report Interval - Health report and configuration refresh interval. 1. If IdentityIQ is the data enrichment connector (DEC) type, follow the connector guide **Integrating IdentityIQ with File Access Manager for Enrichment**. 1. If Database is the DEC type, type in all the associated configuration fields, which include: - Database Type - User - Password - Query - Query Timeout (minutes) - Database Server - Database Name # Stale Data As a general rule, File Access Manager stale data calculations are based on activity data, and default to using activity data it gathers. This may include read activity, if such activity is audited for the application type. In cases where no activity data are available for the resource, the stale data calculation is based on the last access date tracked by the operating system. If such a date is not available, the initial collection date is considered as the last access timestamp. This is the case for all resources when we start the collection process. Note The method for recording the last accessed date may differ between application types, and according to the operating systems' support for last access tracking. For example, most SMB/CIFS-enabled file system disable last access tracking for read activity by default due to performance considerations. ## Detecting Stale Data File Access Manager offers Stale Data detection capabilities, to help organizations identify clusters of unused data, based on real activity-based usage data, as well as file-level metadata. Stale Data information is important in guiding organizations' governance efforts. Understanding where stale data reside can lead organization to areas where access is granted unnecessarily, and data is kept and maintained without being used, which can be exploited by attackers. Stale Data is often forgotten and overlooked during governance process, precisely because of the fact it’s not being used. Some of this data may be sensitive, available on company resources as a sitting duck, increasing the likelihood of an incident or a breach. Remediating stale data, by archiving, deleting or otherwise handling it, can reduce the organization attack surface, and well as reduce hosting costs. Information about the unused data in File Access Manager is aggregated to surface clusters of stale data, with the lowest level of granularity being a business resource (effectively, a folder). Information about stale data is available now as part of the Resources views under the Stale Data tab, in Stale Data and Resource Usage report, and in forensics views. As part of File Access Manager resource discovery task, the crawl will now collect and aggregate the number and total size of stale files (files that have not been accessed for X long) within a folder. These numbers (# of stale files and the size of stale files) - will include all the resources sub-resources - calculus is based on Folders, not on individual files. Stats will be calculated for all resources whose last accessed data is older than 3 months. The following information about the stale data will be added to the resource and will be presented in both the Resources tab Data View and the Resource Explorer: - File size - File count - Percentage of stale data - Stale data size - Stale data file count The following applications support the stale data task: - Windows File Server - NetApp - EMC-Isilon - EMC-Celerra - EMC-Unity - HDS - Azure File - CIFS ### Archiving Stale Data 1. Navigate to **Admin > Application**. One the desired CIFS application, select the more option button and then select **Manage Resources**. 1. If you have Administrator permissions, select **Archive Stale Data**. The Archive Stale Data window appears. 1. From the **Number of months for Stale** dropdown, select the number of months resources and files that have not been touched would be considered stale. The default is 12. 1. **Is dry run?** is enabled by default. If kept enabled, this gets a list of files that needs to be moved into a log file. If disabled, this moves all stale files. 1. Select **Save** to update the database with the number of months. 1. Select **Run Task** to start the archive stale data task. 1. Progress of the task can be tracked by selecting the **Views Task Status** link. 1. Once the task is completed, Admins can retrieve the archived files log by searching in their SailPoint log folder. 1. Search for the "PermissionsCollection.Archive Stale Data Successful Documents Details.csv" file. This will include the list of files that will be moved to the "Archived Files (FAM)" folder by the task when Dry Run is disabled. ## Stale Data Report To get an updates list of stale data in your system, configure and run the stale data report. 1. Go to **Reports > Templates**. 1. Search for “Stale Data” to find the report template. 1. To configure the stale data report, select “Duplicate Template” from the dropdown menu on the report template. 1. Configure the report: - Classification category - Last used (months) - time definition of stale data for this type of data. Default: 6 months - Resource minimal size (MB). Default: 0 - Scope type - by application or folder name - Additional tags - to help find this report 1. Choose to schedule or run the report now. 1. Select **Save** to save and run the report according to the schedule. # Administrator Tasks - Admin Client This section describes general File Access Manager system administration capabilities, which assist in File Access Manager management and self-monitoring. System administrator capabilities include: - Health Center - Event Viewer - Tasks and Scheduled Tasks ## Licensing Model File Access Manager uses an honor-based licensing method. The application does not manage or enforce these licenses. ## Updating File Access Manager Software SailPoint publishes updates to the File Access Manager from time to time as new releases, minor releases, and software patches. When updates are available, the application can sends an email to the administrator to notify you of the update. This feature is disabled by default. To enable the notification feature: 1. Run the following update statement to update the database with the email address where the system can send notifications: `update [whiteops].[system_configuration_value] set [value] = N'[ENTER DESIRED eMAIL HERE]' where [name] = N'New Version Message To'` 1. From the Scheduled Task Handler service server, edit the file `%SAILPOINT_HOME%\FileAccessManager\ScheduledTaskHandler\ScheduledTaskHandlerServiceHost.exe.config` 1. In the **appSettings** section, change the **newVersionCheckIntervalInMinutes** from -1 (which means do not check for new versions) to a desired check interval, in minutes. 1. Save and close the file. 1. Restart the Scheduled Task Handler service. After the service restart, an email will be sent if a newer version is available for download from Compass. Please contact your SailPoint representative for further details, and to discuss the options for upgrade. Note This feature requires internet access from the server. # Audit Log File Access Manager creates audit records for all activities performed in the web application. The audit log can be exported for use by external auditing tools. ## Audit Log Format The audit log stores the following information for each record: - id - request_timestamp - client_ip - request_params - authorization - body_params - endpoint - http_status_code - authentication_method - user_roles - request_uri - action_type - http_method - action_description Actions are mapped to the following action types: - Delete - Update - Create - Execute - Read ## Audit Log Report The administrator, or anyone with the right **Reports > Report Templates > Report Templates Administrator**, can configure a report to download as a subset of the audit log as an Excel report for a one-time report, or a scheduled report. To configure an audit log report: 1. Go to **Reports > Report Templates**. 1. Enter or start typing "Audit" into the filter and select **Audit** to filter out all the available audit report templates. 1. If there is no report template that fits your needs, create a custom report by selecting duplicate from the **Audit Log Report menu**. This opens the Duplicate Template panel. By default, the template displays only for users with the Administrator role. Fill in the required fields and either select **Run Now** or set a schedule. - Time period - time period to scan for activities. Options are the last 7, 30, 90, or 365 days. Default is the last 7 days. - Action type - which action to report on, or all actions. Default is All. Note This report is limited to 1M rows. ## Audit Log Report Fields The audit log report is a subset of the full audit log stored in the database. The report contains the following fields: - User - Role - Host IP address - Timestamp (UTC) - Action - Action description # Checking the System Health The Health Center provided in the administrative console displays a list of all File Access Manager services. File Access Manager is a distributed system with components in multiple locations. Each tab in the service status display represents the service types, arranged by subject. The panel is split into two tabs, one for Production services and one for Disaster Recovery services. If the system does not have a disaster recovery environment configured, the Disaster Recovery tab is disabled. The spotlight on each service represents its status as follows: - Green: Service is in good health. - Yellow: Warning that the service needs a checkup. - Red: Service is in poor health. - Gray: Service exists, but is not installed. To display a service’s health status in the Administrative Client, go to **Health Center** and select a service. The following information displays: - Physical Status: Service started, stopped, or starting.\ The Watchdog Service operates the physical statuses. - Log Level: Current (running value) log level - DEBUG/INFO/ERROR. - Server Name: The server on which the service is running. - Version: The File Access Manager version that is running, as well as any pending versions. 1. Select **Refresh** to refresh the service health status. 1. Select **Actions** to perform one of the following actions on this service: - Change log level: - It is not necessary to restart the service to change the log level. - Changing the log level through the administrative client creates a task for a specific service to handle and changes the log level in runtime. - By default, if you restart the service, the log level will revert to the original Error state until the next service restarts. - Restart service - Start service - Stop service The File Access Manager Watchdog service performs the start, stop, and restart service actions. If you stop the Watchdog service, there are no stop, start, or restart service actions for services on that server. Note It is not possible to stop, start, restart, or change the log levels of applications from the Health Center. You must perform a manual log collection, start, stop, or restart on the Watchdog service or any service with installed applications. ### Gathering System Logs To gather system logs, go to the Administrative Client's **Health Center**. Select **Actions** and then select **Gather System Logs**, which is the only action available. The system creates a task to handle log collection from the physical servers with File Access Manager installed. The task gathers all the logs, compresses them into a zipped file, and sends the link to the user. You can view the logs for each physical server on the Reports page of the File Access Manager web application. ### Viewing Health Center Events 1. Select the **Event Viewer** tab to view events on the selected service. 1. Select a start date and an end date by selecting on the calendars next to the Start and End fields. 1. Select a level from the Level Field dropdown menu - Information, Error, Warning, or All. 1. Select **Apply** to apply the date and level filters. 1. Select **Reports** and go to Reports > Applied Filter Events > **Produce Now** to produce reports based on the selected service. ### Viewing Health Center Tasks 1. Select the **Tasks** tab to see a list of tasks related to the selected service. 1. Check the **Show Tasks from all users** checkbox to show tasks related to the selected service from all users. 1. Select **Refresh** to refresh the list of tasks. 1. Select **Clear All** to clear the entire list of tasks. ## Viewing and Scheduling Health Center Reports To produce or schedule the health center reports in the Administrative Client, go to the Health Center. 1. Select the report from the dropdown list. 1. Select **Run Now** or schedule your report to run later. 1. To view the reports in the web client, go to **Reports > My Reports**. ### Available Health Center Reports You can produce the following system health reports from within the Health Center: - System Services Versions Report - This report lists the current version of the installed services and the service types. - Services Health Report - This reports lists the current status of the installed services. Service status types: - Service not installed - Service running - Service down - Standby - this status refers to services that are in the inactive environment of a Disaster Recovery setup - Task Status Report - This report lists all tasks from the last 24 hours. - Activity Summary Report - This report shows the number of activities captured per application in the last 24 hours. # Impersonating Another System User User Impersonation allows an administrator to impersonate another system user for troubleshooting. Authorized users gain access to the User Impersonation screen by selecting a URL hyperlink, which is only available to administrators who are also Active Directory users with Web User Impersonation permission in the File Access Manager administrative client. This permission should be given to a role of which the user is a member. If an unauthorized user attempts to activate user impersonation, an error message displays. ## Accessing User Impersonation 1. Enter the following URL to gain initial access: `http://ServerName/SiteName/v1/#/impersonation` For example, `http://server.example.domain/IdentityIQFAM/v1/#/Impersonation` 1. Enter the User Name and Domain of the user to be impersonated, and select **Save**. 1. When the impersonation process finishes, a page with the new (impersonated) user credentials displays. 1. Select **Reset Impersonation** to cancel the impersonation. 1. If an unauthorized user selects **Reset Impersonation**, the page reloads with the same credentials. The system automatically cancels the impersonation when the server session expires. If left without action, the session expires within approximately 20 minutes. 1. Select **Discard** to clear all fields. # Managing the Data Dictionary Data dictionary fields are attributes that define data types. You can modify this list to fit your organization and needs. Each data type has a separate list of data fields. The list of data fields contains the fields for all data types. You can filter the list to display either all or a single data type. Note You can also create relevant data dictionary fields in the administrative client in the identity collector wizard and application wizard for home-grown applications. These fields can be seen in the following features and pages: - Enrichment - Access request Template wizard - Permissions and Identities pages When data dictionary fields are used in the Permissions or Identities screens and the user saves the queries, these queries can be used in campaigns. These data dictionary fields can also be displayed in the scheduled report templates that were created from the filters set in the Permissions or Identities page: - Access Request - Access Certification - Permissions - Identities ## Navigation **Admin > Permissions Management > Data Dictionary Fields** ## Permissions This screen is accessible by default for users with administrator capability. ## Data Types The system supports managing attributes for the following data types: - Users - Groups - Business Resources - Permission Types ## Filters Selecting the filter icon opens the Filter panel. Enter or select the desired filter. The Name field filters the data dictionary fields using a “Contains” operator. - Apply - Apply the filter and fill the grid accordingly. - Clear All - Clear the filter and fill the grid with all data. - X - Close the filter panel without changing the grid output. ## Data Dictionary Fields Data dictionary fields are attributes that define data types. You can modify this list to fit your organization and needs. Each data type has a separate list of data fields. - Name - Field name - Field Type - The type of the attribute. For all user-created attributes, the field type is String. - Data Type - The data type to which this attribute is associated. See the list of [Data Types](#data-types). - Is Mandatory System (out of the box)? - Yes or No. Fields that are mandatory cannot be edited or deleted. ## Actions Each data dictionary field has the following Actions: - Edit - Opens the Edit panel. Only the data dictionary field name can be changed. This action button is disabled for mandatory fields. - Delete - Delete the data dictionary field. This action button is disabled for mandatory fields. A data dictionary field that is used cannot be deleted. Selecting the **Delete** button, then selecting **Accept** opens a message showing the dependency. ## New Data Dictionary Field To create a dictionary field: 1. Open the Dictionary fields page **Admin > Permissions Management > Data Dictionary Fields**. 1. Select **New Data Dictionary Field**. 1. Fill in the following parameters: - Name - The name of the data dictionary field. The name of the data dictionary field must be unique, even if it has a different data type. - Data type - The data type this attribute is associated with. Note New data dictionary fields created are not mandatory, and of field type String. 1. Select **Save** or **Cancel**. # Viewing System Messages on the Event Viewer File Access Manager services forward important messages to the administrative console. These messages can be viewed in the Event Viewer on the administrative client. To select event sources to view within the Administrative Client, go to **Event Viewer**. 1. Select the **Source: [x] Selected** button on the menu to open the source picker. The source picker button displays the number of sources selected previously. 1. Select a category from the **Categories Field** dropdown list. 1. Enter text in the Filter field (above either the Available Sources or the Selected Sources box) to search for sources listed in those boxes. 1. Select a source in the Available Sources box, and select **>** to copy it to the Selected Sources box, or select **>** to copy all the Available Resources to Selected Resources. 1. To delete a source, select the **X** next to it or select **Clear All** at the top of the Selected Resources box to clear all the selected sources. 1. Select **Save** to save your selections. 1. Select **√ Apply** to refresh the screen with the selection. 1. The table displays a list of events from the selected sources. ## Filtering Events 1. Select a start date and an end date by selecting the calendars next to the **Start** and **End** fields. 1. Select a level from those available in the **Level Field** dropdown menu-Information, Error, Warning, or All. 1. Select **Apply** to apply the date and level filters. 1. Select **Reports**, and go to **Reports > Applied Filter Events > Produce Now** to produce reports on the selected service. ## Deleting Events 1. Define a filter defining the events to delete. 1. Select **Purge** to delete all displayed events that match the filtering criteria. 1. Select **Yes** on the confirmation to delete the event or **No** to return to the Event Viewer window. Note File Access Manager saves events for 30 days and automatically deletes them after that period. # Administrator Tasks - Website To administrators in charge of the File Access Manager configuration and ongoing operation, the dashboard and gives an overall view of the state of the system. In the web client, go to **Dashboard > Administrator**. The administrator dashboard features a graphic overview to assist monitoring the system. Its widgets show various system statistics for detailed analysis, including reports and drill-downs to forensics screens. You can update the widgets on the administrator dashboard either automatically or manually. When the Update Now task finishes, the system generates a notification and displays it as a new unread notification which refreshes the dashboard. The Administrator tab of the dashboard consists of the following widgets: - Data Ownership - Sensitive Data Exposure - System Health Check - Activity Statistics - Alerts in Last 7 Days - Active Data Classification Policies - Active Campaigns - Top Sensitive Resources by Activity - Top Users with Pending Tasks Select the *Update Now* button to update all the widgets in the Administrator tab. Selecting Update Now starts a background task that updates tables with information for widgets, either automatically (daily) or manually. The Last Updated date to the left of the Update Now button is updated accordingly. Select the bell icon to open the Most Recent notifications. Select the most recent notification at the top of the list to update all information displayed in all widgets. ## Data Ownership The Data Ownership widget displays the number of resources with classified data that are missing an assigned data owner. This widget display the overall compliance score. | Term | Description | | ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Data Owner | A user who is responsible for reviewing and approving the access of users to resources. | | Score | The score consists of a number, as follows: - A score of 0 to 5 indicates a high risk. - A score of 5.1 to 7.5 indicates a medium risk. - A score of 7.6 to 10 indicates a low risk. | | Counter | The counter displays the number of sensitive resources missing owners. If the number of resources is one thousand or more, it is expressed in K (e.g., 10,000 displays as 10K). If the number of resources is one million or more, it is expressed in M (e.g., 10,000,000 displays as 10M). | | Report | Select **Generate Report** to create a detailed resources report. When the report is generated, it can be accessed in **Reports > My Reports**. | | Update Frequency | The data is updated daily, by default. | ## Sensitive Data Exposure The Sensitive Data Exposure widget displays the number of overexposed resources and the overall compliance score. The structure of this widget is similar to that of [Data Ownership](#data-ownership). | Term | Description | | --------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Overexposed resources | Resources containing classified data which can be accessed by a large number of users. You can configure the definition of “large number of users” in **Settings > General > Overexposed Resources**. | | Report | Select **Generate Report** to create a detailed report listing resources and groups. When the report is generated, it can be accessed in **Reports > My Reports**. | | Update frequency | The data are updated daily, by default. | ## System Health Check The System Health Check widget displays a list of active and inactive system services by service and status. Some services may be restarted from the widget. Services are displayed by category, and the status indicates the total number of active and inactive services. The status of a service can be either active or inactive, where "inactive" indicates a potential problem. ### Viewing Inactive Services 1. Select a blue **Inactive** link. An Inactive Services screen displays a table with the following columns: | Column Name | Description | | ----------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Status | Not Responding, Broken | | Service | Service name | | Server Name | The name of the server on which the service resides. Since the System Health Check screen shows the current active servers, this can be used to tell the user which server is active, in a configuration of Disaster Recovery / Production / high availability. | | Action | Start [Enabled] Start [Disabled] empty - no screen action available | 1. Select **Start** in a row on the table to start the service in that row. 1. Select **Close** to close the Activity Monitoring Inactive Services screen. Notes - This widget does not have a report. - Update frequency: Data is updated continuously. ### Disaster Recovery Considerations When you have a Disaster Recovery environment configured, all the services are duplicated - one set in Standby mode, one set in Active mode. The Activity Monitoring Inactive Services panel (see above) displays the active server name. The System Health Check widget shows only the active server services. The System Health Check widget always shows the current active services, regardless of the physical environment being used, such as Disaster Recovery or Production. Important Services marked as **Inactive** are services that are on the active servers in terms of Disaster Recovery, but are inactive. ## Activity Statistics The Activity Statistics widget displays a trend graph of activities per application. The chart displays one application per tab, for a maximum of five tabs. You can select which applications to monitor by adding or removing tabs. ### Timeline Set the time in which to aggregate the data. This will affect the report output as well. Valid values are: - Last 24 Hours - Last 72 Hours - Last 7 Days - Last 30 Days ### Activity Statistics graph Hover the mouse over any point on the graph to display the number of activities on a given date and time. Select a point on the graph to drill down to the activity forensics screen with a list of activities per resource. In the web client, you can also reach this screen by navigating to **Forensics > Activities**. ### Activity Statistics Widget To add a tab, select the **+** to the right of the tabs and enter an application name to add. This field offers autocomplete. To remove a tab, select the **X** on the tab title. For reporting, select **Generate Report** to create a detailed activities report according to the timeline and applications selected. When the report is generated it can be accessed in *Reports > My Reports*. Update frequency - The data on this widget updates continuously. ## Alerts in Last 7 Days The Alerts in Last 7 Days widget displays the number of alerts created within the last seven days. ### Alerts in Last 7 Days Graph Hover the mouse over any portion of a bar graph to display a tool tip with information on the number of alerts of a specific type, the alert date, and the group for whom the alert was issued. Report - Select **Generate Report** to create a detailed alerts report. When the report is generated it can be accessed in **Reports > My Reports**. Update frequency - The data on this widget updates continuously. ## Active Data Classification Policies The Active Data Classification Policies widget displays the active data classification policies in a separate graph for each policy. Each graph displays the five applications with the most policy-classified resources. The main portions of the Activities Statistics widget are: - Number of Policies - The number is in parentheses after the widget name. - Only one policy bar graph displays at a time. - Select the arrows to the right or left of the graph to display graphs for other policies. - Generate Report - Active Data Classification Policy graph - This graph shows the number of resources for each of the five top applications for a given policy. - Select a bar on the graph to display the list of classified resources in the selected application. Update frequency - The Active Data Classification Policy graph is updated once a day, by default. ## Active Campaigns The Active Campaigns widget displays a graph showing the progress of active campaigns, with a separate screen for each campaign. The main portions of the Active Campaigns widget are: - Number of Active/In Progress Campaigns - The number appears in parentheses after the widget name. - Only one campaign circle graph displays at a time. - Select the arrows to display the graphs of other campaigns. The arrow to the right displays the next graph and the arrow to the left displays the previous graph of the graph. - Generate Report - Active Campaign graph - This circle graph shows the percentage of records for each active campaign, as well as the campaign status. Approved is green, rejected is red, and pending is gray. - Select a segment in the graph to drill down to a screen that lists pending records per reviewer in a selected campaign. You can also display this screen by navigating to **Compliance > Access Certification**. Update frequency - The Active Campaigns widget is updated once a day, by default. ## Top Sensitive Resources by Activity The Top Sensitive Resources widget displays a table of the sensitive resources with classified data and the most activities within a selected timeframe. The table includes columns for the number of categories and number of activities for each resource listed. Select the **No. of Categories** value in a resource to display the names of the categories. Update frequency - The Top Sensitive Resources widget updates continuously. ## Top Users with Pending Tasks The Top Users with Pending Tasks widget displays a table of users with the highest number of pending tasks. Examples of tasks are access certifications and access requests. The table includes columns for the name of the user, the number of pending tasks, and a button for sending a reminder to the user. Select **Send Reminder** in the user's row to send them a reminder of their pending tasks. The following alert displays: “Email reminder to [User FullName] is being sent. Notification will be provided upon completion.” Update frequency - This widget is updated continuously by default. # Architecture This section provides an overview of File Access Manager architecture.\ It can be deployed in one of the following deployment models: - Simple - Cloud-Based The Cloud-Based deployment model provides a solution for these common use cases: 1. Deploy the File Access Manager Services - the central services that provide the core functionality - in a cloud environment with on-premises collectors that harvest information from target applications. 1. Use this model in non-cloud implementations to scale the Permissions Collection and Data Classification processes to more than a single service per application. This decreases the time for crawling, collecting permissions, and classifying data in large applications. Administrators can deploy File Access Manager using either deployment model, and can also begin with the Simple model, and later progress to the Cloud-Based model by installing the File Access Manager Message Broker and adding Collectors. Consult a certified implementer before installation to determine the best configuration for your organization. File Access Manager supports a disaster recovery solution, enabling the administrator to transfer the operation to a backup site if required. See details in the *Server Implementation* and the *Disaster Recovery* procedure guides. Note When installed in a high-availability environment, RabbitMQ is used to synchronize data between IIS servers, making sure all users see up to date data in our web site. If your installation uses more than one IIS, make sure to install RabbitMQ. Note When designing the architecture for File Access Manager, ensure the deployment is planned to prevent File Access Manager from being installed on systems hosting other critical infrastructure services (such as Active Directory Domain Controllers) or on endpoint devices (such as WFS or similar components). This separation helps maintain system integrity, security, and optimal performance. ## Simple Deployment Model See [Server Services](https://documentation.sailpoint.com/fam/help/administrator_guide/application_capabilities_and_architecture/services.html#server-services) for the description and capability of each service. ## Cloud-Based Deployment Model File Access Manager, can be deployed in a cloud environment with on-premises collectors that harvest information from target applications. This adaptive connectivity model enhances performance and scalability for large sets of data. The collectors focus on completing the work assigned to them by the File Access Manager Central Permissions Collector and Central Data Classification services. These collectors pass processed information - through the File Access Manager Message Broker (RabbitMQ), which provides secure communication - back to File Access Manager Services. The information is then persisted to the database. Each application can be processed by as many collectors running in parallel as necessary. When it is no longer necessary to process large amounts of data, such as after the first full analysis of the environment, the data classification capacity can be reduced to manage a relatively smaller number of modifications to sensitive data within the environment. This adaptive connectivity model allows for the progressive analysis of permissions collection and data classification without having to wait for the complete data set to be processed. Each collector is tasked with processing a small subset of the environment, and as it completes each task, it sends its results (through the File Access Manager Message Broker) back to the File Access Manager Services, which persists it to the File Access Manager database. As a result, usable information about the file system or other resources becomes available as it is processed, which decreases the time-to-value ratio, since it is no longer required to analyze an entire data set before obtaining useful results. ## Disaster Recovery To support continued service following a natural or human induced disaster, you can install an additional environment in standby mode to be activated if and when required. ## Collector Overview A connector is a micro-service that accesses work items (business resources) through the message broker, connects and retrieves metadata from the target application, and then sends the processed information back to the central service. Connectors communicate with the central services through a third-party messaging broker service (RabbitMQ), which implements a persistent queue. In a hybrid cloud / on-premise implementation, connectors send data to the cloud through the message broker, which eliminates the need for direct database access from on-premise to the cloud. Connectors are not mandatory. When the cloud is not being used and/or when horizontal scaling is not required, there is no need to install RabbitMQ. If RabbitMQ is not installed, it is not possible to install Permissions Collection/Data Classification connectors, and the central services act as both the engine and the collector. Key terms related to the Connector and Collector are defined below. - **Connector**\ The collection of features, components, and capabilities that comprise support for an endpoint. - **Collector**\ Refers only to the “Agent” component or service in a Data Classification and/or Permission Collection architecture. - **Engine**\ The core service counterparty of such architecture. - **Identity Collector**\ The logical component used to fetch identities from an identity store and holds the configuration, settings for that identity store, and the relations between these identities. It has no “physical” manifest. The collection work is performed by the Collector Synchronizer. Data Classification and Permission collection are the only collectors. The connector is not the same as a collector. Connectors are services that connect the to the target applications for: - Permissions Collection (PC) - Data Classification (DC) ## Application > Central Service > Collector Relations File Access Manager provides an adaptive connectivity model, allowing multiple deployment configurations that fulfill the needs of basic single-site implementations, as well as those of distributed geo-distributed implementations. The following describe the relationship among applications, Central Permissions Collection/Data Classification services, and Collectors: - Multiple Central Permissions Collection/Data Classification services can be installed by the File Access Manager Server Installer. - A single File Access Manager application can be associated with a single Central Permissions Collection/Data Classification service. - Multiple File Access Manager applications can be associated with the same Central Permissions Collection/Data Classification service. - A Permissions Collection/Data Classification Collector is always associated with a single Central Permissions Collection/Data Classification service. - Multiple Permissions Collection/Data Classification Collectors can be installed and associated with the same Central Permissions Collection/Data Classification service. ### Possible Deployment Options In the simplest form, an application can be associated with a Central Permissions Collection (PC)/Data Classification (DC) service and without installed Collectors as shown below. The same application can be extended to use a single Collector if it is a cloud-based implementation. Also, if the application is located in a remote site over a slower network, the Collector can be located closer to the application. Since each Central Permissions Collection/Data Classification service can serve a single application at a time, it is possible to install multiple Central Permissions Collection/Data Classification services. Multiple applications can be associated with the same Central Permissions Collection/Data Classification service, such as for small scale applications that can be processed by a single sequential Central Permissions Collection/Data Classification service. Multiple collectors can be installed and associated with the same Central DC/PC service, which: - Improves performance and - Reduces the time for Crawl/Permissions Collection/Data Classification processes to run. ### Scaling Collectors Horizontally The installation of multiple collectors reduces the operational time of Crawl/Collect Permissions/Data Indexing. The central DC/PC service distributes the business resources among the collectors by serving them resources through the Message Broker. Each collector processes a subset of resources. As each task completes, the collector sends results back through the File Access Manager message broker to the File Access Manager services, which persists them in the database. Since each business resource is an atomic work item, adding more collectors results in near linear-scale performance. # Audit Log The audit log registers all activities in the web application for auditing and regulatory purposes. The audit log data is stored in the database, and an administrator can run a report to retrieve all or part of the audit log according to predefined filters and/or as scheduled. Running this report requires the **Reports > Report Templates > Report Templates Administrator** right. By default, the ability to configure the audit log is accessible to Administrator capability only. The audit log functionality is on by default. ## Audit Log Format The audit log stores the following information: - User - Role - Host IP address - Timestamp (UT) - Action - Action Description The report is limited to one million rows. # Capabilities This section describes the main File Access Manager capabilities and provides a technical mapping of each service to a set of capabilities. You can find more information on each capability in the relevant chapters of this guide. | **Feature** | **Description** | | ---------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Activity Monitoring** | Activity monitoring involves capturing information about events that users perform on monitored applications. An activity includes: - **Who?** - A user - **Performed what action?** - Read, write, or delete - **Where?** - On what business resource? For example, a file, a file folder, a SharePoint site, or an Exchange mailbox - **When?** - Date and time which is displayed in the user’s local time | | **Real-Time Alerts** | Issue real-time alerts based on pre-defined alert rules regarding suspicious activities. | | **Threshold-Based Alerts** | Issue threshold alerts when activities exceed a defined threshold within a timeframe, e.g., "Alert me when a user reads more than 1000 files in an hour." | | **Crawling** | The process that discovers business resources (BRs) of an application (folders, mailboxes, etc.), required for capabilities like Permissions Collection and Data Classification. | | **Permissions Collection** | Discovers and collects permissions on the BR(s) of an application for use in Permissions Forensics, Access Certification campaigns, Access Requests, etc. | | **Data Classification** | Provides the ability to discover and classify resources/files with sensitive information like credit card data, personal information, and health records. | | **Identity Collection** | Collects and aggregates users and groups from identity repositories (e.g., Active Directory, Azure, NIS) for analyzing users, groups, memberships, and structures. | | **Access Certification** | A campaign process to certify or remove stale or unneeded permissions or identities. | | **Access Requests** | Users' requests to gain permission to BR(s), managed and automatically fulfilled using approval workflows. | | **Access Fulfillment** | Automatically adds or removes permissions to users’ BR(s). | | **Discovery of Data Owners** | Automates the process of identifying data owners by collecting activity/permissions data and consulting business users about folder ownership. | # Inter-Service Communication File Access Manager uses SSL communications for all its deployed services. SSL communications use server and client certificates which, by default, are self-signed and created when each service is installed. While the operating system may not trust these certificates, File Access Manager components do trust them. The table below lists the relationships among the services and clients. | Service | Clients | Default Port | | --------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------ | | Agent Configuration Manager | Activity Monitor Event Manager Central Data Classification Central Permissions Collector Data Classification Collector Permissions Collector Collector Installation Manager | 8000 | | Event Manager | User Interface Central Data Classification Scheduled Task Handler Central Permissions Collection Web Server | 8001 | | Reporting Service | User Interface | 8006 | | User Interface | File Access Manager Administrative Client | 8005 | | Workflow | User Interface | 8008 | | Elasticsearch | Event Manager Reporting Service Scheduled Task Handler User Interface Web Server Activity Analytics | 9200 | | Elasticsearch | Elasticsearch | 9300 | | RabbitMQ | Central Permissions Collector Central Data Classification Permissions Collector Data Classification Collector Activity Monitor Event Manager | 5671 | | RabbitMQ | Schedule Task Handler | 15671 | | Activity Analytics | None | 8010 | It is a best practice for all components to be in a safe, secure network, behind firewalls, even though SSL secured communication is enabled. ## Using Trusted Certificates Administrators can provide their own certificates for the server services only. To be trusted, server certificates must conform to the following guidelines: - Certificates are signed by a commercial or in-house CA that is trusted by all servers in the organization. - Certificates are issued to each server hosting one of the Windows Communication Foundation (WCF) hosting services. - Certificates include the server name as it is to be used by File Access Manager - whether it is a short name or a Fully Qualified Domain Name (FQDN) in the Subject or in the Subject Alternative Names list. - At minimum, the certificate must have the following extensions defined: - Key Usage: Digital Signature, Key Encryption - Enhanced Key Usage: Server Authentication, Client Authentication Note See the installation guide for a detailed description on using local certificates for File Access Manager and configuring the website to use SSL. ## OAuth Support File Access Manager offers full support of OAuth 2.0 Authentication for all cloud connectors. All monitored applications support Application Based, Client Credentials authentication. The AzureAD identity collector leverages service account User-Flow authentication, offering support for enhanced security measures such as MFA requirements. Follow the instructions on the specific application connectivity deployment guide for more details. Supported applications: - SharePoint Online - Exchange Online - DropBox - Box - Google Drive - OneDrive ### Preliminary Setup 1. An app is registered in the provider's app management console. See description per application in the relevant connector installation guide. 1. App registration generates a set of identifiers: ClientId and ClientSecret. These identify the app uniquely and are used for issuing token requests. App registration includes the definition of a redirect URI that is used for user redirection upon completion of the authentication process. 1. Upon successful authentication and consent, the provider will redirect the user; the redirection URI will be appended with a user authorization code in the URL query string. ### Authentication Flow - An end user browses to a special App Authorization URL - this is typically a credentials' input form at the provider's website. - The end user logs in to the provider with one of the following outcomes: - **Login Failure** - The end user is redirected to the app's redirect URI with an error message in the query string. - **Login Success** - The end user is presented with a consent form that lists the permissions that the app is requesting. There are two possible outcomes: - **Consent Declined** - The end user is redirected to the app's redirect URI with an error message in the query string. - **Consent Given** - The end user is redirected to the app's redirect URI with a user authorization code in the query string. - A web page, or some other code, issues a token request using the user authorization code. This code is active for roughly 30 seconds. - The provider responds with a token set. - The access token can be used to issue requests to OAuth2-enabled services exposed by the provider. ### OAuth2 Token Management - OAuth2 Minisite or OAuthWebsite The OAuth2 minisite is deployed to ease the management of File Access Manager's interface to OAuth2-based services. The minisite enables storage of all provider-specific configuration in a unified location, thus enabling us to modify it from a single location. The minisite provides the following: - Storage of global info, including provider-specific information: - ClientId - ClientSecret - URL for user authentication - URL for token requests - Scope, for providers that allow dynamic permission requests - Handling of OAuth2 flow operations: - ***UserRequest.ashx***\ Redirecting the end user to the appropriate provider's website to start the authentication process. - ***Callback.aspx***\ The target of Redirect URI, extracting the User Authorization Code or error message from a query string and displaying it in a user-friendly format. - ***AccessToken.ashx***\ Encapsulating initial requests for access tokens, exchanging a User Authorization Code for a Token Set. - ***RefreshToken.ashx***\ Encapsulating requests for token refresh, exchanging a Refresh Token for a new Token Set. ### Agent Configuration Manager - TokenRefreshServer This central service is responsible for refreshing all OAuth2 tokens automatically and providing a token retrieval interface for other File Access Manager components. The logic described here is implemented in: `AgentConfigurationManager\src\TokenRefreshServer.cs` - Interface Operations - Upon token request, the requested token is sent as a response. - If no such token is loaded, the service attempts to load it from the database. - Automatic Operations - Upon startup, the service loads all available tokens from the Business Application Management (BAMs') (application's) configurations. - Whenever a token is approaching expiration, it is automatically refreshed and updated in the database. - If a token refresh fails, the token is removed from the memory cache: - This mechanism allows automatic release of expired or failed tokens and protects the service from endless refresh attempts. Note Failed Refresh - there are various reasons for a failed refresh, such as modified or deleted consent user, expired app key, network errors, etc. - A token reload and refresh is re-attempted if or when it is requested again through the ACM token management interface. - TokenRefreshServer is the only File Access Manager component that executes token refresh operations: - Provides a solution for security mechanisms where upon refresh, all tokens are canceled except for the latest. - A centralized point for token management makes for easier logging, debugging, and troubleshooting. # File Access Manager Services ## Server Services The following table describes server services installed by the File Access Manager Server Installer and their relationship to File Access Manager capabilities and main processes. | **Service Name** | **Description** | **Capabilities** | | ----------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- | | Event Manager | Responsible for pulling activities from RabbitMQ, enriching the activity records with additional useful information about the users and the business resources being accessed, evaluating alert and discard rules, and saving activities to Elasticsearch. | Activity Monitoring Real-time Alerts Threshold Based Alerts | | Agent Configuration Manager | Communicates with the Activity Monitors, Permission Collectors, and Data Classification Collectors to receive health checks and provide configurations. It is also the entry point for the installation process of Activity Monitors and Collectors. | Activity Monitoring Permissions Collection Data Classification | | Activity Analytics | Performs the Threshold Alerts calculations in near real-time and sends the alerts when a threshold is met. | Threshold Based Alerts | | Central Permissions Collector | When installed in a simple architecture deployment, it connects to the applications and collects resources and permissions data. When deployed in a distributed architecture, it sends resources to the collector and aggregates the permissions data received from collectors through the message broker. | Crawling Permissions Collection | | Central Data Classification | When installed in a simple architecture deployment, it connects to the applications and classifies sensitive business resources based on the defined data classification policy. When deployed in a distributed architecture, it sends classification data to the collector and aggregates the classification data received from collectors through the message broker. | Data Classification | | Reporting | Generates all reports. | | | Scheduled Task Handler | Schedules and dispatches scheduled tasks when they are due, and runs all maintenance tasks. | Schedule Tasks DB Cleanup task Events Deletion task Events Re-Indexing task Application Deletion task Periodic Elasticsearch & RabbitMQ health checks | | User Interface | Responsible for communication with the File Access Manager administrative client. | | | Business Website | The website service running the File Access Manager web interface. | | | API | RESTful API service. This service provides a platform neutral schema and extension model for representing users, groups and other resource types in JSON format. | | | Workflow | Access certification campaign (“Campaign”) creation and management of review processes. | Access Certification Campaigns Access Requests Business Asset Compliance | | Collector Synchronizer | Performs Identity Collection and the Access Fulfillment tasks. | Identity Collection Access Fulfillment | | Crowd Analyzer | Creates and manages data owners’ election goals. | Data Owners Discovery | | Elasticsearch | This full text indexing database retains all data on activities collected by the Event Manager. | Activity Monitoring Threshold Based Alerts | | RabbitMQ | This service is a secure message broker for communication between the Central Permissions Collector and Central Data Classification services, to/from the Permissions, Data Classification Collectors as well as Activity Monitors and Event Managers. | Permissions Collection Data Classification Activity Monitoring | ## Collector Services The services below are installed by the Collector Manager. | **Service Name** | **Description** | **Capabilities** | | ----------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------- | | Activity Monitor | The service connects to the application and collects activity data (“Who did what?”). A dedicated Activity Monitor service must be installed for each application. | Activity Monitoring | | Permissions Collector | When the RabbitMQ service is installed, the Permissions Collector can be installed to extend the Central Permissions Collector service. See [Architecture](https://documentation.sailpoint.com/fam/help/administrator_guide/application_capabilities_and_architecture/architecture.html) for additional information on collector and cloud-based architecture. | Crawling Permissions Collection | | Data Classification Collector | When the RabbitMQ service is installed, the Data Classification Collector can be installed to extend the Central Data Classification service. See [Architecture](https://documentation.sailpoint.com/fam/help/administrator_guide/application_capabilities_and_architecture/architecture.html) for additional information on collector and cloud-based architecture. | Data Classification | ## Databases Elasticsearch is a search database engine, optimized for text searches. File Access Manager uses Elasticsearch to store and query activity data. It is installed by the File Access Manager Server Installer. # Troubleshooting Notes When a user first launches the administrative client while using the self-signed certificates, the system displays a message asking if the user trusts the certificate. **Yes** - Trust the certificate and open the client. This message will not display again. **No** - The client displays an error message, and closes the dialog. ## Ensure HTTP/2 Support File Access Manager services, version 8.2 and up, use gRPC as their communication protocol, which requires http/2 to operate. Once fully upgraded, File Access Manager services should work seamlessly with http/2. In some cases, some communication middleware components, such as load balancers, may not be configured to support http/2, which may cause communication failures that halt the upgrade. To reduce the risk of failure, ensure that all servers and communication middleware components are configured to support http/2 prior to beginning your upgrade. ## Connection Errors Following a successful upgrade to version 8.2, services will only accept http/2 connections. Version 8.2 and up, use gRPC as their communication protocol, which requires http/2 to operate. Once fully upgraded, File Access Manager services should work seamlessly with http/2. In instances where the customer upgrade halts after a successful Agent Configuration upgrade, one potential cause could be that the communication middleware, such as a load balancer, is not configured to work with http/2. If that happens, the following error will be shown in the log of services trying to connect to the Agent Configuration manager: > Unable to connect to test.domain.com with user_name Grpc.Core.RpcException: Status(StatusCode=Internal, Detail="Bad gRPC response. Response protocol downgraded to HTTP/1.0.")at Grpc.Net.Client.Internal.HttpClientCallInvoker.BlockingUnaryCall\[TRequest,TResponse\](Method`2 method, String host, CallOptions options, TRequest request)at Grpc.Core.Interceptors.InterceptingCallInvoker.b__3_0[TRequest,TResponse](TRequest req, ClientInterceptorContext`2 ctx)at Grpc.Core.ClientBase.ClientBaseConfiguration.ClientBaseConfigurationInterceptor.BlockingUnaryCall\[TRequest,TResponse\](TRequest request, ClientInterceptorContext`2 context, BlockingUnaryCallContinuation`2 continuation)at Grpc.Core.Interceptors.InterceptingCallInvoker.BlockingUnaryCall\[TRequest,TResponse\](Method\`2 method, String host, CallOptions options, TRequest request) If such errors appear in the log files, make sure all communication middleware components are configured to work over http/2, and the connection is not downgraded to http/1. When the error appears in a service that is still in version 8.1, the errors may be safely ignored. Once the service is fully upgraded the errors will stop showing in the log. # Business Resource Owners Business resources in File Access Manager are assigned to users so they can see the resources in the various screens they are permitted to access. The business resources assigned to a user are defined as the user’s scope. A business resources owner, or Data Owner, is defined in the system as a user with user scope assigned to them, who has the Data Owner capability. The Data Owner is the owner all the business resources that are assigned to them. ## Assigning Data Owners You can select business resource owners through any of the following methods: - [Manually, using the Data Owners page](#assigning-a-data-owner-manually) - Location: **Resources > Owners** - Create Goals using crowd sourcing election - Location: **Goals > Set New Goal** - See [Creating Goals](https://documentation.sailpoint.com/fam/help/goals/creating_goals.html#creating-goals) - Bulk upload using [Import User Scope](https://documentation.sailpoint.com/fam/help/administrator_guide/managing_users/scope.html#importing-user-scope) Important This process only updates the user scope. You must add the **Data Owner** capability in order to make the user a data owner of this scope. The bulk assignment of data ownership overrides data ownership previously assigned to an individual business resource. ## Assigning a Data Owner Manually By default, data owners own the entire tree below the business resource they are assigned to, via data owner hierarchy. To assign a data owner to a resource manually, you must first break the hierarchy. Adding a data owner to a resource: 1. Go to **Resources > Owners**. 1. Select a resource from the resources tree on the panel on the left. 1. If there is a current owner inherited from a higher hierarchy, uncheck **Inherit data owners from [application][business resource]**. There are two options for breaking the hierarchy: - **Yes** - Breaks the inheritance and removes the current owner(s). - **Yes - Copy the current owners** - Breaks the inheritance and adds a new owner in addition to the current owner(s). 1. Select **+ Add New Owner**. 1. Select the requested user by entering part of the name and selecting from the dropdown list. 1. Select **Save.** ## Data Owner Inheritance The owner of a business resource is also the owner of the child business resource, unless you assign a different data owner to a specific child business resource. If the business resource has an owner through data owner inheritance, there is no button to add an owner. Breaking the inheritance allows assigning additional data owners at this level and below. If you break the data owner inheritance but do not assign a new owner, the data owner inheritance switches back on. The new owner assigned to the business resource is the owner of the current and all downstream resources. ### Breaking Data Ownership Inheritance In this example, Data_Admin is the owner of folder `C$\Data`. You want to assign the folder `C$\Data\HR` to Admin_HR, and the folder `C$\Data\System` to the users Data_Admin and Example_Ops. 1. Go to **Resources > Owners**. 1. Assign a unique owner for HR: 1. Select the folder `C$\Data\HR` on the Resource Tree. 1. On the Current Owners panel, uncheck **Inherit data owners from [application]C$.** 1. Select **Yes** to indicate that you want to break the inheritance, and not continue Data_Admin as the local owner from this branch down. 1. Select **+ Add New Owner**. 1. Select the user Admin_HR. You can starting entering the name and select from the dropdown list. 1. Select **Save.** 1. Assign additional owner for System: 1. Select the folder `C$\Data\System`. 1. On the Current Owners panel, uncheck **Inherit data owners from [application]C$**. 1. Select **Yes - Copy the current owners** to indicate that you want to break the inheritance, and add a new owner in addition to Data_Admin for this resource. 1. Select **+ Add New Owner**. 1. Select the user Example_Ops. You can starting entering the name and select from the dropdown list. 1. The names Data_Admin and Example_Ops are listed as current owners for this, and all downstream folders. 1. Select **Save**. # Goals Data Owners are responsible for protecting the data within a specific resource. Administrators use the **Goals process** so that those who are the most knowledgeable regarding the use of a specific resource can elect the most suitable data owners for a specific resource. This process uses a crowd sourcing process. Note In the default configuration, only administrators can access and view the Goals tab. **Activity** Each selection of a data owner for a particular resource in a crowd sourcing process. **Goal** A collection of all the selections of data owners for a particular resource in a crowd sourcing process. Therefore, a “goal” is a collection of activities. For example, if the goal is to determine the identity of the data owners for five business resources in a file server application, that goal consists of five activities - one for each resource. ## Goal Lifecycle Stages **Creation** First, an administrator creates goal activities, specifying the goal type, application, scope, and settings. **Pending for Execution** After goal creation, but before the system sends emails to participants, an administrator checks the goal status, including the goal participants selected and the data owner candidates selected, to validate successful goal creation. **Election** After goal execution, the participants who were decided upon in the creation process vote for data owners. Appointment - reviewers review the selected data owners unless the administrator chooses the automatic selection of data owners. **Finished** A goal is completed when all the goal activities have been completed, for example, all data owners have been assigned. Note You can block users from being eligible for election as data owners using the Goals Exclusion setting. See [Excluding Accounts from File Access Manager Processes](https://documentation.sailpoint.com/fam/help/administrator_guide/website_settings/excluding_accounts.html#excluding-accounts-from-file-access-manager-processes). ## Creating Goals The Set New Goal process consists of the following steps: - Goal Type - Application - Scope - Settings - Summary To set a new goal: 1. Go to **Goals > Set New Goal**. 1. Select the relevant goal type from the available types. 1. Select **Next** to select the application. 1. Select one of the applications displayed. The resources for this goal will be from the selected application. 1. Select **Next** to set the scope. 1. Select one or more resources from any of the categories, including: - Top level resources - resources for a specific application from the top level of the resource tree. - Resources that change inherited permissions - resources that inherit permissions, with permissions added to those inherited permissions. - Resources that do not inherit - resources that break an inheritance. - All resources - resources from the entire resource tree. 1. Select the checkbox next one or more resources to select that resource, then select **Add** under the resource list to add the resource as a new activity in the current goal. Check the **Select All** checkbox to select all the resources listed under each category. The number of resources selected displays in parentheses in Resources Added, and the added resources are unchecked in the original resource list. 1. Select **Resources Added** to display a list of Selected Resources. 1. Select the blue **X** to the right of any selected resource in the list of resources to deselect that resource. 1. Select **Save** to save the revised selection of resources. 1. Select **Next** to open the Settings screen. 1. In the **Goal Name** text box, enter an appropriate name for the goal. 1. There are two methods of finalizing data owners: - Review Process Required - A reviewer has to either approve or reject the selected data owners who were voted for before their final appointment. - Automatic - Appoint selected data owners without a review based on the votes of the participants. 1. If you select **Review Process Required**: 1. Select a reviewer by starting to type in the Reviewers text box. 1. Select the blue **X** to the right of any selected reviewer in the reviewer list to deselect them. 1. Select **Next** to open the Summary screen. The goal Summary screen lists the following information: - **Goal Type** - The goal type, for example, Data Owners Election. - **Goal Name** - The name selected for the goal. - **Application** - The application for which a data owner is to be selected. - **Scope** - Number of resources. - **Appointment Method** - Either Review Process Required or Automatic. - **Reviewers** - Names of reviewers if the appointment method is Review Process Required. 1. Select **View List** in Scope to view the selected resources. 1. Select **Create Goal** at the bottom right of the Summary screen. 1. A success dialog displays, indicating that the goal was created successfully, and requesting that you execute the goal in Running Goals. 1. Select **OK**. ## Goal Status Administrators can manage goals more efficiently by viewing the status of the goals before executing them. To view status details for a newly created goal, perform the following steps: 1. Go to **Goals > Running Goals**. The Running Goals screen displays. If the goal is ready for execution, “Ready for execution” displays in green at the bottom left of the New Goal box. 1. Select **Show Status** at the bottom right of the Running Goals box. The status of the running goals displays, based on one of the following filtered statuses (the default is All): - All - displays all the resources in this goal. - Election - displays resources pending completion of voting. - Appointment - displays resources that are pending review. - Finished - displays all the resources for which the Election and Appointment processes have been completed. If no candidates were selected as data owners for a given resource, the message “There were no eligible candidates for the selected resource” displays to the right of the list of resource statuses. 1. Select **Menu** on the right top of the Running Goals window to display a dropdown menu of status activities. The Running Goals status actions include: - View Details - Displays all the goal details - Refresh - Updates the goal status - Reinitialize - Starts the goal creation process from the beginning. After reinitializing, the status will be Ready for Execution and the system will delete all votes. This action cannot be undone. A confirmation dialog displays. Select **Yes** to reinitialize or **No** to return to the Running Goals screen. - Delete - Deletes the goal. This action cannot be undone. A confirmation dialog displays. Select **Yes** to delete or **No** to return to the Running Goals screen. 1. Select **Execute Now** at the bottom of the Running Goals box to execute. pending running goals. ## Completed Goals Several actions are available for managing completed goals. 1. Select **Completed Goals**. A summary of the completed goals displays, including the following information: - Goal Type - Application - Start Date - End Date - Percentage of Goal Completed 1. Select **Menu** on the right top of the Completed Goals window to display a dropdown menu of status activities. The Completed Goals status actions include: - View Details - Displays all the goal details. - Reinitialize - Starts the goal creation process from the beginning. After reinitializing, the status will be Ready for Execution and the system will delete all votes. This action cannot be undone. A confirmation dialog displays reminding you that proceeding will result in the permanent loss of all the data for that goal. Select **Yes** to reinitialize or **No** to return to the Running Goals screen. - Delete - Deletes the goal. This action cannot be undone. 1. Select **Show Status** at the bottom right of the Completed Goals box. After a user for whom a review process was required has voted, the system adds a review task to the reviewer’s task list. One user can be both a final candidate and a reviewer. If a goal is ready for execution, it is possible to see the status of that goal before executing it by selecting **Show Status** to the right of Execute Now at the bottom right of each goal marked Ready for Execution. If goal creation is in progress, Execute Now and Show Status are not available. The only available option is Refresh. To view status details for a newly created goal, select **Show Status**. The Resources section on the left side of the Show Status screen displays the total number of activities (resources) that have been finished for the goal. In the Status dropdown menu under Resources, the following options are available: - All - displays all the resources in this goal. - Election - displays activities pending completion of voting. - Appointment - displays resources pending review. - Finished - displays all the resources for which the Election and Appointment processes have been completed. The bottom right side of the Resources section displays the previous or next screen, and the number of the total number of screens displayed; for example, ½ indicates the first of two screens. The Election section of the Show Status screen displays the current results, which are the number of participants who have voted. Up to five data owner candidates may be displayed, with their names, place, and percentage of votes received. However, the first and second place data owner candidates are given prominence. To view the Election Section of the Show Status screen: 1. Select **All Participants** in the top right of the Election Participants section. 1. A summary of the election participants displays. 1. The viewing options are: - All Participants - Voted - number of all participants who have already voted. - Pending - number of all participants whose vote is still pending. Navigation in the All Participants view of Election section of the Show Status screen is the same as in the Resources section of the Show Status screen. 1. Select **Remind** next to a user who has not yet voted to remind the user to vote. 1. Select **Votes** next to a user who has voted to see a list of the people for whom that use voted. 1. Select **See Summary** in the top right of the Election section to return to the Summary view. 1. Select **End Election Process** in the top right of the Election section to end the election process even if it does not include 100% of the votes. 1. A confirmation dialog displays, asking whether you want to end the election process. 1. Select **Yes** to end the election process or **No** to return to the previous screen. # Appointment Appointment is the second step, following election, in the process of assigning data owners to resources. Note If a goal has an appointment, the goal does not proceed directly to the Finish status. To continue with the appointment process after the election process has completed, perform the following steps: 1. On the File Access Manager website, go to **Goals** 1. Choose a goal, and select **Show Status**.\ The **Show Status** screen displays. 1. Select **Appointment (In Process)**.\ A list of final candidates and reviewers displays. 1. Select the **remind icon** next to a reviewer’s name to send an email reminder to that reviewer.\ A confirmation dialog displays, asking whether you want to send the reminder email. 1. Select **Yes** to send the email reminder or **No** to return to the Show Status screen. After the appointment process has finished, the system displays the names of the final candidates and the names of all reviewers, together with information on whether a candidate’s reviewer approved or disapproved of that candidate. # Data Owners Election via Goal Creation Data owner election is managed from the Goals process. For a full list of emails sent to data owners and other members of the goals process, see [Message Templates](https://documentation.sailpoint.com/fam/help/administrator_guide/website_settings/message_templates.html#message-templates). # Data Owner Exclusion Using Goals Exclusion You can block users from being eligible for election as data owners using the Goals Exclusion setting. In the File Access Manager website go to **Settings > Account Exclusions > Goal Exclusions**. See [Excluding Accounts from File Access Manager Processes](https://documentation.sailpoint.com/fam/help/administrator_guide/website_settings/excluding_accounts.html#excluding-accounts-from-file-access-manager-processes) # Crawling Overview Crawling is the process that discovers the business resources (BRs) of a specific application type. It is the first task involving an application, since BRs are required for many other activities involving applications, such as Permissions Collection and Access Certification. For example, a crawler may discover folders (BR) on a file server (an application type), or mailboxes and folders (BRs) on Exchange (an application type). Before beginning the crawling process, you must install and run the permissions collection service for each application. The crawling process involves the following: - Discovery of business resources and the population of a BR tree - Business resource size calculation | File Name | File Type | Size | | ------------------------- | ----------------------- | ---- | | Finance Balance Sheet.xls | Excel (\*.xls) | 2 M | | Finance Salaries.docx | Word (\*.docx) | 1 M | | Finance Departments.txt | Text (\*.txt) | 3 M | | Finance Organization.ppt | PowerPoint (\*.ppt) | 5 M | | Finance Other Files | (An uncommon file type) | 4 M | - Summary of business resource size by file type | Category Name | Size | | ------------------- | ------------------- | | Office Files | (2M + 1M + 5M) = 8M | | Text Files | 3M | | Finance Other Files | 4M | The Business Resource Trees display the results of crawling in various locations in File Access Manager. ## Interaction of Crawling with Permissions Analysis The permissions analysis process, in brief: - The crawling process collects applications BRs. - In parallel, the Identities Collector collects users and groups (which may occur before the crawler collects the BRs, since these collections are unrelated). - The Permissions Collector collects the BRs, users, and groups, and associates them with permission types to create permissions. # Business Resource Structure The table below lists additional information on the Business Resource Structure. | Application Type | Business Resource Type | Business Resource Full Path Structure | Example | | --------------------- | --------------------------- | -------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------- | | Active Directory | Every LDAP Object | `Distinguished Name` | `CN=Howard,CN=Users,DC=Example,DC=com` | | Box | Folder | `Users//` `/All Files/` | `Users/alice@co.and.co/Points of Interest/Data Classification` `/All Files/doc/Chinese` | | DropBox | Folder | `Team Members//` `Public/` | `Team Members/Batman@brucewain.Example.com/Hobbies/Caving` `Public/Villains/Joker/Hobbies/Product Management` | | EMC Celerra - CIFS | Folder | `\\\\` | `\\celerra-cifs\Users\Ed` | | EMC Celerra - NFS | Directory | `//` | `/users/ed` | | EMC Isilon | Folder | `\\\\` | `\\emc-isilon\Finance\Budget\Last Year` | | Exchange Online | Mailbox Folder | `Mailboxes\:\` | `tom@whereabouts. Example.com:\Inbox\Scripts\Cast Away` | | Exchange Online | Public Folder | `Public Folders\` | `Public Folders\Assets\Assessments\Assorted` | | Exchange On-premise | Mailbox Folder | `Mailboxes\:\` | `Mailboxes\inigo.montoya@Example.com:\Inbox\Bugs` | | Exchange On-premise | Public Folder | `Public Folders\` | `Public Folders\Public\Private` | | Generic NFS | Directory | `//` | `/export/goods` | | Google Drive | Folder | `Users//` | `Users/glenn@501. Example.com /Things to do/Done` | | Windows File Server | Folder | `\\\\` | `\\winserver\C$\Program Files` `\\winserver\Public\Presentations` | | NetApp - CIFS | Folder | `\\\\` | `\\netapp\share\with\the\World` | | NetApp - NFS | Directory | `//` | `/projects/next_iphone` | | OneDrive for Business | Folder | `Personal//` | `Personal/watson@company. Example.com/Diagnostics/Recent` | | SharePoint | Site Collection/List/Folder | `http://///Lists//` | `http://sharepoint2013.Example.com/TeamSite/Lists/ListOfStuff/Really Important` | | SharePoint Online | Site Collection/List/Folder | `https://.sharepoint.com///Lists//` | `https://sailpoint.sharepoint.com/Wayback Site/Lists/Songs/New York/New York` | # Configuring and Scheduling the Crawler To set or edit the Crawler configuration and scheduling, open the edit screen of the required application. 1. Go to **Admin > Applications**. 1. Scroll through the list or use the filter to find the application. 1. Select the **Edit** icon on the line of the application. 1. Press **Next** until you reach the **Crawler & Permissions Collection** settings page. The actual entry fields vary according to the application type. **Create a Schedule** Select to open the schedule panel. See [Scheduling a Task](https://documentation.sailpoint.com/fam/help/administrator_guide/permissions/collection_process.html#scheduling-a-task) ## Setting Crawl Scope There are several options to set the crawl scope: - Setting explicit list of resources to include and / or exclude from the scan. - Creating a regex to define resources to exclude. ### Including and Excluding Paths by List To set the paths to include or exclude in the crawl process for an application, open the edit screen of the required application. 1. Go to **Admin > Applications**. 1. Scroll through the list or use the filter to find the application. 1. Select the **Edit** icon on the line of the application. 1. Press **Next** until you reach the **Crawler & Permissions Collection** settings page. The actual entry fields vary according to the application type. 1. Scroll down to the Crawl configuration settings. 1. Select **Advanced Crawl Scope Configuration** to open the scope configuration panel. 1. Select **Include / Exclude Resources** to open the input fields. 1. To add a resource to a list, type in the full path to include / exclude in the top field and select **+** to add it to the list. 1. To remove a resource from a list, find the resource from the list, and select the *x* icon on the resource row. Note When creating exclusion lists, excludes take precedence over includes. ### Excluding Paths by Regex To set filters of paths to exclude in the crawl process for an application using regex, open the edit screen of the required application. 1. Go to **Admin > Applications**. 1. Scroll through the list or use the filter to find the application. 1. Select the **Edit** icon on the line of the application. 1. Press **Next** until you reach the **Crawler & Permissions Collection** settings page. The actual entry fields vary according to the application type. 1. Select **Exclude Paths by Regex** to open the configuration panel. 1. Type in the paths to exclude by Regex. Since the system does not collect BRs that match this Regex, it also does not analyze them for permissions. Notes - To write a backslash (`\`) or a dollar sign (`$`), add a backslash before it as an escape character. - To add a condition in a single command, use a pipe character `|`. #### Crawler Regex Exclusion Examples - General The following are examples of crawler Regex exclusions. **Exclude all shares which start with one or more share names** | Action | Example | Regex | | ------------------------------------------------ | ----------------------------------------------------------- | ----------------------------- | | Exclude all shares starting with a specific name | `\\server_name\shareName` | `\\\\server_name\\shareName$` | | Exclude all shares starting with multiple names | `\\server_name\shareName` or `\\server_name\OtherShareName` | \`\\\\server_name\\(shareName | **Include ONLY shares which start with one or more share names** | Action | Example | Regex | | ----------------------------------------------------- | ----------------------------------------------------------- | ---------------------------------- | | **Include ONLY shares starting with a specific name** | `\\server_name\shareName` | \`^(?!\\\\server_name\\shareName($ | | **Include ONLY shares starting with multiple names** | `\\server_name\shareName` or `\\server_name\OtherShareName` | \`^(?!\\\\server_name\\(shareName | **Narrow down the selection** | Action | Example | Regex | | ------------------------------------------ | ------------------------ | ---------------------------------- | | **Include ONLY the C$ drive shares** | `\\server_name\C$` | \`^(?!\\\\server_name\\C$($ | | **Include ONLY one folder under a share** | `\\server\share\folderA` | \`^(?!\\\\server_name\\share$($ | | **Include ONLY all administrative shares** | - | \`^(?!\\\\server_name\\[a-zA-Z]$($ | #### Crawler Regex Exclusion Examples - Linux | Action | Example | Regex | | ---------------------- | ------------------------------------------------------------------------------ | ---------- | | Exclude a path | The path `/root` | \`^/root($ | | Exclude multiple paths | The paths `/root` and `/media` | \`^(/root | | Include only a path | The path `/home` (parent directories like `/` must also be added) | \`^(?!(/ | | Include multiple paths | The paths `/home` and `/boot` (parent directories like `/` must also be added) | \`^(?!(/ | #### Crawler Regex Exclusion Examples - Google Drive **Exclude all drives that start with one or more user names:** | Action | Example | Regex | | ----------------------------------------------------- | -------------------------------------- | ---------------------- | | Exclude all drives starting with a specific user name | Starting with `John.Doe` | `^Users\\John\.Doe@.*` | | Exclude all drives starting with multiple user names | Starting with `John.Doe` or `Jane.Doe` | \`^Users\\(John | **Include ONLY drives that start with one or more user names:** | Action | Example | Regex | | ------------------------------------------------------ | -------------------------------------- | ---------------------------- | | Include ONLY drives starting with a specific user name | Starting with `John.Doe` | `^(?!Users\\John\.Doe@.*).*` | | Include ONLY drives starting with multiple user names | Starting with `John.Doe` or `Jane.Doe` | \`^(?!Users\\(John | #### The AWS Path Structure in File Access Manager File Access Manager uses a path name in the following structure: - Path Structure: `Root/[OU]/[Account]/[Bucket Path]/[Folder]/[Filename]` - Component structure: `Root/[OU]/[OU2]/[Account name](#[Account ID])/s3.[region].[bucket name]/[folder]/[file name]` - Example: `Root/Example-OU/Example-Account(#420269343516)/s3.north-east-17.HR3InputDataBucket/Prospects/CVs/SueSmithPM.Docx` **Root** All paths start with `Root/` **OU** The organizational unit. This could be empty, or include a sting of one or more OUs, according to the BR hierarchical structure. **Account** Since account names are not unique under an organization, this string includes the account ID and the account name `[Account name](#[Account ID])` **Bucket Path** The bucket section of the path starts with "s3." and includes the region `s3.[region].[bucket]` #### Crawler Regex Exclusion Examples - AWS S3 Buckets **Exclude all Folders Which Start With One or More Folder Names**: | **Action** | **Regex** | | ----------------------------------------------------------------------- | ------------------------- | | Starting with `bucket_name/folderName` | `bucket_name/folderName$` | | Starting with `bucket_name/folderName` or `bucket_name/OtherFolderName` | \`bucketName/(folderName | **Include ONLY Folders Which Start With One or More Folder Names**: | **Action** | **Regex** | | ----------------------------------------------------------------------- | ----------------------------- | | Starting with `bucket_name/shareName` | \`^(?!bucket_name/shareName($ | | Starting with `bucket_name/folderName` or `bucket_name/OtherFolderName` | \`^(?!bucket_name/(folderName | ### Excluding Top Level Resources Use the top level exclusion screen to select top level roots to exclude from the crawl. This setting is done per application. **To exclude top level resources from the crawl process:** 1. Go to **Admin > Applications**. 1. Find the application to configure and select the drop-down menu on the application line. Select **Exclude Top Level Resources** to open the configuration panel. 1. The **Run Task** button triggers a task that runs a short detection scan to detect the current top level resources. If the top-level resource list has changed in the application while you are on this screen, press this button to retrieve the updated structure. Once triggered, you can see the task status in **Settings > Task Management > Tasks**. Note This will only work if the user has access to the task page. When the task has completed, press **Refresh** to update the page with the list of top level resources. 1. Select the top level resource list, and select top level resources to exclude. 1. Select **Save** to save the change. 1. To refresh the list of top level resources, run the task again. Running the task will not clear the list of top level resources to exclude. ### Special Consideration for Long File Paths in Crawl If you need to support long file paths above 4,000 characters for the crawl, set the flag `excludeVeryLongResourcePaths` in the **Permission Collection Engine App.config** file to `true`. By default, this value will be commented out and set to `false`. This key ensures, when enabled, that paths longer than 4,000 characters are excluded from the applications’ resource discovery (Crawl), to avoid issues while storing them in the SQL Server database. When enabled, business resources with full paths longer than 4,000 characters, and everything included in the hierarchical structure below them, will be excluded from the crawl, and will not be collected by File Access Manager. This scenario is extremely rare. Note You should not enable exclusion of long paths, unless you experience an issue. #### Background File Access Manager uses a hashing mechanism to create a unique identifier for each business resource stored in the File Access Manager database. The hashing mechanism in SQL Server versions 2014 and earlier is unable to process (hash) values with 4,000 or more characters. Though resources with paths of 4,000 characters or longer are extremely rare, File Access Manager is designed to handle that limitation. #### Identifying the Problem When using an SQL Server database version 2014 and earlier, the following error message will appear in the Permission Collection Engine log file: `System.Data.SqlClient.SqlException (0x80131904): String or binary data would be truncated.` In all other cases, this feature should not be enabled. #### Setting the Long Resource Path Key The `Permission Collection Engine App.config` file is `RoleAnalyticsServiceHost.exe.config`, and can be found in the folder: `%SailPoint_Home%\FileAccessManager\[Permission Collection instance]\` Search for the key `excludeVeryLongResourcePaths` and correct it as described above. # Data Source Types and Usages A data source In File Access Manager is a table containing data from various sources, including internal File Access Manager reports, for use in various system locations. An Administrator can join data sources to form a superset of data, which follows the same logic as a “left join” in an RDBMS database. Caution For some data source types, the files should be located on the same server where the IIS is running. To run reports on these data types, the Reporting service has to be installed on the same server as well. Please check in the description of the relevant type below. ## Available Data Sources Refer to [Data Source Properties](https://documentation.sailpoint.com/fam/help/administrator_guide/data_source_types_and_usages/data_source_properties.html) for more information about available data sources. | Data Source | Description | | ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | SQL Server Database | Access to SQL server database | | Flat File | Query a delimited file | | Excel | Read data from an MS Excel document | | User Exit | Run a user script to return data | | Active Directory | Access to the Active Directory | | LDAP | Query LDAP for object types and properties | | ODBC | Access to any ODBC source (such as, DB2 and AS400) | | Oracle Database | Access to an Oracle database | | Static Table | Define an ad-hoc source by creating and populating a table on screen | | XML | Analyze and import data from XML. The files should be located on the same server as the IIS. In order to run reports, the Reporting service should be installed on the same server as well. | ## Viewing and Editing Data Sources The Data Source page displays a list of data sourced defined in File Access Manager. To create a data source, select **New Data Source**. See [Creating Data Sources](#creating-data-sources) Actions available on data sources - Edit - Delete - Generate Report - opens a scheduling panel to run a report once, or create a scheduled report from this data. ## Join Data Sources The Join Data Source works like a "left join" in an RDBMS, where the configured data source is the left table, and the joined data source is the right table.\ The join will produce a complete set of records by matching data from the configured Data Source, with data in the joined Data Source (if available). If there is no matching data, the right columns will be empty (null values). A joined data source depends on a match between the Local Key (in the configured Data Source column) and the Remote Key (in the joined Data Source column). In the following example, Data Source A (configured) has the following columns: Note A User Name is a unique entity, while a User Display Name may have more than one associated user. **Data Source A** | User Name | User Display Name | | --------- | ----------------- | | John | John Doe | | Mike | Mike Miller | | Lisa | Lisa B | **Data Source B** Data Source B (the joined data source) has the following columns: | User Name Joined | Department | | ---------------- | ----------- | | John | Engineering | | Mike | Product | | Other User | Finance | The joined data source below results from joining Data Source A and Data Source B, Local Key = User Name and Remote Key = User Name Joined: **Joined Data Source** | User Name | User Display Name | Department | | --------- | ----------------- | ----------- | | John | John Doe | Engineering | | Mike | Mike Miller | Product | | Lisa | Lisa B | | The Department value for Lisa is null in Data Source B. Other User is not in Data Source A, and is therefore, not in the joined Data Source. ## Creating Data Sources To create a new Data Source: 1. Go to **Admin > Data Sources > New Data Source** to open the New Data Source wizard. 1. Select the data source type from the dropdown list, and enter a name and description. 1. Select **Next** to open the configuration page. The parameters Data Source Wizard screen displays. This screen is different for each data source type. For a detailed description of the fields for each data source type, see the next sections. | | | | | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | [Active Directory Data Source](https://documentation.sailpoint.com/fam/help/administrator_guide/data_source_types_and_usages/data_source_properties.html#active-directory-data-source) | [LDAP Data Source](https://documentation.sailpoint.com/fam/help/administrator_guide/data_source_types_and_usages/data_source_properties.html#ldap-data-source) | [SQL Server Database Data Source](https://documentation.sailpoint.com/fam/help/administrator_guide/data_source_types_and_usages/data_source_properties.html#sql-server-database-data-source) | | [Excel Data Source](https://documentation.sailpoint.com/fam/help/administrator_guide/data_source_types_and_usages/data_source_properties.html#excel-data-source) | [ODBC Data Source](https://documentation.sailpoint.com/fam/help/administrator_guide/data_source_types_and_usages/data_source_properties.html#odbc-data-source) | [Static Table Data Source](https://documentation.sailpoint.com/fam/help/administrator_guide/data_source_types_and_usages/data_source_properties.html#static-table-data-source) | | [Flat File Data Source](https://documentation.sailpoint.com/fam/help/administrator_guide/data_source_types_and_usages/data_source_properties.html#flat-file-data-source) | [Oracle Database Data Source](https://documentation.sailpoint.com/fam/help/administrator_guide/data_source_types_and_usages/data_source_properties.html#oracle-database-data-source) | [User Exit Data Source](https://documentation.sailpoint.com/fam/help/administrator_guide/data_source_types_and_usages/data_source_properties.html#user-exit-data-source) | | [XML Data Source](https://documentation.sailpoint.com/fam/help/administrator_guide/data_source_types_and_usages/data_source_properties.html#xml-data-source) | | | 1. Fill in the configuration fields for the data source. 1. Select **Test**. If the configuration is correct, the Test will run the data source with the values entered in the configuration fields, and display the first ten results. If there is an error the test will fail. 1. Joining with additional data sources (Optional) The Join Data Source works like a *Left Join* in an RDBMS, where the configured data source is the left table, and the joined data source is the right table. See [Join Data Sources](#join-data-sources) for further details. Select the box **Do you want to join this data source with another one?** to configure joining this data source with other predefined data sources. Select the data source, and the key to link by from the dropdown lists. Press the **+** to add additional data sources. 1. Select **Done** to create the data source. # Data Source Properties ## Active Directory Data Source The Active Directory data source allows the creation of an LDAP query to the Active Directory to obtain specific objects and their properties. An Active Directory data source can be added as a previously configured DEC, or using specific parameters to access the Active Directory. ### Configuring an Active Directory Source by DEC ***DEC*** The Data Enrichment Application. Select from a list of Active Directory DECs ***Filter*** An Active Directory path by which to filter. For example: OU=NewUsers,DC=Example,DC=Com ***Search Scope*** Where to search objects. Select from - Base - One Level - Subtree ***Properties to Fetch*** More properties to fetch in addition to the default (Active Directory properties names). For example: description, objectClass, sAMAccountName etc. ### Configuring an Active Directory Source by Properties | Property | Description | | ------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------- | | Domain NetBios Name | The Active Directory domain NetBios name Example: CONTOSO | | Domain DNS Name | The Active Directory domain DNS name Example: .Example.com | | User / Password | A user from the Active Directory domain with Administrative Rights | | Port | The connection port. The default is 389 Must be 389 or 636 if SSL is selected | | SSL | Check this box to use SSL | | Specific Server | Should use a specific server connection | | Base DN | Specifies an Active Directory path to search under. Can be used to search in a specific OU. Leave empty if unsure. | | Filter | An LDAP-syntax filter to refine results. Example: (objectClass=user) This will give you all objects of the "user" class. | | Search Scope | Where to search objects: Subtree, Base, or One Level. | | Properties to Fetch | More properties to fetch in addition to the default (Active Directory properties names) For example: description, objectClass, sAMAccountName etc. | ## Excel Data Source You can create an Excel data source from an existing Excel file. | Property | Description | | ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ | | File UNC Path | The file location. This must be a relative UNC since it can be accessed from multiple File Access Manager servers. Example: \\file-server\\share1\\file.xlsx | | Domain | The domain of the user that has access to the file | | User / Password | The user that has access to the file | | Worksheet | The name of the worksheet in the Excel file to query. Example: Sheet1 | | Custom Columns Letters | The columns to query, comma delimited. Example: A,B,E,Z. Enter a column letter, then select + for each additional column | | First Row | The first row number to query. First-row columns are headers. Select to read the headers from the Excel sheet. | ## Flat File Data Source You can create a table from a flat file data source (such as \*.csv). | Property | Description | | --------------------- | ------------------------------------------------------------------------------------------------------------------ | | Source File Path | The file location. Example: \\file-server\\share1\\file.xlsx | | Headers Row Structure | The row header (the name of the new table) according to the structure of the file, for example: Users, Roles, Data | | Delimiter Character | The delimiter separating entries | | First Row | Specifies a column name. Select to read the headers from the Excel sheet. | ## LDAP Data Source You can create a table from an LDAP query. | Property | Description | | ----------------------------- | ------------------------------------------------------------------------------------------------------------------------------------ | | Query | The LDAP query that defines the data source. Example: objectClass=user | | User / Password | The user that has permissions to run the query | | Server | The server to run the LDAP query | | Port | The port (default 389) | | SSL | Should use SSL | | Expand Multi-value Attributes | If set, will create a row in the data source for each value in a multi-value attribute | | Search Scope | Where to search objects: Subtree, Base, or One Level. | | Base DN | The Base DN from which the query should run. Example: DC=Example,DC=COM | | Properties to Fetch | Type in the name of the property, and select + to add it to the list. Select the delete icon on any item to remove it from the list. | ## ODBC Data Source You can create a table from an ODBC data source. | Property | Description | | --------------- | -------------------------------------------------------------- | | System DSN | The ODBC file data source name as it is stored in the server | | Timeout (min) | The ODBC query timeout, in minutes (default is 0) | | User / Password | Credentials of the user with permissions to run the ODBC query | | Query | The query to retrieve the required data | ## Oracle Database Data Source You can create a table from an Oracle Database query. | Property | Description | | --------------- | ---------------------------------------------------------------------------------------------------------------- | | SID | The oracle site identifier. This field is compulsory if the By Properties radio button is checked | | User / Password | The user with permission to run the query. This field is compulsory if the By Properties radio button is checked | | Timeout | The query timeout in minutes. This field is compulsory if the By Properties radio button is checked | | Query | The query that defines the data to retrieve | ## SQL Server Database Data Source You can create a table from an SQL Server Database query. | Property | Description | | ----------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | | WPC | The Data Enrichment Application from which to take the parameters (only SQL DECs). This field is compulsory if the BY DEC radio button is checked | | Server Name / Port / Database | SQL Server Database access. These fields are compulsory if the By Properties radio button is checked | | User / Password | The user with permission to run the query. This field is compulsory if the By Properties radio button is checked | | Timeout (min) | The query timeout (default is 0). This field is compulsory if the By Properties radio button is checked | | Query | The SQL query that defines the data to retrieve | ## Static Table Data Source Create a static custom table by adding or deleting columns and inserting / editing written text in the data grid on the screen. Edit the headers and content directly in the New Data Source page. Use the **Add Row** / **Column** buttons and the delete buttons to manage the table dimensions. ## User Exit Data Source The User Exit data source executes an external script / executable file, which prints a \*.csv-formatted table of data to the Standard Output stream. | Property | Description | | ---------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | File Name | The full path to the file being executed. Examples: c:\\temp\\UserExitScript.bat \\remotehost\\shared_dir\\UserExitScript.exe | | Arguments passed to the file | List of arguments | | User Name / Password / User Domain | The user running the file execution process | | Timeout (ms) | The amount of time, in milliseconds, to wait for the process to exit. The maximum is the largest possible value of a 32-bit integer. If the timeout passes, the process terminates. | | First-row columns are headers | Select to indicate that the csv output contains headers in the first row | | Values Delimiter Character | The delimiter of the values in each row. Examples: , (comma) | ## XML Data Source Create a table from an XML data source file. | Property | Description | | -------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | XML Namespace | The connection details screen contains a list of namespaces. Add or remove rows pressing the Add Row button, or the delete icon respectively. | | Prefix | If the source XML has XML namespaces, this is the namespace’s prefix. This field is compulsory if the source XML has XML namespaces. Example: If the namespace is: `xmlns:sp=http://some.namespace.uri` then the prefix is sp. | | URI | If the source XML has XML namespaces, this is the namespace’s URI. This field is compulsory if the source XML has XML namespaces. Example: If the namespace is: `xmlns:sp=http://some.namespace.uri` then the URI is: `http://some.namespace.uri` | | Fields | Define the fields within the XML source. Add or remove rows pressing the Add Row button, or the delete icon respectively. | | Name | Example: The name in this record would be "Job" `fireman` | | XPath | Example: the XPath for this record would be "Job/text()"`
fireman` | | Type | Example: `System.DateTime, System.Int32` | | Format | If the column is of a Date type, can set the date format. Example: `DD’/’MM’/’yyyy` | | Source XML File Path | The path to the source XML file. This is a local path, from which the "File Access Manager User Interface" service is installed | | Record Base XPath | This XPath query defines the recurring element to use as a base record. The different field definition query from inside this base record. For example, if the XML is:`
john smithjohn doe` Then the record base XPath is `.someData/record` | # Forensics The forensics screens allow the administrators to view analysis screens of data collected by the File Access Manager services. The tables can be filtered to fit specific needs, and filters can be saved, and shared with others as well. The File Access Manager website has the following forensics screens: - Activity forensics - Permissions forensics - Identities forensics - Data Classification forensics Forensic queries can be used to answer questions such as: 1. Who has accessed files classified as Credit Cards? 1. Who can access folders classified as SSN? 1. Are there users without a password in the system, or users who haven’t logged in for the past six months? ## Creating and Editing a Forensics Query A query is a collection of one or more filters that let you select from a list of parameters to select user types, permissions, user scenarios or permission scenarios to analyze. Note When creating a filter using Business Resource Name or Business Resource Full Path, those two fields only support Equals or Any of. This filter is not auto-complete capable. 1. Select **Clear All** to clear the current filters, and clear the grid. 1. Select **+** to add a filter to the query. 1. Select a field to filter by from the **Select Field** dropdown menu, and the filter criteria, according to the filed type and parameters. 1. Select **Save** to add the filter line to the query, or **Cancel** to start over. 1. Add more filter lines by repeating these steps as required. For example: "Last login date older than 100 days and Password not required equals True” 1. Select **Apply** to run the query. Note For [Permission Forensics](https://documentation.sailpoint.com/fam/help/administrator_guide/forensics/permission_forensics.html), the data retrieved depend on the user scope of the user running the query. The data returned will only be within the applications and resources within each application to which the user running the query has access. ### Searching for Resources Using a Resource Tree You can add resources for the filter by navigating down the resource tree and selecting the requested branch. 1. Open a new filter line. 1. Select **Resource** from the **Select Field** drop down list. 1. Open the **Select Resource** drop down menu to view the resource tree. ### Saving Queries 1. To save a query, select **Save**. That will open a popup screen to enter the query name. 1. Select **Save** or **Cancel** to continue. A query can be deleted only by the user who created it. ### Using Saved Queries Note If you select a saved query, the contents of your current query will be overwritten. To retrieve a saved query: 1. Select **Saved Queries**. 1. Select a query from one of the saved query lists: - Recent - a list of your recently used queries. These queries are named and ordered by the timestamp. - Saved - a list of queries saved by the user. - Shared - a list of queries shared with the user. Selecting on a query will load its filters and displayed columns. A Query object cannot be edited, and changes made after loading a query do not impact the loaded Query object. However, these changes can be saved in a new query. ## Sharing Queries with Other Users The forensics screens give you the option to share queries with other users. Sharing a query will make the query available in the quarry list of other users in this forensics screen. To share a forensics query: 1. [Create](#creating-and-editing-a-forensics-query) a query. 1. Select **Save**. 1. Type in a name for the query. 1. Type in the name or part of a name of the user to share the query with. 1. Select the user from the dropdown list. 1. Select **Save** to save the query to your list and the assigned user’s query list. The query will be stored in the other user’s list under **Shared**. ## Generating Reports To generate a report from the last run query: 1. Run a query as described above, or by selecting a saved query from the query list. 1. Select **Global Options > Generate Report**. 1. The report will be available in My Reports. To schedule and save a report template: 1. Run a query as described above, or by selecting a saved query from the query list. 1. Select **Global Options > Generate Report**. 1. Name the schedule and fill in the scheduling parameters. # Activity Forensics To locate the Activity Forensics page, go to **Forensics > Activity**. The Activity Forensics page can be used to track user activities in various areas of interest. ## Filter The activity forensics filter allows users to focus on set scenarios and areas of interest. When you open the activity forensics page, it will load with the last query used. The query is composed of one or more filters, combined with an `and` operator. ### Creating a Query 1. Create a filter. 1. Select a field from the field dropdown list. 1. Select an operator. 1. Select or type in a value. For multiple values, start typing part of the value, and select items from the dropdown list by ticking the checkbox next to each item. 1. Select **Add** to add this filter to the query list. 1. Repeat to add additional filter items to the query. 1. Select **Apply** to run the query, and display the results. ### Common Activity Forensics Filter Fields - **Action type** - **Application** - From the applications connected and monitored by File Access Manager. - **Application type** - **Category** - As assigned by the data classification module. - **Object name** - **Resource** - Specific folder or folders to monitor. - **User** ### Storing and Sharing Queries The 10 last queries are stored for reuse, with the query timestamp as the name. You can store queries for later use, with a meaningful name, with the option of sharing them with other users. To store or share queries: 1. Select the **Actions** dropdown menu on the top right corner. 1. Select **Save Query** to open the Save Query dialog box. 1. Type in the query name, and optionally, the name of a user(s) to share the query with. 1. Start typing the user name. To add a user to the share list, click the **+** button. ### Loading Stored Queries To load a stored query, open the query list panel on the left side of the activity forensics page. You might have to click the **restore** button if this panel is minimized. Click on a recent query, or a stored query to load the query, and apply it to the results. ### Saving the Query to a Report You can create a report out of an activity forensics query. 1. Select **Generate Report** from the **Activities** dropdown menu. 1. The report will be available in **Reports > My Reports**. ### Creating a Scheduled Report from a Query You can also create a repeated report from the query. Select **Schedule Report Template** from the **Activities** dropdown menu to open the **Schedule Report Template** panel. # Data Classification Forensics The Data Classification Forensics screen can be found by navigating to **Forensics > Data Classification**. It displays data classification results, based on your active policies. Use filters to focus on specific data. You can sort the results by Match Count. The returned records are limited to 10,000 results. Note The Data Classification Results table shows results of the data classification process running in File Access Manager, as well as any data classification results imported from an external source, using the [Import Data Classification Results](https://documentation.sailpoint.com/file_access_manager/help/data_classification/import_data_classificati.html#data_classification_243363973_1784148) feature. This might lead to duplicate entries from the two sources. ## Reports Data Classification reports can be found in the report templates, using the *Classified Data* tag to locate relevant reports. ## Using the Data Classification Forensics Table Users can change one or more of the default columns by clicking on **Display Columns**, and selecting one or more columns from the dropdown menu. Currently, all columns display, including the following: - Application - This column displays all the system applications. - Application Type - This column displays all the system application types. - Last Updated - This is the timestamp of the last classification process, in which the file was classified into the specified category. - Result Type - This is the source of the classification result (Content, Behavioral, or Imported Classification). Note The default column headings, from left to right, are: Resource Full Path, File Name, Policy Name, Rule Name, Categories, and Match Count. You can clear any selections made in the Policy, Rule, and Category search fields by clicking **Clear Selection** on the top right of each field. 1. Select a result type from the Result Type dropdown menu: - All - All possible result types. - Behavioral - Only results from behavioral rules. - Composite Classification - Results from composite rules (Combining the results of several classifications). - Content - Only results from content rules. - Imported - Normally, the administrative client imports the results from a Data Loss Prevention (DLP) product that has already scanned the results to control what data end users can transfer, so there is no need to rescan those results. 1. Enter a number in both the Match Count (Bigger than) and the Match Count (Smaller than) fields to restrict the number of Regular Expression (Regex, the general standard for textual search) results. Note Users can see the resources according to the user scope they have. A result record represents the classification of a certain file by file, rule, and policy. A single file can be classified into multiple rules/policies, resulting in a separate record in the result for each file-to-rule-to-policy relation. The result record consists of default columns, which can be changed, based on the users’ requirements: - Resource Full Path - This is the full path of the resource in which the file resides. - File Name - This is the name of the classified file. - Policy Name - This is the name of the policy, by which the file is classified. - Rule Name - This is the name of the rule, by which the file is classified. - Category - This is the classification category name used by the rule. - Match Count - This is the maximum number of matches under any rule's requirements contained in the file. This is not an aggregative figure, and does not sum up the number of matches in each of the rule requirements for the file. Instead, it represents the highest match count yielded by any of the rule requirements, and should be viewed as a sensitivity score attributed to the file, in accordance with the applicable policy rules. - For example, if a policy rule contains two rule requirements - one matching credit card numbers with ten occurrences of credit card numbers within the same file, and another matching telephone numbers with eight occurrences of telephone numbers within the same file, the Match Count value of the file for that category (assigned by the rule) would be 10 (rather than 18, or 8), since it represents the maximum number of occurrences matching any of the rule requirements within that policy rule. - When the result displays a regular expression search, this field will be clickable and display the masked matches of the regular expression. Note The query will retrieve the first 10,000 results. Narrow the search to obtain a better fit. ## Filter To filter data classification forensics, select the **Filters** button at the top right of the screen. The forensics results can be filtered by: - Policy Name - Category - Rule Name - Result Type (All, Content, Behavior, Imported) - Match Count (Bigger than/Smaller than) - Filter by Scope 1. Select a scope type (Application type, Application, or Resource) from the Scope Type dropdown menu. 1. Select a corresponding resource from the Resources dropdown menu.\ You can clear a selection from this dropdown menu by clicking **Clear Selection** on the top right of the menu. 1. Select **Reset** at the bottom left of the filtering screen to apply all the selected filters. # Identities Forensics To locate the Identity Forensics page, go to **Forensics > Identities**. The Identities Forensics screen displays users, groups and their relationship recorded by the system. Use filters to focus on specific data, The page supports reports and campaigns limited to 10,000 results. Filters - See [Creating and Editing a Forensics Query](https://documentation.sailpoint.com/fam/help/administrator_guide/forensics/index.html#creating-and-editing-a-forensics-query). Reports - See [Generating Reports](https://documentation.sailpoint.com/fam/help/administrator_guide/forensics/index.html#generating-reports). ## Viewing Identity Forensics Results Select the tab to display different data about users, groups and their relationship. - Users’ Membership in Groups - View of users and their group memberships;. - Users - This tab displays users and their attributes, defined in the identity store. - Groups - This tab displays groups and their attributes, defined in the identity store. - Identity queries involve identity stores connected to File Access Manager, regardless of the permissions attached to these identities. Note Each tab has a separate filter and stored query list. # Permission Forensics The Permission Forensics screen lets the user monitor and analyze the user and group permissions. On this screen you can create queries to analyze the permissions of specific groups of users, save and share queries for selecting users and groups, generate reports, run permission scans, and revoke explicit permissions of users. This page supports reports and campaigns. This component answers questions, such as: - Which users have access to what resources? - Which users have not used permissions granted to them? - Which permissions were granted to each group? - Which groups are not being used? The table displays the permissions, according to the level of granularity selected in the filter. When creating a filter, you can define the granularity of the report using the **View by** field, and can mark stale permissions on the table, according to the unused time selected. Note The query will retrieve the first 100,000 results. Narrow the search to obtain a better fit. Reports - See [Generating Reports](https://documentation.sailpoint.com/fam/help/administrator_guide/forensics/index.html#generating-reports) Filters - See [Creating and Editing a Forensics Query](https://documentation.sailpoint.com/fam/help/administrator_guide/forensics/index.html#creating-and-editing-a-forensics-query). ## Viewing Permission Forensics The Permission Forensics table displays the permissions retrieved by the query run. The data displayed, by default, includes the following columns for each permission: - What resource - Business resource full path - Application - Who the user is - User name - User display name - Group name - User domain - Group domain - User entity type - Group entity type - The permission type - Permission type - Classification Category - Is Inherited - Inherits Permissions - ACL Type Allowed? To change the order of the columns, drag the column titles. Additional Columns - Application group - Application type - Business Resource Logical Path - Business Resource Name - Business Resource Type - Creates Loop - Creation Timestamp - Cumulative Last Used - Department - Distinguished Name - Group Path - Is Effective - Is Owner Permission - Is Riskiest - Is - SID History - Last Login Date - Last Used Date - Loop Path - Password Never Expires - Password Not Required - Permission Type Description - User Disabled - User Email - User Locked ### Selecting Columns to Display 1. Select the Column chooser icon on the table header bar. 1. Select the columns to display from the drop-down list. 1. Select **Show All / Show Less** to display a full list of columns / only the default columns in the column chooser. This does not change the selection of columns to display in the table. 1. Use the search field to narrow down the list of columns in the column chooser. 1. Select **Reset Columns** to reset to the default selection and order of the columns in the table. ### View by You can change the granularity of the output by selecting the View By type. These options will determine whether to check a user’s direct permissions, or permissions granted by groups the user belongs to, as described below: - Groups & Users direct Permissions\ This view displays direct Users’ and Groups’ permissions but does not display the Group members. - Users direct & Group membership Permissions\ This view displays user permissions based on direct permission, group membership, and nested group membership. This view doesn't list the users in the groups Everyone and Authenticated Users. - Everyone Groups expanded, Users direct & Group membership Permissions\ This view displays user permissions based on direct permission, group membership, and nested group membership, including listing the members of the Everyone and Authenticated Users groups. Notes - The default view is the Users and Groups view. - In the permission forensic screen, the View By field can be changed after setting or restoring the filter. ### Mark Stale Permissions Select the time period for stale permissions. The user permissions which were not in use for X time (configurable) will be marked in red. ## Scope and Hierarchical Search By default, when you select a business resource (BR) to scope its permissions, only the direct BR permissions (not the child BR permissions) displays. ## Special Groups - Group Entity Type When creating a filter, you can select the group entity type from the **Field** field. In Windows-based environments, the user groups are Everyone, Authenticated Users, and Domain Users. - Everyone - Includes all users. - Authenticated Users - Includes all users without a guest. - Domain Users - Includes a group with all users in the domain. By default, any user created is a member of this group (but it is possible to remove that user). ## Owner Permission Field File Access Manager permissions forensics allows identification and tracking of Owner permissions in the AFM interface: - A proprietary column, called “Is Owner Permission” indicates whether a given permission is an Owner permission. - A proprietary query attribute is dedicated for filtering Owner permissions (allowing queries and/or reports listing the owners of resources). ### Permission Scan for Business Resource The Permission Scan collects the security information from the scanned BRs, and stores it in the File Access Manager database. This includes which users or groups have access to the BR, and whether the access is inherited. The permission scan stores access types such as read, write, full control, etc., depending on the application type. When requesting a permission scan, you can set the resources to scan, and the number of levels below the requested BR to scan. To perform a permission scan: 1. Open the Permission Forensics screen\ **Forensics > Permissions**. 1. From the **Global Options** dropdown menu, select **Start Permission Scan.** 1. This will open the Permission Scan panel. Select the scan level: 1. This Business Resource only 1. This Business Resource and levels 'Level 1-4' and 'All Levels' 1. Select **Scan** to start the scan, or **Cancel** to return to the Permission Forensics screen. ### DFS Support - For DFS resources, the Permission Forensics table will show the physical, as well as the logical path of resources. - You can create a filter for DFS resources by logical path only. To select a logical path, select **Resource** on the **Select Field** drop down menu, then go to the required path on the resource tree on the **Select Resource** dropdown list. Refer to [Searching for Resources Using a Resource Tree](https://documentation.sailpoint.com/fam/help/administrator_guide/forensics/index.html#searching-for-resources-using-a-resource-tree). ### Removing Explicit Permissions Using the Permission Forensics Page Note This process will revoke explicit permissions from non-normalized resources that are configured for access fulfillment. Permissions that are inherited will not be removed. 1. Go to **Forensics > Permissions**. 1. Set a filter, as described in [Creating and Editing a Forensics Query](https://documentation.sailpoint.com/fam/help/administrator_guide/forensics/index.html#creating-and-editing-a-forensics-query). 1. Select **Apply** to run the filter. 1. Set the View to **Groups and Users direct permissions**. 1. In the permission results, select the permission rows to remove, by selecting the checkbox on the row. Before selecting which permissions to remove, be sure that: - The Application in which the BR resides is configured to support Access Fulfillment for Direct Permission Removal. Section Configuration in [Enabling Removal of Explicit Permissions](https://documentation.sailpoint.com/fam/help/administrator_guide/permissions/access_fulfillment/config_access_fulfillment.html#enabling-removal-of-explicit-permissions) has additional information on how to configure removal of explicit permissions. - The permission is defined directly on the BR (the value in the **Is Inherited** column is False). - The selected permission is not a normalized group, created and managed by File Access Manager. 1. Select **Revoke Explicit Permissions**. # File Access Manager User Interfaces There are three user interfaces to File Access Manager: - **File Access Manager Administrative Client** This is a windows based application installed on site. This interface is accessible to administrators and other specific users defined in the system. It includes configuration and activation of File Access Manager services and activities. *Authentication:* Login and Password Note This interface is in the process of being phased out, as functionality is converted into the File Access Manager website. - **File Access Manager website** A web based interface accessible to all users in the system’s domain.\ Within the File Access Manager website, users’ access to data and functionality is set to fit the users’ role in the company and data they are authorized to view. Screens and buttons within screens that a user does not have the right to use are disabled, or not displayed. *Authentication:* Login to the system is auto-authenticated through IIS, or via supported SSO sources. - **File Access Manager API** A standard RESTful API supporting SCIM standard for identity management. The API documentation can be found in the installed server at the URL: `[Installed server]/IdentityIQFAMapi/docs/index.html` *Authentication:* The File Access Manager API uses OAuth 2.0 as well as Basic Authentication across HTTP. Note To set up the File Access Manager website on HTTPS, see File Access Manager Website SSL. # File Access Manager Administrative Client This section describes the administrative client, the main capabilities, and navigation paths. The image below shows the system module of the File Access Manager Administrative Client user interface. ## Main User Interface The following image shows the different areas of the main screen: ## Primary Navigation The main navigation panel, or system modules, control the primary parts of the system. These include: - Applications - Reports - Review Processes - Data Sources - Access Requests - Access Fulfillment - What-If - Health Center - Event Viewer - Upgrades & Patches ## Secondary Navigation Some panels in the primary navigation have sub-panels, which users can select from the list at the upper left side of the secondary navigation area. Currently, secondary navigation options (also called screens) are in all modules except for the Activities module. | Feature | Description | | --------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ | | What-If | Displays a simulation panel to describe the permission changes that would be created by adding or removing users to or from groups. | | Access Requests | Displays the access requests created in the web application. | | Applications | Includes the following capabilities: - Application configurations - Identity collectors | | File Access Manager permissions | Alert responses configuration | | Authentication store management Reports | For reports created in other panels in the administrative client. This panel enables the user to customize, save, and add schedules for these reports. | | Review Processes | Defines static and dynamic review process workflows for use in Access Certification processes. | | Data Sources | Manages data sources. | | Access Fulfillment | Provides oversight of pending fulfillment requests. Performs actions on fulfillment requests, such as Rollback or Retry. | | Health Center | Tracks the status of File Access Manager services. | | Event Viewer | Displays important updates from File Access Manager services. | | Upgrades and Patches | Includes system upgrades and patch downloads. | ### Context Most File Access Manager operations operate within the context of a business resource (BR), which is a monitored application object. Examples of BRs are: - Exchange Mailbox folder - Active Directory objects - SharePoint folders - Shares on a File Server Monitored applications include file servers, Microsoft™ Outlook, Microsoft SharePoint, Microsoft Active Directory, or any other system that can be monitored and assessed. The working business resource displays in the content area of the main navigation window. Users can select a business resource or a specific attribute using advanced filtering in the secondary navigation area. Note If a user accesses a screen or panel for which they have permission, but no valid user scope, the screen, table, and report will be empty. Opening such a screen is accompanied with an information panel stating that the contents of the screen might be limited or empty due to the user scope. ## Resource Tree The resource tree appears in the File Access Manager administrative client (In the File Access Manager website it is replaced by the Resource Explorer). It represents all the applications and BRs available. The items in the resource tree display in their natural, hierarchical order. The resource tree contains the following: - The resource tree’s children, which are all the containers in the system - The container’s children, which are all the applications, and their children, which, in turn are the BRs The image below shows a sample resource tree, with containers, applications, and BRs. ### Search There can be tens of millions of resources in a resource tree of a medium-to large-sized organization. The system searches for object names, rather than object paths. ### Deleted Objects By default, File Access Manager filters deleted objects from the resource tree and search results. Selecting the trash bin icon on the upper right side of the resource tree displays the deleted objects in that tree. ### Refresh Resources Structure File Access Manager constantly updates the BR tree when it monitors live systems, but does not auto-update every change, to improve system performance. Selecting the refresh icon (two arrows in a circle) refreshes the BR tree. # File Access Manager Website This section describes the File Access Manager website, the main capabilities and navigation paths. The image below shows the System *module* of the File Access Manager website user interface. ## Administrator Login As an Administrator using Windows authentication, a user is able to log into File Access Manager using a dedicated login screen. When logging into File Access Manager for the first time, use 'wbxadmin' as the username and the password you previously provided. After you have logged in successfully, follow the instructions to change the admin password. A user can access the Login page from either: - User Menu > Switch User - If access was denied, use the link provided on the screen ### Switching Users If there was a misconfiguration in the initial File Access Manager setup process, a user can log in as a WBXadmin using the login page. 1. If switching to WBXadmin, go to the menu at the top right of the screen. Your user name will be displayed. Select the drop down menu and select **Switch User**. 1. Provide your user name and password or the WBXadmin credentials. ### Access Denied Due to a misconfiguration of the initial File Access Manager setup, a user using Windows authentication may get an access denied page. Select the link in the Access Denied message to be taken to the authentication settings where they can be verified. Or contact your File Access Manage administrator for assistance. Note If you are unable to log in, contact your SailPoint representative for assistance. # Application Main Screen The Applications page enables a user to view, add, modify or delete applications. The Applications grid provides the following columns: - Name - name of application - Description - additional information about the application - Type - common search or grouping criteria - Tags - allows users to group applications together - Actions - provides multiple options for the user, including editing or deleting the application The amount of rows displaying applications can be changed with the **Rows per page** drop down at the bottom left of the page. The user can also select through pages with the left and right arrows at the bottom right of the page. The following are options throughout the Application page: | Option | Description | | ---------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Add New | This option allows the user to add a new application. | | Filters | Allows the user to have a more defined search. Searchable items are Name, Type, and Tags. | | Edit | Allows various details about the application to be edited. | | Delete | Allows the user to delete the chosen application. The deleted application will not be available on the grid and a task will be created to clean the application references and data. This deletion task can be monitored on the Tasks screen. | | Exclude Top Level Resources | Function allowing the user to exclude top-level resources from being retrieved by a crawler action. | | Download Installation Files | Download command-line script for a silent installation of the Windows File Server Application Activity Monitor. Download Installation File is supported only by the Windows File Server application type. | | Manage Resources | Browse and manage all resources within the application. This action moves the user to the Resource Explorer. | | Managed Normalized Resources | View, modify, and manage all normalized resources within the application. Here, the user can also enable or disable the normalization, set or modify the normalization configuration and report on all normalized resources. Managed Normalized Resources isn’t supported by all the application types and there are specific settings which should be defined during creation of the application in order to see this option. | ## Adding Applications An application is a component that represents the monitored system, such as Microsoft Outlook, Active Directory, MS Windows file servers. All active applications can be seen in **Admin > Applications**. You can add tags to applications to group the applications by (called containers in previous versions of File Access Manager). In order to integrate with a component, we must first create an application entry. This entry includes the identification, connection details, and other parameters necessary to create the link. To add a standard application, use the New Application Wizard. Notes The actual configuration pages and fields vary according to the application type you are adding. For a detailed description, see the relevant connector installation guide in Compass or on the [documentation website](https://documentation.sailpoint.com/connectors/file_access_manager/fam_landing_page/portal_landingpages/fam_portal_landing.html). For homegrown applications, see [Proprietary Application Permissions Collection (Homegrown Apps)](https://documentation.sailpoint.com/file_access_manager/help/admin_guide/proprietary_application_.html) Note For bulk application loading, use the Bulk Application Wizard. See the connector installation guide. For example, Adding New Bulk Application(CIFS only). 1. Go to **Admin > Applications**. 1. Select **Add New** to open the wizard. 1. Select **Standard Application**. 1. Select **Next** to open the **General Details** page. | Field | Description | | --------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Application Type | Select the application type from the dropdown list. | | Application Name | Logical name of the application. Do not use a backslash in the name of the application. | | Description | Description of the application. | | Tags | Select tags for the application from the dropdown menu, and/or type a new name, and press **Enter** to create a new tag. The dropdown list of tags filters out matching tags as you type and displays up to 50 tags. Note: The **tags** replace the **Logical container** field that was used when creating applications in releases before 8.2. | | Event Manager Server | This option is available if there are more than one event manager servers configured in the system. Select an event manager from the drop-down menu. | | Connection Details | Server and user credentials to connect to the remote system. | | Crawler and Permission Collection | Associate an application with a Central Permission Collector Service. This service is responsible for running the Permission Collector and Crawler tasks. Note: The Crawler task progress bar will progress based on the number of resources scanned. | | Data Classification | Associate the application with a Central Data Classification Service. This service is responsible for running the Data Classification tasks. | | Activity Configuration and DECs | Change the default values of the activity monitoring attributes. | | Access Fulfillment | Allow File Access Manager to add and remove permissions. | See the relevant connector installation guide for full details. # Using the Manage Resources Page The Manager Resources page on the website lists the resources per application. You can use this page to - Enable normalization for resources of supported applications - Set monitored actions for top level resources of supported applications ## Navigation To navigate through the resources, select a child resource to change the level displayed, and display the child resource content, or select a path on the cookie crumb list on top of the screen, to move up to the level selected. ## Filtering The filter allows narrowing down the selection of resources. The results are filtered as you type. The filter can be used to search for object names, rather than object paths. **Only Search Inside** [current folder] - search from this folder and downwards. **Name Contains** - toggle the search behavior between "Starts with" and "Contains." ## Manage Normalization The Manage Normalization button appears in applications that support fulfillment. Press the Manage Normalization button on the row of a resource to enable or disable normalization for the resource. ### Handling Inexact Permission Matches During the normalization process, the application has to decide what to do with permissions that do not match the normalized permissions. - Fail the normalization process - Elevate to the nearest permission match - Revoke the permission # File Access Manager Website Dashboard Traditionally, IT personnel or security personnel determine which individuals can access specific operations on specific resources. However, since they are not always directly involved with those resources on a daily basis, they often rely on other people to decide who should have access to each resource, or type of resources. Users who work with resources on a daily basis can best determine which users would be the most likely data owners of specific resources. These are not necessarily IT personnel or even project managers. This dashboard makes it easier for IT and security personnel to enlist the cooperation of resource users to indicate which resources are at risk. This screen has two tabs: - Administrator - Data owner These tabs are accessible according to the user’s capabilities. By default, they are available to administrators, and data owners respectively. An administrator who is also a data owner will see both tabs. ## Viewing the Data Owners on the Dashboard The Date Owner tab is in the web client (**Dashboard > Data Owner**) is available for users in the Data Owner capability, who have user scope assigned to them. The Data Owner tab of the Dashboard in the Web user interface consists of the following sections: - My Resources - Did You Know - My Tasks - Owner Leaderboard ### My Resources The My Resources section is located at the top of the main Dashboard display by following **Dashboard > Data Owner > My Resources**. The dashboard shows statistics for the resources within the user’s scope. The score in parentheses after the name of the resource is the average score of all the Key Performance Indicators (KPIs). The name of the application and its full path are beneath the resource name. The KPIs change based on the resource selected. Each of the KPIs lists the number of indicators and their weighted scores (from 1-10) are also displayed in a color-coded circle graph. The KPIs are: - Overexposed Resources - Overexposed Sensitive Resources - Users with Stale Permissions (permissions older than 12 months) - Stale Data - data older than 12 months, expressed in number of megabytes or gigabytes - The color-coded scores are: - **Red** (0-5) - **Yellow** (5-7.5) - **Green** (7.5-10) For a full description of stale data, and how it is calculated, see [Stale Data](https://documentation.sailpoint.com/fam/help/administrator_guide/activities/stale_data.html#stale-data). To see the details of a specific KPI with the applicable filters, scope, and permission type: 1. Select a KPI from My Resources or go to **Resources > Path** (for example, C:) > *KPI* 1. Select a KPI to see details, with the relevant filters, scope, and permission type. Note If the user does not have the right to access the drill down screen, the drill down link will be disabled. 1. To return to the Dashboard view, select the **Dashboard** tab. ### Did You Know? The “Did you Know?” area of the Dashboard contains useful information about an owned resource. This information includes statistics, resource information about logged in users, and warnings. Information may include identification of users who can access resources with specific permission types or the number of users that used a specific resource within a defined period. This information is updated for each logged-in user. To navigate the Did You Know carousel: 1. Select the **>** to the right (or the **\<** to the left) of the displayed entries. 1. Select a specific **Did You Know** item to review it. 1. Use touch selection and navigation (left or right) when viewing Did You Know information on a tablet. The carousel displays four items at a time, and automatically moves to the next four items every 5 seconds. The progress dots at the bottom of the Did You Know section indicate how many total pieces of information (in groups of four) are available. For example, if the Did You Know section displays five dots, there are twenty total pieces of information. 1. Select **Review Now** to display the details of any item of information in Did You Know. Note If the user does not have the right to access the drill down screen, the drill down link will be disabled. ### My Tasks The My Tasks section, at the top right of the Dashboard, lists the number of pending items in the following categories: - Access Certifications - Access Requests - Owners Election You can navigate directly to the My Tasks view for a task by selecting that task. ### Owner Leaderboard The owner Leaderboard section of the Dashboard displays information about the data owners with the highest-ranking score per owned resource. Owner Leaderboard scores are ranked only for data owners, displaying the identities and scores of the top five data owners and the score of the logged-in user (displayed as “Me”). The “Me” entry indicates whether the user’s rank has increased (a green arrow pointing up) or has decreased (a red arrow pointing down). # Managing File Access Manager Users All the users of the business resources you want to monitor are potential File Access Manager users. You need administrators configuring and monitoring the system, data owners of particular areas of the business resources, verifying that the users (employees, bots, and other entities) that require access to resources in their control have the appropriate access, and other users do not. This chapter describes how to create, delete, manage, and authorize users in File Access Manager. It also discusses several processes available under the System tab. - User access terminology - Creating and deleting users - Managing roles - Capabilities - Scope ## User Access Terminology File Access Manager users have two main characteristics that determine their abilities in the system, permissions and scope. **Permissions** Permissions determine **what** a user has rights to, mainly in terms of screens the user can access, and actions the user can perform on each screen. Naming convention - in most cases, the name is the path to the screen or button being permitted. Permission name - the path in the File Access Manager Administrative Client. Right name - the path in the File Access Manager website. **Scope** Determines which application, and which business resources within each application, a user has a right to perform these actions on. Scope defines business resources that the user is allowed to see on the screens, run reports on, or any other activity enabled by the user’s permissions. For example, an Auditor has the right to run all reports, but only on the data limited by the scope assigned to them. As stated previously, these access parameters are configured separately for the File Access Manager Administrative Client and the File Access Manager website. The terms in the table below are used in each user interface. | Application | Allowed screens and actions | Allowed resources | | ----------------------------------------- | ----------------------------------------- | ----------------- | | File Access Manager Administrative Client | Role and permissions within roles | Data Role | | File Access Manager website | Capability and rights within capabilities | User Scope | Permission - Defines a page or activity on a screen in the application the user can access. Capability - An aggregation of permissions. Users - Assigned to one or more capabilities. ### User The user is an object that represents an account associated with a permission. Standard user attributes include: - User type - User, orphan, or local. - User disabled / enabled - Whether the user account is enabled or disabled in the managed application or the identity store. - User domain - The security domain in the identity store in which the user is defined. For example, you can define the identity store as an Active Directory forest, in which you define the User in one of the domains of the forest. User data is commonly part of an identity collector connected to a relevant identity store. For example, when an identity store is set as an organization's Active Directory, extended attributes may be Department and Manager. ### Capability A capability is a set of rights. Assigning a capability to a user grants them these rights. A right allows a user to perform an action in the File Access Manager Administrator Guide, such as pressing a button or opening a page, or in the File Access Manager website, such as using the navigation menu. If the user lacks a right, the relevant page or button is either unavailable or grayed out. Since a user can be associated with multiple capabilities, the user’s rights are the total of all the user’s rights in all the user’s capabilities. Important Administrators in the administrative client are admins in the File Access Manager website as well. Administrators in File Access Manager website, on the other hand, are not automatically administrators in the administrative client. ### Role-Based Access Control Capabilities can be created and configured to fit your needs. This is best done during the File Access Manager installation phase. Note Except as stated above, capabilities apply only to the interface in which they are assigned. At least one super user (a user with the capability of Administrator) should be defined as an Administrator, with access to both the File Access Manager Administrative Client and File Access Manager website systems. You must first define an Administrator with the assigned capability of Administrator in the File Access Manager Administrative Client before that Administrator can access File Access Manager website. After logging into the File Access Manager website, an Administrator can assign different capabilities to users in the File Access Manager website. This is done by completing the steps below. In the Administrative Client: 1. Log in as the system user. 1. Create administrator user or users. 1. Log in as an administrator user. 1. Change the system password. 1. Optionally, you may now go the File Access Manager Database and create custom capabilities. In the File Access Manager website: 1. Log in as an administrator user. 1. Assign user access within the web client. 1. Manage capabilities by assigning functionality and screen access 1. Manage user scope by defining the applications and directories a user is allowed to access. Return to the Administrative Client if you want to complete the optional step of assigning user access, including roles (assigning functionality) and data roles (defining valid applications), within the Administrative Client. ### Security Objects The File Access Manager security objects include: - User - Role - Data Role # Capabilities (Web Client) Capabilities in the File Access Manager website determine what pages and actions the users can access in File Access Manager. Capabilities are groups of rights, where a right grants access to an action or a particular page. By assigning a capability to a user, the user is given these rights. File Access Manager comes with several capabilities configured out of the box and more can be configured with SailPoint professional services to meet your needs. ## Basic Rights Granted to All Users There are a set of basic rights granted to all users. These rights cannot be revoked. - Make access requests. This right can be turned off in the settings. - View access reports that have been generated for them. - Respond to certifications, access request approvals, and manual fulfillment tasks assigned to them. ## System Capabilities The capabilities below are shipped with the default configuration of File Access Manager. You can create custom capabilities to fit your needs. Warning The system capabilities described below should not be removed or modified. ### Auditor The auditor capability is designed for users who perform internal audits and assist in external audits of user access information within the organization. #### Rights - See and manage all reports. - See and run the forensic screens. - Delete report templates. #### Scope The Auditor capability is assigned **Full Scope** by default. This allows users in this capability to see and run reports on all resources. It does not allow the auditor users actions that require specific resources assigned to them. This capability does not have permission to delete query results from the Activity Forensics screen. ### Data Owner This is a capability automatically associated with anyone assigned as an owner of any business resource. Users who are assigned this role are the data owners of all the resources in their scope. #### Rights See and manage user access information around business resources in their scope ### Compliance Manager #### Rights - Configure and manage certification templates and campaigns. - Configure data classification policies, rules, and policy objects. - View data classification forensics - this does not include Activities. - See and run most reports. This role does not have the right Report Template Administrator. See [Special Rights](#special-rights). #### Scope The Compliance Manager capability is assigned **Full Scope** by default. This allows users in this capability to see and run reports on all resources. It does not allow the compliance manager users actions that require specific resources assigned to them. ### Administrator The administrator has all the rights in File Access Manager enabled, except for **Reviewer**. See [Special Rights](#special-rights). #### Rights - View the administrator dashboard and statistics. - See and manage user access information for all business resources. - Configure and run data owner election processes. - Configure settings for the File Access Manager website. - Access rights granted to anyone with Administrator capability in the File Access Manager website or File Access Manager Administrative Client. - The Report Templates Administrator right. See [Special Rights](#special-rights). #### Scope The Administrator capability is assigned **Full Scope** by default. This allows users in this capability to see and run reports on all resources. It does not allow the administrator users actions that require specific resources assigned to them. The table below shows a high-level description of default capabilities, which are set with rights to access the indicated screens. | Screens | Administrator Capability | Compliance Manager Capability | Data Owner Capability | Auditor Capability | | ---------- | ------------------------ | ----------------------------- | --------------------- | ------------------ | | Dashboard | ✓ | | ✓1 | | | Resource | ✓ | | ✓ | | | My Tasks | ✓ | ✓ | ✓ | ✓ | | Reports | ✓ | ✓ | ✓ | ✓ | | Compliance | ✓ | ✓2 | | | | Forensics | ✓ | ✓3 | ✓ | ✓ | | Goals | ✓ | | | | | Settings | ✓ | ✓4 | | | 1 Data Owners see a limited version of the dashboards that is relevant to the capability. 2 The Compliance Manager cannot access the Alert Rules under the Compliance menu. 3 Compliance Managers have access to the Data Classification Forensics page only. 4 Compliance Manager access to the Settings screen is limited to the Access Certification Message Template. For a full description of the rights set per capability, see the **web_permission** table in the File Access Manager database. The capabilities in your system can be modified and new capabilities added by the administrators and implementation teams, so your implementation may differ from the table above. ## Special Rights ### Report Templates Administrator The right **Reports > Report Templates > Report Templates Administrator** is an administrator-level right. A user with this right can do the following: - View all report templates - Delete report templates - Share report templates ### Reviewer The reviewer is a central part of the review process involving Access Certification and Access Requests. The Reviewer right enables the user to approve access requests for resources that are in their scope, and the responsibility to review and approve the access certification process. This right is not included by default in the Administrator capability. The Data Owner and Reviewer are not necessarily the same entity. The Data Owner capability has the Reviewer right by default, but you could define a separate capability with the Reviewer right that is not a Data Owner. ## Viewing Capabilities To view the existing capabilities, go to **Settings > Capabilities > Current Capabilities**. A list of all the capabilities shows users and user groups associated with each capability. These include the system's out of the box capabilities and any custom capabilities created by the users. - To filter a single capability, select a capability from the dropdown options. - Filter a user or user group by typing a letter - not necessarily the first letter - in the name of a prospective user or group. The output is filtered as you type, removing users from the lists of each capability. Additional custom permission changes can be added with the assistance of SailPoint Professional Services or partners. ## Adding Capabilities to a User or Group (Web Client) To add a user account to a capabilities list: 1. Go to **Settings > Capabilities > Capabilities panel**. 1. Select the type of account: **Group** or **User** account. 1. Search for a user or group in the Account search box. 1. Select a capability from Capability dropdown box. 1. Select **Add** to add the selected user to the selected capability or select Clear to clear your choices. 1. Select **Add** to add the user-capability selection to the capabilities list. When you have added users to the list successfully, the system displays “Users added to the list” in green for five seconds. ## Removing a User Account from a Capabilities List (Web Client) 1. Go to **Settings > Capabilities > Capabilities panel**. 1. Find the account to remove and select the **X** icon in the Actions column. 1. Confirm or cancel the deletion. When you have removed users from the list successfully, the system displays “Users removed from the list” in blue for five seconds. ## Adding a Right to a User (Web Client) Adding a right to users is similar in concept to adding permissions to users in the File Access Manager Administrative Client. Note Capability management activities such as listing rights in each capability, adding rights to capabilities, and creating new capabilities are performed in the database. These permission changes can be added with the assistance of SailPoint Professional Services or Partners. 1. Identify the right according to the path within the application to the screen, panel, button and/or functionality to which we want to define the right. 1. Assign the user a capability that has this right, using one of the following methods: | Method | Database | Web Client | | --------- | --------------------------------------------------------------------------------- | ---------------------------------------------- | | 1 | Find a capability that has this right. | Assign the capability to the user. master | | 1 results | This adds all the other rights in this capability to the user as well. master or | | | 2 | Add this right to an existing capability. | Add this capability to the user, if necessary. | | 2 results | The added permission is granted to all users that have this capability. master or | | | 3 | Create a new capability that includes this right. | Add it to the user. master | # Creating and Deleting Users This section describes the process of managing users who are assigned administrative roles either in the administrative client or in the web client. User management includes the following: - Listing users - Creating or modifying users - Deleting users ## Listing Users The Users section in the File Access Manager Administrator Guide is under the Applications > Configuration menu. 1. In the Administrative Client, go to **Applications > Configuration > Manage File Access Manager Permissions > Users**. 1. Double click on a user or select **Edit** to view their details. 1. A window with the user’s details displays with the following data fields: - Username - A unique user ID. For users who must authenticate to AD, this must be identical to the AD user name in the authentication store. - Full Name - The user's full name - Description - The user's description - Log in Timeout - Inactivity logoff timeout - Suspended - A flag to internally suspend the user - Password - This is required to identify internal users - Is AD User? - Checking this checkbox grays out the password fields and marks the user for AD authentication - Connected AD User - Internal users must be associated with an AD account to be able to generate reports and access the business user portal. When the account name is set here, the internal user is associated with the AD account permissions and email address. Notes In addition to these fields, roles, or functions, can be associated with users and data roles so those users can view information on applications. By default, users are associated with the All data role, which grants access to all applications 1. Enter any needed changes in the relevant fields. 1. Select **Save** to save the changes or **Cancel** to return the user’s details to their prior state. 1. The Users window displays. ## Creating Users To create users in File Access Manager, perform the following steps: 1. In the Administrative Client, go to **Applications > Configuration > Manage File Access Manager Permissions > Users**. 1. Select **New** to add a new user. An empty user details window displays. 1. Enter the information for each field listed in the List Users section. 1. Select **Save** to save the information and return to the Users window or **Cancel** to return to the previous window. ## Deleting Users To delete users from File Access Manager, perform the following steps: 1. In the Administrative Client, go to **Applications > Configuration > Manage File Access Manager Permissions > Users** to open the Users window. 1. Select a user to delete. 1. Select **Delete**. 1. Select **Yes** to delete or **No** to cancel the deletion. Warning Deleting users is irreversible. # Managing Roles Roles are a way to assign permissions to users in the File Access Manager Administrative Client. Role management includes the following tasks: - Creating and modifying roles - Deleting roles - Assigning users to roles In the Administrative Client, go to **Applications > Configuration > Manage File Access Manager Permissions > Roles** A Roles window displays, listing the role names and descriptions. Note Roles are called “capabilities” in the File Access Manager website, and are managed separately. ## Creating or Modifying Roles To create or modify roles, complete the following steps: 1. In the Administrative Client, go to **Applications > Configuration > Manage File Access Manager Permissions > Roles** to open the Roles window. 1. Select **New** or choose a role and select **Edit**. The role data window opens. Fill in the relevant fields, moving permissions between the Available Permissions list and Role Permissions list as desired using the move buttons **>**, **\<**, **>>**, and **\<<**. - Role Name - The role unique identifier. - Description - The role description. - Role Users - Add or remove users from the role. - Permissions - Add or remove permissions from the role. Permissions can be associated with multiple roles. 1. Select Save to save the changes or Cancel to retain the role details before making changes. ## Adding Roles to a User (Administrative Client) To add or remove a role from a user, complete the following steps: 1. Open the Edit User panel. 1. In the Administrative Client, go to **Applications > Configuration > Manage File Access Manager Permissions > Users**. 1. Select the user to update. 1. Drag roles between the Available Roles list and the User Roles list. 1. Select **Save** or **Cancel**. ## Adding a Permission to a User (Administrative Client) Permissions are listed as the path within the File Access Manager Administrative Client. To add a permission to a user, you must first identify the permission in the list of available permissions. The following example demonstrates granting a user permission to configure responses for activities. 1. Identify the permission path within the File Access Manager Administrative Client. The path for accessing this screen is:\ **Admin Client > Applications > Configuration > Activity Monitoring > Responses> Manage Responses**. 1. Identify this permission in the list of permissions by drilling into the detail of any role in **Applications > Configuration > Manage File Access Manager Permissions > Roles** and checking the Role Permissions list. This is the list of permissions that are assigned to the selected role. Note that the permission window can scroll to show longer permission paths. In this case, the closest permission is **Applications > Configuration > Activity Monitoring > Responses**. 1. Once identified, you can add this permission to a user in one of three ways: - Find a role that already has this permission, and assign the user to this role. - Add this permission to an existing role, and verify that the user has this role. Note that this permission will be added to all users with this role. - Create a new role that includes this permission and add it to the user. ## Deleting Roles To delete roles, perform the following steps: 1. In the Administrative Client, go to **Applications > Configuration > Manage File Access Manager Permissions > Roles**. 1. Select a role to delete. 1. Select **Delete**. A Confirmation window displays. 1. Select **Yes** to delete or **No** to cancel the deletion. Warning Deleting roles is irreversible. # Scope The scope determines what applications and resources a File Access Manager user can access and run reports on within the application. ## Assigning Scope to Users Scope is assigned to users in the administrative client by assigning a data role to them. Data roles can be defined in terms of applications that the user has access to. See details below. User scope can be assigned to users in the web client. Data scope can be defined in terms of folders within an application that the user can access. See [User Scope - Web Client scope](#user-scope-web-client-scope). ## Data Role - Administrative Client Scope A data role lists the applications that a user can access in the File Access Manager Administrative Client. ### Managing Data Roles Users can be associated with one or more data roles, and are able to access all the applications in every data role with which that user is associated. User access to data roles - The user’s ability to query applications, such as Activities or Permissions, visible in the resource tree. ### Listing and Deleting Data Roles To list data roles, perform the following steps: 1. In the administrative client go to **Applications > Configuration > Manage IdentityIQ FAM Permissions > Data Roles**. 1. The Data Roles window displays. 1. To delete a data role, select a data role and select **Delete**. ### Creating and Modifying Data Roles To create or modify data roles, perform the following steps: 1. In Administrative Client, go to **Applications > Configuration > Manage IdentityIQ FAM Permissions > Data Roles**. A Data Roles window displays. 1. Select **New** to create a new data role. 1. Select **Edit** to edit an existing data role. 1. Fill in a name and description for the data role. 1. Create a list of applications that this data role is allowed to access by selecting applications from the **Available Applications** column and moving them to the **Data Role Applications** column. ## User Scope - Web Client Scope ### Assigning User Scope to Users There are several ways of assigning scope to users in the File Access Manager. - Administrators are assigned the Full Scope resource allocation (see below) automatically when they are assigned the Administrator capability. - Bulk assignment of user scope, using Import User Scope (see below). ### The Full Scope Resource Allocation - The Full Scope resource allocation is an administrator-level allocation, to allow broad view and general system-wide statistics of the business resources. - Full Scope is added automatically to Administrator users. It can also be added through the user scope import **Settings > Capabilities > Import User Scope**. - You cannot remove the Full Scope capability from users who are Administrators, even by using Import User Scope. To create an administrator that has less access than Full Scope, clone the Administrator capability and upload the required coverage using User Scope Import. #### What It Allows Access to all resources in the dashboard and reports. #### What It Does Not Allow - Users with Full Scope who are assigned with the Data Owner capability are not data owners of the entire scope, but only of any user scope that is allocated to them specifically. This includes approving data owner requests, approving access requests, etc. See [Business Resource Owners](https://documentation.sailpoint.com/fam/help/administrator_guide/business_resource_owners/index.html#business-resource-owners). - Drilling down from statistics in the Data Owner Dashboard allows you to view only the resources to which this user has direct allocation. This means that in some cases, drilling down from a chart on the dashboard will display detailed charts of the partial scope that do not add up to the totals that were on the dashboard charts showing the full scope.\ If an admin user has no directly allocated resources, the user receives an error message and an empty chart. ### Importing User Scope Users can be assigned resources in bulk, using a one time or scheduled import process. The list of users and scopes assigned to them are input when configuring the Data Source within the website under **Admin > Data Sources**. The data source could be any of the supported data sources, such as an Excel file or database table. The upload process setup includes mapping the source data fields to the File Access Manager user scope fields. Note The Import User Scope functionality supports changes and adjustments to existing scopes. New imports do not override existing scopes and manually-set data owners, but will retain or adjust the existing scope assignments based on the specified action. There is an Action field that displays one of four possible values: - Add - adds the resource to the User's Scope. This action can either have a full scope or a resource. If a resources is specified, the full scope is ignored. If a resource is empty, the full scope field must be true. - Remove - removes the resource from the User’s Scope. This action can either have a full scope or a resource. If a resources is already specified, the full scope is ignored. If a resource is empty, the full scope field must be true. - Clear - removes all resources from the user’s scope. This command does not need any data specified in the Application or Resource Full Path columns. This operation removes all resources from the users scope. This action can only have Full Scope set to True. - Data Owner - functions in the same way as Add, but also adds the Data Owner capability to the user if they do not have it already. If the user already has the Data Owner capability, the Data Owner action simply functions as Add. This action cannot have a full scope. It must have a resource. Full scope is ignored and if the resource is empty, the line will be ignored as well. **To import user scope:** In the File Access Manager website, create a data source that contains the users and scope fields. See [Creating Data Sources](https://documentation.sailpoint.com/fam/help/administrator_guide/data_source_types_and_usages/index.html#creating-data-sources) for a description on creating data sources. Mapping the input fields is done at a later stage. The names of the fields and any additional fields in the input data source won’t affect the input process. When setting the **Full Scope** parameter to True, the record cannot contain other parts of resources, such as Application Name and Full Path, since it already contains all paths and applications. The input source should contain the following information: | **Input field** | **Description** | | ---------------------- | ------------------------------------------------------------------------------------------------- | | Application Name | Name of the application as it appears in File Access Manager | | Full Path | Full path of the resource | | Full Scope | True/False toggle for granting the user full scope access to all resources in File Access Manager | | User Domain, User Name | Domain and user name of the user receiving access | | Action | Actions related to resources, including Add, Remove, Clear, and Data Owner. | **Setting up the import process**: 1. In the File Access Manager website Go to **Settings > Capabilities > Import User Scope** to open the **Import User Scope** page. !!! note There is an Excel template file within the website that is there to serve as a basis for the data source. There are explanations about the different actions within the template file. Select the provided link within the Import User Scope display for this preferred method. 1. Select the data source from the dropdown list. This list contains data sources created in the administrative client. 1. Map the fields in your file to the File Access Manager fields listed on the panel. 1. Set the frequency of running the upload process. 1. Set the recurrence parameters to Once or Periodically. 1. Select **Save** or **Cancel** to exit. Adding or removing of the full scope will take affect the next time the user logs in. To force a user login, close the application and wait ten minutes for the system to time out and log the user out. # Permissions This section describes the File Access Manager permissions and the operations available under the Permissions menu in the Administrative Client and Forensics menu within the website. ## General Many of the key File Access Manager Permissions use cases involve every aspect, from gaining visibility to actual active involvement of management in permission reviews. Permissions describe the access that a specific User or Group must a specific Business Resource. Examples of permissions include: - Mary Jones has Read access to the Finance folder directly - John Smith has Write access to the Finance folder because he is a member of the Finance AD Group - Larry Taylor has Write access to the Finance folder directly because he is a member of the Admins AD Group Atypically, a permission may also include an Allow/Deny modifier. ### Permission Modeling Basic rules are used to model permissions from various systems into a single coherent view. Every permission consists of a combination of the following four elements: - User - Group - Permission - BR Not all components are required for all permissions, since some systems provide direct permissions to users, while others only enable permissions through groups. ### User The user is an object that represents an account associated with a permission. Standard user attributes include: - User type - User, orphan, or local. - User disabled / enabled - Whether the user account is enabled or disabled in the managed application or the identity store. - User domain - The security domain in the identity store in which the user is defined. For example, you can define the identity store as an Active Directory forest, in which you define the User in one of the domains of the forest. User data is commonly part of an identity collector connected to a relevant identity store. For example, when an identity store is set as an organization's Active Directory, extended attributes may be Department and Manager. ### Group A Group is a container of users that represents a Group, Responsibility, or Profile. Some endpoint systems only set permissions through groups. Standard Group attributes include: - **Group Type** is often provided in accordance with the group type, depending on the type of endpoint system. For example: SharePoint local groups - "SharePoint group" - **Group Domain** is the security domain in the identity store in which a group is defined. For example, the identity store is an Active Directory forest, with the Group defined within one of the forest domains. ### Group Nesting Normally, it is possible to nest Groups (one group resides within another group). For example, assume that Group A contains both User A and User B. If Group A is also a member of Group B, then it follows that Group B also contains User A and User B. File Access Manager examines all nested groups when it analyzes which entities are effective group members for a given group. ### Permissions Permissions are functions enabled, or denied to, a user or group. Permissions are identified for out-of-the-box supported systems. The standard permission attributes (that provide context) include: - **Permission Type** - the function name - **Access Control List (ACL) Allowed** - Allow/Deny - **Is Inherited** - defined locally or inherited Note “Is Inherited” is crucial to Permission queries, since it eliminates permission duplication by showing only unique permissions. ### Owner Permission Most permission mechanisms utilize a special Owner permission type. Typically, the Owner permission cannot be blocked, revoked, or customized, and provides full access rights. Different applications and permission mechanisms may interpret Owner permission differently. The table below describes the permission types that File Access Manager treats as an Owner permission. For each platform, the Owner permission is defined and named (queried by the listed name in the AFM query filter controls). | | | | ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Permission Scheme** | **Description** | | Microsoft ACL | Microsoft Access Control Lists contain a special field that indicates the owner user/group) of the resource (for example, a file or a folder). There can be only one entity defined as the Owner (but that Owner can be a group). Since an Owner has full control of the ACL, the Owner effectively grants all permissions. The Microsoft ACL Owner applies to: - Windows File Server - Active Directory - Microsoft Exchange / Microsoft Exchange Online - NetApp - CIFS - EMC Celerra - CIFS - EMC Isilon - CIFS | | Unix | When a file(/folder) is created in Unix/Linux, its creator is automatically set as the Owner. Permissions are categorized by: - Owner - Users in the Owner’s group - Other Users There can only one owner user and one owner group per file/folder. Since only the Owner (or root) can change file permissions, an Owner effectively grants all permissions. The Unix file system Owner applies to: - NFS (when using Unix permissions, but not NFSv4 ACLs) - NetApp - NFS - EMC Celerra - NFS | | SharePoint | A SharePoint server features Site Collection containers, which function as separate entities, and permission scopes. Different Site Collections may have different users, groups, and permission types. One or more users in a Site Collection may be defined as a Site Collection Administrator. The Administrator has full control of the resources in the Site Collection’s inner structure. The SharePoint Site Collection Administrator applies to: - Microsoft SharePoint - Microsoft SharePoint Online - Microsoft OneDrive | | Cloud Storage Providers | Typically, cloud storage providers include a permission type named “Owner” which grants full access rights to the resource (file, folder etc.). The generic “Owner” permission is employed in: - Box.com - Dropbox - Google Drive | ### Business Resource A business resource (BR) is a monitored application object, such as a folder on a file server, a site on SharePoint, or a mailbox on Exchange. Business resources can have child BRs, and can inherit permissions from a parent resource. Standard business resource attributes include: - **Name** - the name of the resource - **Full Path** - the path with all its hierarchy levels (a unique business resource identifier, for example C:\\Finance\\CTO) - **Inherits Permissions** - a flag identifying whether or not a business resource inherits permissions In cases of applications which support file level permissions, the business resource tree will include BRs on a file level, where: 1. The application is configured in the setup to includes file level permissions 1. The file has unique permissions, compared to its parent nodes. ### Inheritance While inheritance can make management easier, it also can result in unnecessary duplication. Permission analysis analyzes inheritance by determining whether a business resource inherits permission, and whether a specific permission is inherited. The table below lists the relationships involved in permission analysis. | **Business Resource Inherits Permission** | **Permission is Inherited** | **Result** | | ----------------------------------------- | --------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | True | True | **The permission is not unique** and derives from the father permission. | | True | False | **The permission is unique** and even though the business resource inherits permissions, the specific permission is not inherited. This is a common scenario in NTFS. | | False | False | The permission is unique. | | False | True | The permission is unique. | Note The last case in the table is a situation that occurs in a few specific end systems (as it is logically inconceivable). For example, the system enforces SharePoint Policy Rule Permissions from the Web application level. Therefore, even if the business resource does not explicitly inherit any permissions, permissions are still inherited. ### Permission Examples The table below lists examples of the results of combining specific permission elements. | **BR** | **Permission** | **User** | **Group** | **Result** | | -------- | -------------- | -------- | --------- | ---------------------------------------------------------------- | | Folder X | Read | Asmith | Group1 | User Asmith has read permission on Folder X derived from Group1. | | Folder X | Read | Asmith | | User Asmith has a direct read permission on Folder X. | | Folder X | Read | | Group1 | Group1 has read permissions on Folder X. The group is empty. | ## Permission Capabilities Overview This section describes the Permission capabilities available, including: What-If Scenarios Access Certification Access Requests ### What-If Scenarios “What-If” is a component that simulates the addition or removal of users to and from groups. The output contains the resources and permissions for which the user loses or gains permissions. ### Access Certification Access Certification is a component that manages permission review campaigns. These campaigns fine tune user permissions by enabling managers, data owners, or other relevant personnel to review user current permissions. ### Access Requests File Access Manager can accept, process, and manage user requests and provide users with access to certain system resources. The Access Request module manages and controls the access request process. ### Fixing Faulty Permissions Faulty permissions may occur in CIFS-based applications, where: - Permission set on a parent Business Resource is not inherited by sub-resources, although inheritance is configured. - A Business Resource includes an inherited permission, which is missing on the parent Business Resource. Contact the SailPoint support team for assistance in configuring File Access Manager to identify and fix faulty permissions. # Access Requests With Access Requests, users can: - Request permission to perform operations on an application (consisting of a business resource and a permission type) - Join Identity Collector groups Administrators use access requests (which are part of the access certification process) to revoke access to, or change permissions for, BRs. When reviewers revoke a permission as part of an access certification campaign, an access request can be created to determine whether revoked permissions should be removed. Reviewers follow the same process as they do for an Access Certification. File Access Manager can also fulfill access requests automatically. At the end of the access request process, the system sends an email to the original requester to notify him or her of the final status of the request. Note Even if the request was created on behalf of a different user, the originator will receive the email notification. Refer to [Review Process](https://documentation.sailpoint.com/fam/help/access_certification/creating_campaign/review_process.html#review-process) for additional information on the review process as it affects Access Requests. ## New Access Request Wizard Users can initiate an access request using the New Access Request Wizard. This wizard is available using the **New Access Request** button, which is accessible from any screen in the web application. See the chapter *New Access Request Wizard* in the *User Guide*. If required, this functionality can be disabled for all users, as part of the setup process. ## Access Request Template An administrator must create a review process for the application or identity collector to which a user requested access. This can be a multiple level process, with one or more reviewers at each level. Afterwards, the administrator creates an access request template to indicate which request process to use in granting permissions. For each review process, the administrator configures the capabilities and fields available to requesters and reviewers in the review process. ## Creating an Access Request Template To create an Access Request template, perform the following steps: 1. In the administrative client, go to **Permissions > Access Requests > Configuration > Manage Access Requests Templates**. 1. Select **New**. The Access Request Template displays. 1. Enter a unique name in the **Name** field. 1. Select a review process from the **Review Process** dropdown menu. 1. Select the applications/identity collectors in the available fields list to be moved to the **Chosen** list, using `>` or `<`. Notes The available objects depend upon the selected review process. - A static identity collector review process will display all applications/identity collectors. - A dynamic one will display the identity collector itself or will only display applications associated with the review process identity collector. - A dynamic application review process will display only the selected application. This section includes the list of applications and identity collectors included in this template (updated according to the selected review process). Notes - Application and Identity Collectors can only be associated with one access request template. - Applications and identity collectors that are already associated with an access request templates do not display in the list of available objects. 1. **Maximum Duration** is the maximum time for management of an access request, after which the system highlights the request to indicate an expired duration. 1. **Fulfillment** adds a fulfillment step for the permissions to the access request. Refer to [Access Fulfillment](https://documentation.sailpoint.com/fam/help/administrator_guide/permissions/access_fulfillment/index.html#access-fulfillment) for additional information. Select the fulfillment method: - **None**: The access request will end after the last reviewer in the review process has reviewed all the request permissions, without a fulfillment step. - **Fulfill Access Requests**: The review step will be followed by a fulfillment step, depending on the business resource type and manual fulfillment type selected: - **Managed BRs**: Fulfillment is handled automatically by File Access Manager. - **Unmanaged BRs**: Selecting **File Access Requests** will open a drop-down list to select the **Manual Fulfillment Review Process** - a one-step review process defining the user or group responsible for the fulfillment process. Note If selecting Fulfillment, **Bypass review process when a Data Owner issues a Revoke request** will display. If this option is selected, an additional review process will not be triggered if a data owner directly revokes access from a user on this resource. - **Custom Script**: The review step will be followed by a fulfillment step, depending on the business resource type and manual fulfillment type selected: - **Managed BRs**: Fulfillment is handled automatically by File Access Manager. - **Unmanaged BRs**: Fulfillment is handled by a script prepared by the user. See [Access Fulfillment for Unmanaged BRs](https://documentation.sailpoint.com/fam/help/administrator_guide/permissions/fulfillment_permission_changes.html#access-fulfillment-for-unmanaged-brs) for a full description of fulfillment using a user script. Note The system only displays single-level review processes. 1. Select **Next**. The **Review Data Fields** window displays. Note The Reviewer Data Fields display what the reviewer will see when reviewing permissions. All built-in fields display, and the relevant Identity Collector fields do not display if you selected an Identity Collector. 1. Select the fields in the **Available Data Fields** to be moved to the **Review Data Fields** list, using `>` or `<`. 1. Select a field, and use the **up** and **down** arrow keys above the **Review Data Fields** list to change the order of the Reviewer Data fields. The fields will display to the user in the order selected in the **Reviewer Data Fields** list. 1. Check the **Display the same fields in the File Access Manager client** checkbox to display the same fields in the administrative client as displayed in the Web interface. Note The administrator may want to provide the user of the Web interface with fewer fields if it is not necessary for the user to view all the fields. 1. Select **Finish** (only if you checked the checkbox). This will appear in the web client at **My Tasks > Access Request** on the web application. 1. If you do not check **Display the same fields in the File Access Manager client**, the **Administrators Data Fields** window displays, so the administrator can select a list of data fields that differ from the list of the Reviewer Data Fields. 1. Select **Finish**. ## Managing Requestable Permission Types This feature allows an Administrator to determine which permission types will be available to users who request access to specific application types. Note The list of available permission types for managed resources cannot be modified. If you add requestable permission types for a resource type, it will take affect only for non-managed resources i.e. only resources that take the manual fulfillment path. To manage requestable resources: 1. In the administrative client, go to **Access Requests > Configuration > Manage Requestable Permission Types**. The Manage Requestable Permission Types window displays. 1. Select an application. 1. Select **Edit**. The Edit Requestable Permission Types window displays. 1. Select permission types from the Available (left) pane, and use the arrows to place them in the Chosen (right) pane. Note You can also move the default Chosen permission types to the Available pane so that they are not displayed to users. 1. Select **Save**. 1. Expand the resource tree. 1. Select a resource. 1. Select **Add**. The selected resource is displayed in the right pane. Notes - The right pane displays a Path column, which displays the full path of the selected resource, an Include Sub-Resources column with a checkbox to include (or not) the sub-resources of the selected resource, and an Action column with an option to remove the resource. - There is an option to add a label to easily identify the right resource to request. 1. Select a business resource from the Available (left) pane, and use the arrows to move them to the right pane, where you can decide whether to include their sub-resources or remove them. 1. Select **Save**. Note If you select New to create a new requestable resource, any saved applications will no longer be available in the Application selection, but will be available for editing. 1. Select **Edit** to edit the resources within the displayed applications or **Delete** to delete the application’s requestable business resources. When an application is deleted, all its business resources will be available for a user making an access request. ## Managing Requestable Resources This feature allows an Administrator to determine which resources will be viewable by users who request access to resources. To manage requestable resources: 1. In the administrative client, go to **Access Requests > Configuration > Manage Requestable Resources**. The Manage Requestable Resources window displays. 1. Select **New** or select an application, and select **Edit**. The Requestable Resources for Application window displays. 1. Select an application. 1. Expand the resource tree. 1. Select a resource. 1. Select **Add**. 1. The selected resource is displayed in the right pane. Notes - The right pane displays a Path column, which displays the full path of the selected resource, an Include Sub-Resources column with a checkbox to include (or not) the sub-resources of the selected resource, and an Action column with an option to remove the resource. - There is an option to add a label to easily identify the right resource to request. 1. Select a business resource from the Available (left) pane, and use the arrows to move them to the right pane, where you can decide whether to include their sub-resources or remove them. 1. Select **Save**. Note If you select New to create a new requestable resource, any saved applications will no longer be available in the Application selection, but will be available for editing. 1. Select **Edit** to edit the resources within the displayed applications or **Delete** to delete the application’s requestable business resources. When an application is deleted, all its business resources will be available for a user making an access request. ## Configuring Reminders To set reminders for access requests: 1. In the administrative client, go to **Access Requests > Configuration > Configure Reminders**. The Access Requests Template Reminder displays. Note The Access Requests template reminder sends bulk emails to reviewers regarding all access requests pending their review. 1. Select the **Send Reminder Mail** checkbox. An empty email template displays. 1. Enter free text in the email template and transfer information from the fields displayed in the Fields box to the right of the email template. 1. You can use the following fields either in the subject or in the body of the email, or in both locations: - Pending Requests - these pending requests are per reviewer. - Reviewer Display Name - this is the display name, and not the unique user name. - Reviewer Account - this is the unique user name. 1. Select **Next**. The Reminder Email Scheduler displays. 1. Select the **Create a Schedule** check box to create a schedule. 1. Fill in the Name, Schedule, On (date), and At (time) fields with the relevant information. 1. Select **Finish**. ## List Access Request Templates To view a list of Access Request templates, perform the following steps: 1. In the administrative client, go to **Access Requests > Configuration > Manage Access Requests Templates**. 1. Right-click any of the Access Request templates to open an editing option menu: - Edit template - Delete template - Copy Cell Content ## Overview of Access Requests The *Access Requests* screen centralizes all access requests in the system. It contains a filter mechanism, a main data grid (with displayed access requests) and a toolbar for the Actions, Reports, and Configurations menus. This section describes how to list, view, and reassign access requests. The main access request data grid contains the following information for each access request: The main access request data grid contains the following information for each request: - # (assigned by the system) - ID - Type - Status - Application - Origin - Issued By - Review Conclusion - Progress - Fulfillment Status - Issued At - Due Date To access the Access Requests panel, go to **Permissions > Access Requests**. The default view of the navigation filter displays pending access requests, issued in the past seven days. Filter the list of access requests first, and then select one or more access requests from which to drill down to more information. ### Filtering Access Requests Note Not all fields are mandatory. 1. Select an ID for the Access Request. 1. Select one of the following campaign statuses to display from the **Status Field** dropdown menu: - Pending Creation - access request has not been created - Pending - access request is pending - Closed - all access review processes have finished - All - all access requests 1. Fill in the following Access Requests fields: - Due Date - Application - Origin (the campaign in which the permission was revoked) - Issued By - Issue Date Note These fields are static and filter revoked permissions. 1. Fill in the following Advanced fields: - Resource - User - Permission - Group Note These fields are dynamic and the fields displayed may differ from those listed above. 1. Select **Apply** to apply the selected filters or select **Clear Filter** select different filters. 1. The filtered access requests display in the main **Access Requests** screen. 1. Select the **In Summary** expander to view summary charts of all the access requests (which are the same regardless of the selected filters). 1. Three separate access request summaries display: - The summary on the left is a bar graph that shows Open Requests by Due Date. - The summary in the middle lists Pending Access Requests by Reviewer (top 10), as well as the number of review items for each reviewer. - The summary on the right is a pie graph that displays In Process Access Requests by Application. 1. The section under the **In Summary** section lists the selected filtered status. 1. Double-click on a selected access request to view its details. ## Inside Access Requests Filter access requests by: - Pending Permissions by Reviewer (which lists pending permissions by reviewer) - All Permissions (which provides full filtering of all permissions) In addition, it is also possible to reassign permissions or revert the permission review process. The following subsections describe permission filtering, reassignment, and reversion of the permissions review process. ### Viewing Pending Permissions by Reviewer To view pending permissions by reviewer, perform the following steps: 1. To view pending permissions by reviewer, select **Pending Permissions by Reviewer** as the filter view. The reviewers list will be displayed on the right with the number of permissions waiting for them to review. 1. Select **In Summary** expander to see a summary of the campaign’s permissions. Note Since the charts in the In Summary view reflect all the permissions, they will remain the same, regardless of any filter applied. 1. The information on the left displays permissions by review process levels. The pie chart on the right displays permissions by review status (approved, rejected, or pending). 1. You can select **Refresh** to refresh the summary view. ### Viewing All Permissions All Permissions fall into the following filtering categories: - *Permissions* - Standard (fixed) search fields, including: - *Resource*- business resource - *User* - user name - *Permission* - permission level - *Group* - user group - *Rev. Conclusion* - select from All, Rejected, Approved, Pending Conclusion, or Not Relevant. - *Fulfillment Type -* select from All, Automatic, Manual, or None. - *Fulfillment Status* - select from All, Not Relevant (Rejected by Reviewer), Not Fulfilled, Fulfilled, Pending Conclusion, and Not Relevant. - *Level Name* - name of the level - *Dynamic Fields* - Use these customizable fields for additional searching, for example: - Business Resource Name - Department **To view all permissions:** 1. Select **All Permissions** as the filter view. 1. Select each of the Permissions fields, and select an option from the options displayed in the popup window. 1. Select **Apply**. The filtered permissions displays in the Access Request list to the right. 1. Double-click one or more of the entries from the list. 1. Review Process details display, with the following information on that permission: - Level ID - Level Status - Level Name - Reviewer - Response - Time - Comment ### Reassigning Permissions An administrator can reassign a permission review from one reviewer to another reviewer (for any reason). **To reassign a single permission:** 1. Right-click on a permission line from **Reassign Permissions**. 1. Select a user for reassignment of permissions and enter a reason (mandatory). 1. Enter the new reassignment destination and select **Reassign**. **To reassign all permissions:** 1. Go to **Actions > Reassign Permission Review > All Permissions**, and enter a reason (mandatory). The Permissions Reassignment window displays. 1. Enter the new reassignment destination and select **Reassign**. **To reassign multiple permissions:** 1. Press and hold the `Shift` key and select the permissions to reassign. 1. Right-click outside of the highlighted area (on the grid), and then select **Reassign Permissions**. 1. Enter a reason for this action (mandatory). 1. The Permissions Reassignment window displays. 1. Enter the new reassignment destination and select **Reassign**. ### Reverting Permissions An administrator (not a reviewer) can revert permissions to a previous review level. To revert permissions, perform the following steps: 1. Press and hold the `Shift` key and select the permissions to reassign. 1. Right-click and then select **Revert Review Process**. 1. Select the level (for example, Level 1) to which to revert. 1. The Confirmation popup displays, noting the consequences of resetting the review process to a previous level. 1. Select **Yes** to revert or **No** to return to the previous screen. # Permissions Collection Process Permissions Collection is a process that discovers and collects permissions on the BRs (business resources, such as folders) of an application. These permissions are later used and displayed in Permissions Forensics, Access Certification campaigns, Access Requests, and in other locations. The task itself is a Permissions Collection task. The permission collection uses one Permissions Collector Engine and zero or more Permissions Collectors. ## Permissions Collector Collects permissions from the application, usually installed near (network wise) the application itself so it will be easier for it to read the permissions. This service must be linked to exactly one existing Permissions Collector Engine, which will supply the work. By work we mean how to connect to the application and which resources to get the permissions for. **Prerequisites for installation** - There is at least one engine - RabbitMQ is configured ## Permissions Collector Engine There are two configuration modes: 1. With one or more Permissions Collectors. In this case, the engine will give work to the collectors, get all the permissions back from them and write everything to the DB. The Engine and Collectors communicate through the RabbitMQ. 1. Without any Permissions Collectors. RabbitMQ is not relevant in this case. In this case, it acts as both an Engine and Collector. This service is usually installed near the DB, in order to increase the performance of reading / writing the data. ## Configuring and Scheduling the Permissions Collection Permissions can be analyzed to determine the application permissions of an out-of-the-box application, provided you have defined an identity store for File Access Manager to use in its analysis, and you have run a crawl for the application. The permission collector is a software component responsible for analyzing the permissions in an application. The Central Permission Collector Service is responsible for running the Permission Collector and Crawler tasks. If the “File Access Manager Central Permission Collector” wasn’t installed during the installation of the server, this configuration setting will be disabled. To configure the Permission Collection: 1. Go to **Admin > Applications**. 1. Scroll through the list or use the filter to find the application. 1. Select the **Edit** icon on the line of the application. 1. Press **Next** until you reach the **Crawler & Permissions Collection** settings page. The actual entry fields vary according to the application type. 1. Select a central permission collection service from the dropdown list. You can create permissions collection services as part of the service installation process. See section "Services Configuration" in the File Access Manager Administrator Guide for further details. ### Permission Collection Setup Notes for NetApp The permissions are managed either on the NTFS level, or on the Share Level. When the shares are configured with Full Control to Everyone, and all the permissions are defined in the folders, you should select NTFS, which is the default. ### Permissions Comments on Isilon for the CIFS server The permissions are managed on the NTFS level, or on the Share Level (as when the shares are configured with Full Control to Everyone, and all the permissions are defined in the folders, in which case you should select NTFS, which is the default). ## Scheduling a Task 1. Create a Schedule - Select this option to view the schedule setting parameters. 1. Schedule Task Name - Enter a name for the scheduling task. - The system generates a default name in the following format: `{appName} - {type} Scheduler`. - You can override or keep this name suggestion. 1. Select a scheduling frequency from the dropdown list. - Once: Single execution task runs. - Run After: Create dependency of tasks. The task starts running only upon successful completion of the first task. - Hourly: Set the start time. - Daily: Set the start date and time. - Weekly: Set the day(s) of the week on which to run. - Monthly: The start date defines the day of the month on which to run a task. - Quarterly: A monthly schedule with an interval of 3 months. - Half Yearly: A monthly schedule with an interval of 6 months. - Yearly: A monthly schedule with an interval of 12 months. 1. Fill in the **Date** and **Time** fields. These fields differ depending upon the scheduling frequency selected. 1. Select the **Active Check Box** to activate the schedule. Note When scheduling a task, be aware that the default time is in UTC, not local time. 1. Select Next. # Fulfillment of Access Permission Changes There are several scenarios where the system will be required to change a user’s access permissions on a resource: - A user making a direct access request. See [New Access Request Wizard](https://documentation.sailpoint.com/fam/help/administrator_guide/permissions/access_requests.html#new-access-request-wizard). - A campaign, verifying that a user’s existing permissions fit the required permissions Depending on the company’s policies, an administrator may want to review all revoked permissions before making such changes. In this case the system sends approved permission changes, resulting from the review, to the Access Fulfillment process. This process is handled differently for managed, and unmanaged BRs, as described below. ## Access Fulfillment for Managed BRs The system handles access fulfillments on managed BRs automatically, once the requests go through the approval process. ## Access Fulfillment for Unmanaged BRs For unmanaged BRs, the user can either create a custom script for access fulfillment, or create manual process. This manual process includes fulfillment and review using a static, single-level access fulfillment process. Manual fulfillment must be defined to handle unmanaged BRs, either an access request path or an access certification path must first define manual fulfillment on unmanaged BRs. ***To run manual access fulfillment on an unmanaged business resource through the Access Request path:*** 1. In the administrative client, go to **Access Requests > Configuration > Manage Access Request Templates**. 1. Complete the Access Request Template, described in [Creating an Access Request Template](https://documentation.sailpoint.com/fam/help/administrator_guide/permissions/access_requests.html#creating-an-access-request-template). ***To run manual access fulfillment on an unmanaged business resource through an Access Certification path:*** 1. In the Web Client, go to **Compliance > Access Certification > Campaign Templates**. 1. Complete the Access Certification Template, as discussed in [Campaign Templates](https://documentation.sailpoint.com/fam/help/administrator_guide/access_certification_campaigns/campaign_templates.html#campaign-templates). 1. Select either None or Fulfill Permissions Revoke Requests from the dropdown menu in the Fulfillment field. If you selected Fulfill Permissions Revoke Requests in the previous step, select a review process from the Manual Fulfillment Review Process field. Note The system assigns a one-step review process for manual fulfillment to Access requests for non-managed resources and identity collectors. Access Fulfillment Advanced Forensics Control (AFC) Filter, has additional information on forensics control. Different applications and permission mechanisms may interpret Owner permission differently. The table below describes the permission types that File Access Manager treats as an Owner permission. For each platform, the Owner permission is defined and named (queried by the listed name in the AFM query filter controls). | Owner Permission Types | | | ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Permission Scheme** | **Description** | | Microsoft ACL | Microsoft Access Control Lists contain a special field that indicates the owner user / group) of the resource (for example, a file or a folder). There can be only one entity defined as the Owner (but that Owner can be a group). Since an Owner has full control of the ACL, the Owner effectively grants all permissions. The Microsoft ACL Owner applies to: - Windows File Server - Active Directory - Microsoft Exchange / Microsoft Exchange Online - NetApp - CIFS - EMC Celerra - CIFS - EMC Isilon - CIFS | | Unix | When a file(/folder) is created in Unix/Linux, its creator is automatically set as the Owner. Permissions are categorized by: - Owner - Users in the Owner’s group - Other Users There can only one owner user and one owner group per file/folder. Since only the Owner (or root) can change file permissions, an Owner effectively grants all permissions. The Unix file system Owner applies to: - NFS (when using Unix permissions, but not NFSv4 ACLs) - NetApp - NFS - EMC Celerra - NFS | | SharePoint | A SharePoint server features Site Collection containers, which function as separate entities, and permission scopes. Different Site Collections may have different users, groups, and permission types. One or more users in a Site Collection may be defined as a Site Collection Administrator. The Administrator has full control of the resources in the Site Collection’s inner structure. The SharePoint Site Collection Administrator applies to: - Microsoft SharePoint - Microsoft SharePoint Online - Microsoft OneDrive | | Cloud Storage Providers | Typically, cloud storage providers include a permission type named “Owner” which grants full access rights to the resource (file, folder etc.). The generic Owner permission is employed in: - Box.com - Dropbox - Google Drive | # What-If Scenarios The What-If scenarios in File Access Manager use simulations to help predict the effect on a user’s permissions when the user is added to, or removed from, a group (for example, an Active Directory group). ## Running a What-If Simulation To run a What-If simulation, perform the following steps: 1. Open the What-If window in the Administrative Client. 1. In the What-If simulation panel on the left of the screen, select either: 1. Adding a user to a group 1. Removing a user from a group 1. Under Scope, select one of the following: 1. All applications - check the effect of the action on all existing applications. 1. Only Application of Type - select the type of Application to simulate, which will show the results of the simulation for all Applications of the selected type. 1. Specific Applications Only - select only one specific application to be included in the simulation. 1. Under Parameters, select one of the following: 1. Select the group to add or remove under Group. 1. Select the user to add or remove under User. 1. Select **Apply**. The What-If main window displays an Added Permissions Grid in table format for the selected user. ## Table View The table view displays only resources where permission changes occur, and not resources that change by permission inheritance. For example, if adding a user to a group results in giving that user permissions to a specific folder, File Access Manager only displays the folder in which the change occurs, and not all the child folders affected by this change. 1. Select the **>** next to Affected Resources on the left of the Added Permissions Grid to see a tree of the Affected Resources. ## Tree View The tree view displays resources in a color-coded format to help identify where changes occur, since those changes can sometimes be in a deep level of the tree. For example, if you simulate adding a user to a group, which results in giving the user permissions to a top-level folder, File Access Manager only displays the folder in which the change occurs, and not all the child folders affected by their inheriting this change. The color-coding scheme is as follows: - Dark Green indicates the direct addition of permission to a resource. - Light Green indicates the addition of a permission somewhere in the tree below this resource. Follow all light green folders until they lead to a dark green folder, which indicates the direct addition of a permission. - Dark Red indicates the direct removal of permission from a resource. - Light Red indicates the removal of a permission somewhere in the tree below this resource. Follow all light red folders until they lead to a dark red folder, which indicates the direct removal of a permission. Notes - The Added Permissions Grid and the Affected Resources tree views complement one another with the same information in slightly different format. - In the above figures, both views highlight Vss. In the tree view, Vss is dark green (indicating an added permission), and in the grid view, Vss has been added with full control permission. ## Create Access Request After performing a simulation, you can create an access request to fulfill a change, but the request must pass all standard reviews before it is possible to fulfill it. See section [Access Requests](https://documentation.sailpoint.com/fam/help/administrator_guide/permissions/access_requests.html) for additional information on Access Requests. ## Fulfill Now (Bypass Review) The **Fulfill Now (Bypass Review)** option displays to users with a **Bypass review process for access requests** group. This option sends a request that is auto-approved and fulfilled. Section [Access Fulfillment](https://documentation.sailpoint.com/fam/help/administrator_guide/permissions/access_fulfillment/index.html) has additional information on Access Fulfillment. # Access Fulfillment The Access Fulfillment module assists organizations in managing permissions automatically on managed business resources (BRs). The main steps of the access fulfillment process are: 1. A user initiates an access request to receive permissions to a BR. 1. The administrator assigned the relevant approval tasks to all required reviewers. 1. All required reviewers review and approve or deny the access request. 1. File Access Manager automatically fulfills the access request through the relevant Identity Collectors and the Collector Synchronizer service. See section [Review Process](https://documentation.sailpoint.com/fam/help/access_certification/creating_campaign/review_process.html#review-process) for further information about the review process as it affects Access Fulfillment. ## Fulfillment for Managed and Unmanaged BRs Access fulfillment can be initiated by a user’s access request, or as the outcome of a campaign, whereby the systems recommends revoking a user’s access permission. There are several methods for access fulfillment: - Automatic fulfillment using File Access Manager functions. This process works on managed BRs -BRs that underwent a normalization process, as described in the sections below. - Automatic fulfillment using a customer supplied script. This process works on unmanaged BRs only. - Manual fulfillment - the user responsible for the fulfillment will receive a fulfillment task. - The type of fulfillment is determined by the business resource type, and the setting of the Fulfillment type. | Fulfillment field | Managed BRs | Unmanaged BRs | | ---------------------------------------------------------- | ------------------------------------------------- | ------------------------------------------------------------------------------------------- | | None | No action | No action | | Fulfill Access Request / Manual Fulfillment Review Process | Fulfillment processed automatically by the system | Manual fulfillment process. The user performing the fulfillment must mark the task as done. | | Execute Custom Script | Fulfillment processed automatically by the system | Fulfillment processed automatically, calling the custom script for each BR. | ## Supported Applications The system supports Access fulfillment for the following applications: | Target System | Products and Supported Versions | | ------------------------ | ------------------------------- | | Base Product | Microsoft Active Directory | | On-premises File Storage | Microsoft Windows | | | Microsoft SharePoint | | NAS File Storage | NetApp for CIFS | | | EMC Celerra/VNX/Unity for CIFS | | | EMC Isilon for CIFS | | | Hitachi HNAS | | | DFS for CIFS | # Configuring Access Fulfillment The following subsections describe the available actions associated with the Access Fulfillment configuration. ## Configure Access Fulfillment Requests Commit Schedule Commit schedule defines when to run pending normalization requests (which can be during non-working hours so it will not affect end users). To define the Access Fulfillment Requests Schedule, perform the following steps: 1. In the administrative client, go to **Access Fulfillment > Configuration > Configure Access Fulfillment Requests Commit Schedules**. The Access Fulfillment Requests Commit Schedules window displays. 1. In the **Resource Normalization Requests** field, select the day and time for this schedule. Tip Schedule normalization of new managed resources for off-peak hours; otherwise, it might overload the system. 1. In the **Other Fulfillment Requests** field, enter the time cycle in minutes for this schedule. 1. Select **Save**. ## Configure Access Fulfillment Groups Naming Convention This activity configures the naming convention for groups created during the normalization process of a business resource To configure Access Fulfillment Groups Naming Convention, perform the following steps: 1. In the administrative client, go to **Access Fulfillment > Configuration > Configure Access Fulfillment Groups Naming Convention**. The Access Fulfillment Groups Naming Convention window displays. 1. Enter the relevant data in the following fields: - Resource Group Name - Resource Group Description - Template Group Name - Template Group Description Notes - The name must contain the variables `%Seq%` and `%PermType%`. - Template group names cannot contain the variables `%ResName%` or `%ResPath%`. 1. Select **Save**. ## Removing Explicit Permissions from Business Resources Explicit, or direct, permissions can be removed from a Business Resource (BR) without running the normalization process on it. Note This option is only available for BRs that support fulfillment. BRs that do not support fulfillment will not have a Fulfillment tab on the Application Wizard. The following guidelines apply to the removal of explicit permissions: - The application should be configured to support the removal of explicit permissions. - Only explicit permissions (ACEs) can be removed. An ACE is a permission set directly on a resource, which can include any domain user/group, local user/group, special groups, such as Everyone/Authenticated Users, or orphan accounts. Permissions inherited from a parent resource, or granted to a specific user through a group, **cannot be removed**. - Explicit permissions of normalized groups, created and managed by File Access Manager, cannot be removed. - Only Active Directory users with the Administrator capability can remove explicit permissions. ### Supported Applications Access fulfillment for Removal of explicit Permissions is supported for the following CIFS applications: Windows, NetApps, EMC Celerra CIFS, Isilon, and HDS. ### Enabling Removal of Explicit Permissions To enable removal of explicit (direct) permissions on a specific application: 1. Open the configuration screen of the required application. 1. Go to **Admin > Applications** 1. Scroll through the list, or use the filter to find the application. 1. Select the **Edit** icon on the line of the application. 1. Press **Next** until you reach the **Access Fulfillment** settings page. Note The setting pages and entry fields vary according to the application type. 1. Select **Enable Access Fulfillment for Revoking Explicit Permissions**. 1. Select **Next** or **Done** to leave the configuration page. ### Removing Explicit Permissions It is possible to remove explicit permissions in the **Permissions Forensics** page and in campaigns. ### Removing Explicit Permissions in Campaigns 1. Create and save a Permissions Query in the **Forensics > Permissions** screen. 1. Go to **Compliance > Access Certification**: 1. Create a campaign using the Permission Query. 1. From **Summary > Fulfillment Process**, select **Edit**. 1. Select **Fulfill Permissions Revoke Requests**. 1. Select **Save and Run the Campaign**. Access Requests for permission removal are the results of campaign reviewers’ reject decisions. Once the review process for Access Requests is finished, the system removes all direct permissions on supported applications from the relevant BRs. ### Monitoring the Progress of Permission Removal Access Fulfillment is created for each direct permission marked for removal. To monitor progress, in the administrative client, go to Access Fulfillment and filter the Fulfillment Requests by Action “Remove Permission.” ## Access Fulfillment Advanced Forensics Control (AFC) Filter To operate the AFC for access fulfillment, perform the following steps: 1. In the administrative client, go to Access Fulfillment. 1. Select the relevant data from the following dropdown menus in the Fulfillment Request section: - Action (default is “All”) - Status (default is “Not Completed”) - Issued By - Issue Date (Preset or Period) - Request ID 1. Double-click on the field next to each of the field types in the Fulfilled Permission section, and select the relevant data: - Application - Resource - Group - User - Permission Note The selections that open when you double-click on each field display the number of each item, and provide a dropdown menu, in which you can select the number of items to display for each field type. 1. Select **Close** after you have selected each field selection. 1. Select **Apply** to activate the filters or Select **Clear Filter** to clear the filter parameters. ### Access Fulfillment Actions Access Fulfillment actions involves the viewing of fulfillment requests and their statuses. To specify Access Fulfillment Actions, perform the following steps: 1. In the administrative client, go to **Access Fulfillment > Actions**. 1. Double-click on a business resource to view a detailed log of the resource, and to determine (if possible) where an error has occurred. Note A configured user must have Full Control of a business resource to perform normalization on it. 1. Select one of the following actions: - Retry - retry a failed Access Fulfillment Request. - Fulfill Now - ignore the regular schedule and fulfill now. - Cancel Fulfillment - cancel the fulfillment. - Rollback - undo changes caused by a successfully fulfilled access fulfillment request. - Rollback Now - ignore the regular schedule and rollback now. # Enabling Access Fulfillment Access Fulfillment is supported by the following applications: - Active Directory - Windows File Server - SharePoint - NetApp CIFS - EMC Celerra CIFS - EMC Isilon CIFS - Hitachi HNAS - Windows DFS CIFS To enable access fulfillment, the [application has to be enabled for fulfillment](#enabling-access-fulfillment-for-an-application) and the business resources under the application have to be [normalized](#normalizing-a-business-resource). Important Access fulfillment can be used on non-normalized resources for [removal of direct permissions](https://documentation.sailpoint.com/fam/help/administrator_guide/permissions/access_fulfillment/config_access_fulfillment.html#removing-explicit-permissions-from-business-resources). #### Enabling Fulfillment for an Application For applications that support Access Fulfillment only. Configured on the application configuration page. (Admin > Applications. Find application. Select **Edit** button. Change configuration) See [Enabling Access Fulfillment for an Application](#enabling-access-fulfillment-for-an-application) for a full description. #### Normalizing a Business Resource To normalize a resource, open the Manage Resources page (Admin > Applications. Find application. Open the options menu and select Manage Resources) 1. Select the resource to normalize. 1. Select **Manage Normalization > Enable Normalization** for this resource. 1. Define **How to Handle Inexact Permissions Matches**. #### Normalizing a List of Business Resources To normalize a list of resources, use the **Bulk Set** option on the **Manage Normalized Resources** page (See [Adding or Removing Resources in Bulk](https://documentation.sailpoint.com/fam/help/administrator_guide/permissions/access_fulfillment/normalized_resources.html#adding-or-removing-resources-in-bulk)) 1. Open the **Manage Normalized Resources** ( Admin > Applications. Find application. Open the options menu and select **Manage Normalized Resources**) 1. Open the **Global Options** menu and select **Bulk Set**. 1. Upload a list of resources to normalize #### Disabling Normalization for a Resource Select a resource on the **Manage Resources** page, and disable the normalization from the action menu or open the *Manage Normalized Resources* page, and disable the normalization (See [Editing Normalized Resources](https://documentation.sailpoint.com/fam/help/administrator_guide/permissions/access_fulfillment/normalized_resources.html#editing-normalized-resources)) #### Disabling Normalization for a List of Resource For a list of resources use the **Bulk Remove** option on the **Manage Normalized Resources** page. Create a file with a list of resources to disable, and upload them using [Adding or Removing Resources in Bulk](https://documentation.sailpoint.com/fam/help/administrator_guide/permissions/access_fulfillment/normalized_resources.html#adding-or-removing-resources-in-bulk). ## Enabling Access Fulfillment for an Application Access fulfillment is enabled per application in the application setting screen, for applications that support fulfillment (See the compatibility table in Compass for the full list). **To enable Access Fulfillment for an application:** 1. Open the configuration screen of the required application . 1. Go to **Admin > Applications**. 1. Scroll through the list, or use the filter to find the application. 1. Select the **Edit** icon on the line of the application. 1. Press **Next** until you reach the **Access Fulfillment** settings page. Note The setting pages and entry fields vary according to the application type. 1. For non-normalized resources, you can select **Enable Access Fulfillment for Revoking Explicit Permissions**. See [Enabling Removal of Explicit Permissions](https://documentation.sailpoint.com/fam/help/administrator_guide/permissions/access_fulfillment/config_access_fulfillment.html#enabling-removal-of-explicit-permissions). 1. Select **Enable Access Fulfillment for Normalized Groups**. ***Identity Collector*** Fulfillment requires an identity collector in order to run. If you did not select an identity collector in the General Details configuration page, you can select one from the drop down list now. If there is no identity collector defined for this application, or if you want to use a different identity collector than the ones in the dropdown list, you can create a new identity collector in the Administrative Client (**Applications > Configuration > Permissions Management > Identity Collectors**). See Create/Edit an Active Directory Identity Collector for more details on creating an identity collector. ***Managed Group OU (DN)*** The organizational unit in which the managed permission groups will be created. Make sure that the chosen identity collector’s user has permissions to create groups under this location (e.g. OU=FileAccessManagerManaged, DC=SailPoint, DC=COM) OU refers to an Organizational Unit, and DN refers to a Distinguished Name. ***How to Handle Inexact Permissions Matches*** During the normalization process, the application has to decide what to do with permissions that do not match the normalized permissions. - Fail the normalization process - Elevate to the nearest permission match - Revoke the permission 1. Open the Advanced Settings panel for additional settings: ***Group Cache Sync Interval(sec)*** This setting will add a pause to the process of setting normalize permissions on the resource. This will allow the endpoint's local AD groups cache to sync the newly created managed groups. The default Is 0 - signifying the process will not pause by default. ***Use Template Permission Group*** Template groups are created per application and added as a template to every managed resource. These groups are not managed by File Access Manager, and are usually used to ensure that users who need application-wide access such as backup or archiving users have access. Select for each permission group whether File Access Manager should create a group or whether to use an existing group, for the following groups: If you select **Use an Existing Group**, select the required group to use from the dropdown list. Once an application is enabled for access fulfillment, you can set specific resources to be [normalized](https://documentation.sailpoint.com/fam/help/administrator_guide/permissions/access_fulfillment/normalized_resources.html). ## Enabling Access Fulfillment for Business Resources To enable access fulfillment for a resource, it has to meet the following conditions: - The application has to support access fulfillment (see the compatibility matrix in Compass for a full list for this release). - The Application has to be enabled for access fulfillment. This setting is in the application configuration pages. - The business resource has to be normalized. Important Access fulfillment can be used on non-normalized resources for removal of direct permissions. See [Removing Explicit Permissions from Business Resources](https://documentation.sailpoint.com/fam/help/administrator_guide/permissions/access_fulfillment/config_access_fulfillment.html#removing-explicit-permissions-from-business-resources) ### Enabling Normalization for a Resource Note For a list of resources: Create a file with a list of resources to disable, and upload them using [Adding or Removing Resources in Bulk](https://documentation.sailpoint.com/fam/help/administrator_guide/permissions/access_fulfillment/normalized_resources.html#adding-or-removing-resources-in-bulk). 1. Open the Manager Resources page. 1. Go to **Admin > Applications** and find the application. 1. Open the options menu and select ***Manage Resources***. 1. Select a resource and select **Manage Normalization > Enable Normalization for this Resource**. 1. Determine **How to Handle Inexact Permissions Matches**. During the normalization process, the application has to decide what to do with permissions that do not match the normalized permissions. - Fail the normalization process - Elevate to the nearest permission match - Revoke the permission ### Disabling Normalization for a Resource Note For a list of resources: Create a file with a list of resources to disable, and upload them using [Adding or Removing Resources in Bulk](https://documentation.sailpoint.com/fam/help/administrator_guide/permissions/access_fulfillment/normalized_resources.html#adding-or-removing-resources-in-bulk). Using the **Manager Resources** page: 1. Open the **Manager Resources** page. 1. Go to **Admin > Applications** and find the application. 1. Open the options menu and select **Manage Resources**. 1. Select a resource and select **Manage Normalization**. 1. Deselect **Enable Normalization for this Resource**. Using the **Manage Normalized Resources** page: 1. Open the **Manage Normalized Resources** page. 1. Go to **Admin > Applications** and find the application. 1. Open the options menu and select **Manage Normalized Resources**. 1. Select a resource and select **Actions**. 1. Deselect **Enable Normalization for this Resource**. The resource will be removed from the **Manage Normalized Resources** page. # Normalization Process The normalization process reconfigures permissions into dedicated groups. Once a resource is normalized, we can automatically fulfill access certification campaigns and requests. Normalized resources are enabled and relevant only for applications that support fulfillment. Every resource managed by File Access Manager (except for AD groups) must go through a normalization process. - The system creates and sets managed permission groups with the correct permissions on the resource. - The system distributes Users with permissions on a resource among the managed permission groups, based on their current access levels. (It is possible to customize the action applicable to an inexact permission match). - The resource inheritance of permissions is set to **false**. After successful normalization, it is possible to change resource permissions by: ***Access Request*** Whether self-issued, or as the result of an access certification campaign (Access Revoked). ***An approved What-If simulation*** One that a logged-in user has been requested to fulfill. ## Managing Normalized Resources Normalized resources are enabled and relevant in the following conditions: 1. Applications that support fulfillment 1. [Enabling Access Fulfillment for an Application](https://documentation.sailpoint.com/fam/help/administrator_guide/permissions/access_fulfillment/enable_access_fulfillment.html#enabling-access-fulfillment-for-an-application) To access the Manage Normalized Resources page: 1. Go to **Admin > Applications**. 1. Locate the required application to which you want to add resources. 1. Select the dropdown list on the application row, and select **Manage Normalized Resources**. This will open the Manage Normalized Resources page. 1. The Normalized Resources page lists resources in this application that are normalized, or pending normalization. ***Name*** Name of the managed resource. ***Full Path*** Path name ***Status*** Provides the status of the uploaded resources. ***Actions*** The Actions column provides the Manage gear which gives the option to manage the normalization. ***Search by name or full path*** User can search by the resource name or the full path. Note The normalization process is still done within the Admin Client. There is another option to set a resource for a normalization using the Manage Resources screen. ***Global Options menu*** - ***Bulk Set*** Allows the user to upload a list of resources to be normalized and become managed by File Access Manager. These resources will then be queued and the Normalization engine in the Permission Collection Engine will pick them up one by one, normalize their permissions and mark them as managed. See [Adding or Removing Resources in Bulk](#adding-or-removing-resources-in-bulk) - ***Bulk Remove*** Removes the managed state from a list of resources. They are no longer considered normalized. See [Adding or Removing Resources in Bulk](#adding-or-removing-resources-in-bulk) - ***Generate Report*** ### Editing Normalized Resources Normalized resources are enabled and relevant only for applications that support fulfillment. In the Manage Normalized Resources page you can change the following properties for resources: - Disable normalization for this resource - Determine the method of handling inexact permissions matches during a normalization process **Editing the properties of Normalized Resources:** 1. Go to **Admin > Applications**. 1. Locate the required application to which you want to add resources. 1. Select the dropdown menu on the application row, and select **Manage Normalized Resources**. This will open the Manage Normalized Resources page 1. Locate the resource to edit, and press the Actions menu on the resource row. This will open the **Enable Normalization for this Resource** panel. ***Disabling normalization for this resource*** Uncheck **Enable Normalization for this Resource**. This will remove normalization from the source, and remove the resource from the **Manage Normalized Resources** page. To enable normalization for this resource once it has been removed, you can use one of the following methods: - Add it to a CSV file, and upload it using Bulk Set Normalized Resources. See [Adding or Removing Resources in Bulk](#adding-or-removing-resources-in-bulk) - Set the resource to Enable Normalization for this Resource in the **Manage Resources** page. ***Setting the methods of handling inexact permissions matches during a normalization process*** As a part of the normalization process for a resource to be managed, File Access Manager attempts to match every existing permission to one of the managed permissions types. This attribute decides what to do in the case that a granted permission is not an exact match to one of the managed ones Select one of the following methods of handling inexact permissions matches during a normalization process: - Fail the normalization process - this is the default behavior - Elevate to the nearest permission match - Revoke the permission ### Adding or Removing Resources in Bulk Normalized resources are enabled and relevant only for applications that support fulfillment. You can add or remove resources to normalize one at a time, or provide a csv file with a list of resources to normalize or remove from the normalization process. 1. Create a list of resources with a header, and save it as a csv file. ***Format:*** Resource Full Path \\fileServer\\share \\fileServer\\share1 Important The .csv file should be in UTF-8 encoding. 1. Go to **Admin > Applications**. 1. Locate the required application to which you want to add resources. 1. Select the dropdown list on the application row, and select **Manage Normalized Resources**. This will open the Manage Normalized Resources page. 1. On the **Global Options menu**, select **Bulk Set** or **Bulk Remove**. This will open the Bulk Set / Remove Resources to Normalize page. 1. Select **Chose a file** to select the CSV file from your computer, or drag it onto the input panel. 1. Select **Upload**. Note The CSV file for the Administrative Client should be in UTF-8 encoding. A popup will open listing errors in the input file. The files added for normalization will be listed in the normalized resources page as "Pending Normalization" until the normalization task is completed successfully. ## Normalization and Access Fulfillment The following subsections discuss various aspects of normalization and management in Access Fulfillment activities. ### Normalization Process Concepts Normalization is the process by which File Access Manager controls business resource permissions. An unmanaged business resource is made into a “managed” one by assigning a business resource with dedicated Domain Local AD Groups, to manage the access rights to that resource, using the following permission types: - [Group] - Full Control - [Group] - Modify - [Group] - Read and Execute - [Group] - List Folder Contents The Local Users and Special groups listed below are excluded from the normalization process and will maintain their permissions on the normalized business resource: - Local Users - Domain Users (a domain group) - Local Groups - Everyone (includes Domain, Local, and Guest) - Authenticated Users (includes Domain and Local) ### Normalization Process Steps The Normalization Process consists of the following steps: - Use the identity collection and permissions analysis capabilities to gather (read) information about the current identities access rights to the resource being normalized. - Expand groups and nested groups. - Calculate effective permissions. - Create managed groups and associate users with managed groups. - Assign BR permissions to managed groups. ### Normalization Process Examples ***Example 1:*** The Finance Group within C:\\Finance has Full Control permissions, and User A has requested access to read permissions on C:\\Finance. An Administrator can grant User A the requested access either by: - Granting User A Read permissions or - Joining User A to the Finance Group ***Analysis:*** There are disadvantages to both methods, neither of which are good business practices. If User A has Read rights, to a BR, those rights will not be manageable, and as such, will not be eligible for the Normalization process. On the other hand, joining User A to the Finance Group will automatically give User A all the permissions available to the members of the Finance Group. In both scenarios, User A will have rights over which File Access Manager will not have complete control. ***Example 2:*** The Finance Group includes User A, User B, and User C, each of whom has Full Control permissions. The C-Level Executive Group includes User A, User D, and User E, each of whom has Read permissions. ***Analysis:*** User A has both Full Control permissions in the Finance Group and Read permissions in the C-Level Executive Group, since User A (and the other users) retains the same permissions before and after the Normalization process. The system can now manage Full Control Permissions in the Finance Group and Read permissions in the C-Level Executive Group for other users requesting access to those types of permissions in each group. ### Normalization Process Challenges #### Expand Groups and Nested Groups The Identity Application represents either a single domain or multiple domains that are in a trust relationship. If these domains are not synchronized through the Identity Collector, it will not be possible to expand nested groups, and the Normalization process will fail. #### Calculate Effective Permissions The calculation of effective permissions may become complicated when users are members of more than one group with permissions allowed in one group, but denied in another group. ***Scenario 1:*** Group A has Full Control permissions allowed to a BR and Group B has Modify permissions denied to that BR, and assume that User A belongs to both Group A and Group B. Due to the permissions conflict created by User A’s membership in both Group A and Group B, will have Full Control permissions except for Modify permissions, which leaves User A with only Read and Execute permissions. ***Scenario 2:*** User B requests access to Read and Execute permissions and to Delete permissions. Remember that Modify permissions include Read and Execute permissions. An administrator can either fail the normalization process, elevate to the nearest permission match, or revoke the permission. The table below summarizes the results of each action involving the calculation of effective permissions. | **Action** | **Result** | | --------------------------------------- | -------------------------------------------------------------------- | | Fail the normalization process | User B has no permissions. | | Elevate to the nearest permission match | User B has Modify permissions (Read and Execute, Write, and Delete). | | Revoke the permission | User B has only Read and Execute permissions. | ### Normalization Process Results User C submits an access request to have Read and Execute permissions to the Finance Group. All relevant reviewers reviewed and approved User C’s request. If Read and Execute permissions to the Finance Group are a managed business resource, the system automatically executes access fulfillment, and User C will belong to the Finance - Read and Execute Group. ### Managed Resource File Access Manager manages the access permissions of managed resources. ### Managed Permissions Group This Active Directory (Domain Local) group includes users granted a specific permission type on a managed resource. It is possible to create Managed Permission Groups per managed permission type or per managed resource. # Proprietary Application Permissions Collection (Homegrown Apps) Proprietary applications can be commercial off-the-shelf applications or applications that an organization has developed in-house. The Collector Synchronizer Service is the software component responsible for analyzing the permissions of a homegrown application. To model, analyze, and collect the permissions for a homegrown application, File Access Manager must have information on the following data types. Note This information may include from where to bring this data type, its unique identifier, and other data type fields to query later: - User - the list of all the Application’s Users - Group - the list of all the Application’s Groups, and their parent-child nesting (if any) - User-Group Relationships - which Group contain which Users (or which users are members in which group) - Permission Types - all the possible permission types for the application (for example, Read, Write, Full Control) - Business Resources - the list of all the Business Resources of the application, and the hierarchy parent-child relationships (if any) of the business resources - Group-Permission Type-Business Resource Relationships - if the application allows granting permissions through Groups, File Access Manager must know which group provides which permission type on which business resource (for example, the Technical Write Group grants Full Control Permission on the Documents folder). - User-Permission Type-Business Resource Relationships - if the application allows granting direct user permissions to business resources, File Access Manager needs to know which users are assigned which permission type on which business resource (for example, John has direct Full Control permission on the Documents folder). The first step in defining a Permissions Collection for a homegrown application involves determining from where to bring the above information. First, define one or more Data Sources for each data type (using a simplified, single data source for all the data types above, as shown in the example below). The data source tables will be used to map various entities when the Permissions Collection process is defined later. For example, it is possible to easily map a homegrown application that uses LDAP as the identity store and a RDBS database for the rest of the information by: - Defining one or more data sources to bring the information on the Users, Groups, and User-Group relationships, and - Defining another data source to collect the information on the business resources, permission types, and the user/group-permission type-business resource relationships The table below lists sample permissions data in a single Data Source table. | User Name | Group Name | Permissions Type | Business Resource | | --------- | ---------------- | ---------------- | ----------------- | | Jonathan | Technical Writer | Full Control | Docs\\Guides | | John | Technical Writer | Full Control | Docs\\Guides | | Matt | Engineer | Full Control | R&D | | Avi | QA | Read | R&D | The table below lists the distinct columns for each type of Data Source mapping. As the table shows, there are four distinct users, three distinct groups, two distinct Permission types, and two distinct business resources. | User | Group | Permission Type | Business Resource | | -------- | ---------------- | --------------- | ----------------- | | Jonathan | Technical Writer | Full Control | Docs\\Guides | | John | Engineer | Read | Docs\\Guides | | Matt | QA | | R&D | | Avi | | | | The example above shows a homegrown application that does not have direct user permissions, or nested groups, but does have its hierarchical business resources delimited by the ‘\\’ char. The following example examines the relationships between data types. | Group | Members | | ---------------- | -------------- | | Technical Writer | Jonathan, John | | Engineer | Matt | | QA | Avi | | Group | Permission Type | Business Resource | | ---------------- | --------------- | ----------------- | | Technical Writer | Full Control | Docs\\Guides | | Technical Writer | Full Control | Docs\\Guides | | Engineer | Read | R&D | | QA | Read | R&D | ## Creating a Homegrown Application To create a homegrown application (as part of the configuration of a permission collector): 1. In the administrative client, go to **Application > New > Application**. The New Application Wizard displays. 1. Select **Proprietary - Use this to add a Homegrown application**. 1. Type the application type in the **Application Type** field. Note: If there are no application types, select the Create New Application Type link. 1. Enter the following information: - Name - Name of the Application Type - Description - Description of the Application Type - Active Directory Authentication Yes/No - Whether or not to perform AD authentication and use an AD Identity Collector. The same application types will have the same permission types, and you will be defining permission types collector for each application type. 1. Select **Save**. 1. Select **Next**. The General Details window displays. Enter the following information: - Name - Name of the Application Type - Description - Description of the Application Type - Container - Name of the selected Container If there is no suitable container, select to create a new one. - Identity Collector - Name of the identity collector to link to If there is no suitable identity collector, select to create a new one. 1. Select **Next**. The Permissions Collector Scheduling window displays. 1. To end the New Application Wizard without creating a schedule, select **Finish**. 1. To create a schedule, check the **Create a Schedule** check box, and enter the scheduling details: 1. Select **Finish**. A successful completion notice displays. 1. Select **Open Permissions Collection Wizard** to configure Permissions Collection parameters. 1. Select **Close** to close the Wizard without configuring permissions collection parameters. ## Configuring the Permissions Collector 1. To open the Permissions Collector Configuration wizard: 1. Select **Open Permissions Collection Wizard** at the end of the Homegrown Application definition, or by 1. Select a homegrown application to the context by double-selecting on it, and then selecting on **Permissions Collection**. The Permissions Collection Wizard displays. 1. Select **Next** to open the Identities Collection window. - Use Existing Collector - Select a collector from the dropdown list - Edit the Selected Identity Collector - To edit an existing collector - Create a New Collector - To create a new collector 1. If you want to create a new collector, select **This application uses Groups** check box in the Groups Configuration section if applicable. Unchecking this box precludes the need to map the Group data or Group Permission types of Business Resource relations and you can skip those steps in the wizard. If you chose to create a new collector, the page **Identity Collector: Users Collection**\ **(1 of 3)** displays. Under Main Data Source, the Data Source displays automatically. 1. Under Mandatory Fields, select a User Name from the dropdown menu. 1. Under Optional Fixed Fields, check the check box next to each relevant optional fixed field, and select the field from the corresponding dropdown menu. 1. Select **Next** to open the User Collection (2 of 3) screen . 1. Under Fields Mapping, select a field from the **Dictionary Field** dropdown menu (or if none exists, select **Create a new Field** next to Fields Mapping). 1. Select a field from the **Mapped Field** dropdown menu. 1. Select **Next**. The Identity Collector: Users Collection (3 of 3) displays. 1. If relevant, under Users Tree, check the **Should the users tree be grouped** box. This will affect how the users will look in the Users Tree under the Advanced Forensics Control. 1. If you checked that box, select a field grouping from the **Field** dropdown menu. 1. If relevant, under Unique User Accounts Mapping, check the **Use a field to map between accounts of the same user** box. 1. If you checked that box, select the field from the **Field** dropdown menu. 1. Select **Next**. The Identity Collector: Groups Collection (1 of 2) window displays. Under Main Data Source, the Data Source displays automatically. 1. Under Mandatory Fields, select a Group Name from the dropdown menu. 1. Under Optional Fixed Fields, check the check box next to each relevant optional fixed field, and select the field from the corresponding dropdown menu. 1. Select **Next**. The Identity Collector: Groups Collection (2 of 2) displays. 1. Under Fields Mapping, select a field from the **Dictionary Field** dropdown menu (or if none exists, select **Create a new Field** next to **Fields Mapping**. 1. Select a field from the **Mapped Field** dropdown menu. 1. Select **Next**. The Groups Hierarchy Support window displays. 1. Select This Identity Collector uses Groups Hierarchy if relevant. 1. Under Main Data Source, the Data Source displays automatically. 1. Under Mandatory Fields, select a Child Group Name and a Parent Group Name from their respective dropdown menus. 1. Under Mandatory Fields, select a Parent Group Name from the dropdown menu. 1. Under Optional Fixed Fields, check the check box next to each relevant optional fixed field, and select the field from the corresponding dropdown menu. 1. Select **Next**. The Identity Collector: Users Membership in Groups (1 of 1) window displays. 1. Under Main Data Source, the Data Source displays automatically. 1. Under Mandatory Fields, select a Group Domain Name, Group Name, and Username from the respective dropdown menus. 1. Under Mandatory Fields, select a Parent Group Name from the dropdown menu. 1. Under Optional Fixed Fields, check the **User Domain Name** check box if relevant, and select the field from the corresponding dropdown menu. 1. Select **Next**. The Business Resources Collection (General) window displays. 1. Select **This application uses Business Resources** if applicable. Note If you do not check this check box, File Access Manager creates a Business Resource (in the background) and associates it with all permissions. 1. Type the name in the **Name** field. 1. Select **Next** to open the Business Resources collection . # Configuring the Permissions Collector To open the Permissions Collector Configuration wizard: 1. Select **Open Permissions Collection Wizard** at the end of the Homegrown Application definition, or by 1. Select a homegrown application to the context by double-clicking on it, and then selecting on **Permissions Collection**. The Permissions Collection Wizard displays. ## Welcome Tab Welcome Tab Directions 1. Select **Next** to open the Identities Collection window. - Use Existing Collector - Select a collector from the dropdown list - Edit the Selected Identity Collector - To edit an existing collector - Create a New Collector - To create a new collector 1. If you want to create a new collector, select **This application uses Groups** check box in the Groups Configuration section if applicable. Unchecking this box precludes the need to map the Group data or Group Permission types of Business Resource relations and you can skip those steps in the wizard. If you chose to create a new collector, the page **Identity Collector: Users Collection (1 of 3)** displays. Under Main Data Source, the Data Source displays automatically. 1. Under Mandatory Fields, select a User Name from the dropdown menu. 1. Under Optional Fixed Fields, check the check box next to each relevant optional fixed field, and select the field from the corresponding dropdown menu. 1. Select **Next** to open the User Collection (2 of 3) screen . 1. Under Fields Mapping, select a field from the **Dictionary Field** dropdown menu (or if none exists, select **Create a new Field** next to Fields Mapping). 1. Select a field from the **Mapped Field** dropdown menu. 1. Select **Next**. The **Identity Collector: Users Collection (3 of 3)** displays. 1. If relevant, under Users Tree, check the **Should the users tree be grouped** box. This will affect how the users will look in the Users Tree under the Advanced Forensics Control. 1. If you checked that box, select a field grouping from the **Field** dropdown menu. 1. If relevant, under Unique User Accounts Mapping, check the **Use a field to map between accounts of the same user** box. 1. If you checked that box, select the field from the **Field** dropdown menu. 1. Select **Next**. The **Identity Collector: Groups Collection (1 of 2)** window displays. Under Main Data Source, the Data Source displays automatically. 1. Under Mandatory Fields, select a Group Name from the dropdown menu. 1. Under Optional Fixed Fields, check the check box next to each relevant optional fixed field, and select the field from the corresponding dropdown menu. 1. Select **Next**. The **Identity Collector: Groups Collection (2 of 2)** displays. 1. Under Fields Mapping, select a field from the **Dictionary Field** dropdown menu. If none exist, select **Create a new Field** next to **Fields Mapping**. 1. Select a field from the **Mapped Field** dropdown menu. 1. Select **Next**. The **Groups Hierarchy Support** window displays. 1. If relevant, select **This Identity Collector uses Groups Hierarchy**. 1. Under Main Data Source, the Data Source displays automatically. 1. Under Mandatory Fields, select a Child Group Name and a Parent Group Name from their respective dropdown menus. 1. Under Mandatory Fields, select a Parent Group Name from the dropdown menu. 1. Under Optional Fixed Fields, check the check box next to each relevant optional fixed field, and select the field from the corresponding dropdown menu. 1. Select **Next**. The **Identity Collector: Users Membership in Groups (1 of 1)** window displays. 1. Under Main Data Source, the Data Source displays automatically. 1. Under Mandatory Fields, select a Group Domain Name, Group Name, and Username from the respective dropdown menus. 1. Under Mandatory Fields, select a Parent Group Name from the dropdown menu. 1. Under Optional Fixed Fields, check the **User Domain Name** check box if relevant, and select the field from the corresponding dropdown menu. 1. Select **Next**. The **Business Resources Collection (General)** window displays. 1. Select **This application uses Business Resources** if applicable. If you do not select this check box, File Access Manager creates a Business Resource (in the background) and associates it with all permissions. 1. Type the name in the **Name** field. 1. Select **Next** to open the Business Resources collection. ## Permission Collection Resources Tab Permission Collection Resources Tab Directions The **Business Resources Collection (1 of 2)** window displays. Select the data source that contains Business Resource Data type information from the **Data Source** dropdown list or select **Create a new Data Source** to create a new data source. 1. If you select **Create a new Data Source**, the **Data Source Wizard** displays. 1. Select a resource unique identifier from the **Resource Unique Identifier** dropdown list under Mandatory Fields. 1. This field must identify the Business Resource uniquely (for example C:\\Docs\\Finance), and should match Business Resource Unique Identifier selected in the User/Group-Permission Type-Business Resource relationships defined in the following steps. 1. Check the **Resource Name** check box under Optional Fixed Fields, if applicable, and select the column that represents the source name. 1. Select **Next**. The **Business Resources Collection (2 of 2)** window displays. 1. This section allows dynamic field mapping for the Business Resource data type. The relevant fields will be available later for query and display in the Permission Forensics page. You can use it in Access Certification Campaigns and Access Requests to display meaningful information for permission reviewers. 1. Select a dictionary field from the **Dictionary Field** dropdown men. 1. Select a mapped field from the **Mapped Field** dropdown menu. 1. Select **Next**. The **Business Resources Hierarchy Support** window displays. 1. Check the This Business Resources Collector uses Resources Hierarchy check box to support parent-child hierarchy. 1. Type in a unique identifier for the hierarchical string in the String to be used as a delimiter to break the string into resources field. 1. An example of a group hierarchy follows: If the nested groups are: The Data Source table of parent-child group associations would be: | Parent Group | Child Group | | ------------ | ----------- | | Group A | Group C | | Group A | Group D | | Group A | Group E | | Group C | Group B | | Group E | Group F | | Group E | Group G | 1. Select **Next** to open the Permission Types Collection tab. ## Permission Types Collection Tab The Permission Types Collection window displays. The Permission Type collector is associated with the Application type, so all homegrown applications of the same type will share the same permission type collector, and the same permission types Permissions Types Collection Tab Directions 1. Check the **Edit the selected Permission Type Collector** check box to edit the permission type collector. The **Permissions Types Collection (1 of 2)** window displays. 1. Select the data source with information on the Permission Type data type from the **Data Source** dropdown menu, or select **Create a new Data Source**. 1. Select a Mandatory Field from the **Permission Type Name** dropdown menu. 1. This field must identify the Permission Type uniquely (for example, Read), and should match the Permission Type Name selected in the User/Group-Permission Type-Business Resource relationships defined in the following steps. 1. Check optional fixed fields, if applicable, from the **Optional Fixed Fields** check boxes. 1. Select **Next**. The **Permission Types Collection (2 of 2)** window displays. This section allows dynamic field mapping for the Permission Type data type. The relevant fields will be available later for query and display in the Permissions Forensics screen, and you can use them in Access Certification Campaigns and Access Requests to display meaningful information for permission reviewers. 1. Select **Create a new Field** under **Fields Mapping** if applicable. The **Manage Permission Types Data Dictionary** window displays. 1. Type a name in the **Name** field. 1. Select a WH Question from the **WH Question** dropdown menu. 1. A WH Question will determine under which question this field display in the Advanced Forensics Control under the *Permissions > Identity and Permissions Forensics* window, when you create a new query. 1. Select **Save** to save the new field or select **Cancel** to return to the previous window. 1. The **Permission Types Collection (2 of 2)** window displays again. 1. Select a dictionary field from the **Dictionary Field** dropdown men. 1. Select a mapped field from the **Mapped Field** dropdown menu. 1. Select **Next** to open the Users’ Direct Permissions Collection tab. ## Users’ Direct Permissions Collection Tab In this portion of the Permissions Collector Configuration Wizard, you determine how to import permissions given directly to users. This is done by mapping the relations between users, permission types, and business resources. Users’ Direct Permissions Collection Directions Note: The Name field contains the name you provided. 1. Select the \*\*Map permissions given directly to Users\*\*check box to map those permissions. 1. Select **Finish** if you do not need to map the permissions, or select **Next** to continue with the Users’ Direct Permissions Collection portion of the wizard. If you select **Next**, the Users Direct Permissions Collection (1 of 1) window displays. 1. Select the Main Data Source from the **Data Source** dropdown menu that contains the information on the User-Permission Type-Business Resource relationships or select **Create a new Data Source**. 1. Select the mandatory fields from the following dropdown menus: - *Permission Type Name* - this field value must match the permission type name selected in the Permission Type collector. - *Username* - this field value must match the user name selected in the Users Collector defined in the identity collector. - *Resource Unique Identifier* - this field value must match the business resource unique identifier selected in the Business Resources collector. 1. Check optional fixed fields, if applicable, from the **Optional Fixed Fields** check boxes. 1. Select **Next** to open the Groups’ Direct Permissions Collection tab. ## Groups Direct Permissions’ Collection Tab In this portion of the Permissions Collector Configuration Wizard, you determine how to import permissions given to users through rules by mapping the relations between Groups, Permission Types, and Business Resources. Groups Direct Permissions’ Collection Directions 1. Check the **Map permissions given to groups** check box if applicable. Note: The Name field contains the name you provided. 1. Select **Finish** if you do not need to map the permissions, or select **Next** to continue with the Groups Direct Permissions Collection portion of the wizard. If you select **Next**, the Groups Direct Permissions Collection (1 of 1) window displays. 1. Select the Main Data Source from the **Data Source** dropdown menu that contains on the Group-Permission Type-Business Resource relationships or select **Create a new Data Source**. 1. Select the mandatory fields from the following dropdown menus: - Permission Type Name - this field value must match the permission type name selected in the Permission Type collector. - Group Name - this field value must match the group name selected in the Groups Collector defined in the identity collector. - Resource Unique Identifier - this field value must match the business resource unique identifier selected in the Business Resources collector. 1. Check **Optional Fixed Fields**, if applicable, from the **Optional Fixed Fields** check boxes. 1. Select **Next** to open the Permission Collector scheduling tab. ## Permissions Collector Scheduling Tab Permissions Collector Scheduling Directions 1. Select **Finish** if you do not want to create a schedule. 1. Check the **Create a Schedule** checkbox to create a schedule for identities, groups, and permissions collection. 1. Select **Next** to open the summary tab. ## Permissions Collection Summary Tab Permissions Collection Summary Directions 1. Select the **Run Identities and Permissions Collection Now** checkbox to run the collection. 1. Select **Finish**. The Permissions Collector Summary window displays. 1. Check **Run Identities and Permissions Collection Now** and select **Finish**. An Information window displays to indicate that the system created a Task successfully. 1. To view the task progress, go to **Settings > Task Management > Tasks**. 1. Select **OK** to end the wizard. Note: It is possible to reuse the Identity collectors for user, group, and the user-group relationships and the Permission Types collector. However, it is only possible to use the Business Resources collectors and the two Business Resource Relationships collectors once, since they are associated with specific applications. One or more Data Sources collect all the above data types, but there must be a separate mapping from the Data Source to each of the data types. ## Viewing Permissions Collection Results The permission results can be seen in the Permission Forensics screen. See [Permission Forensics](https://documentation.sailpoint.com/fam/help/administrator_guide/forensics/permission_forensics.html#permission-forensics). You can view the results of the permissions collection that you defined from the Permission tab. # Configuring the File Access Manager Website This chapter describes the Settings tab of the File Access Manager website. The *Settings* tab include the following sub tabs (displayed from left to right): Message Templates - Access Certification - Campaign Invitation - Scheduled Reminders - Access Request - Data Owners Election - Welcome Message - New Task - Pending Activities - Scheduled Reminder - Review Task - Owner’s Appointment - Company Information - System Notifications - Service Monitoring Capabilities - Import User Scope Account Exclusions - Goal Exclusions - Sensitive Account Exclusions - Alert Exclusions Discard Rules Task Management - Tasks - Scheduled Tasks - Task Auto Retry General - Overexposed Resources - API Authentication - SMTP Account # Excluding Accounts from File Access Manager Processes Administrators use the Account Exclusions setting to exclude specific accounts from appearing in various reports or activities. This might include bots that access resources often,. But should not be considered for data ownership, or sensitive accounts, that we might not want appearing on activity reports. ## Types of Exclusions There are three types of exclusions: ### Goal Exclusions Exclude specific accounts from the data owner’s election process. The excluded users will not participate in the Data Owner Election, neither as candidates nor as voters. ### Sensitive Account Exclusions The permissions and activities of the excluded accounts will be visible to Administrators only. Select User / Group accounts, or use a prefix. All the direct members of an excluded group will be excluded. Once an account is on the exclusion list, data owners will not be able to see those accounts in the following screens: - *Resources > Activities >Access Frequency* - *Resources > Permissions > Simple View* - *Resources > Permissions > Excess View* - *Resources > Permissions > Tree* - *Resources > Owners* *Forensics* ### Alert Exclusions Alert Rules will ignore all activities performed by the excluded users. ## Adding Accounts To open the exclusion screen, go to **Settings > Account Exclusions**. To add a single account: 1. Select **+Add Account**. 1. Search for a user from the combo box. 1. Select **Add**. To add accounts in bulk: 1. Go to **Settings > Account Exclusions > [X] Exclusions**, and select *Bulk Upload*.\ For example: Settings > Account Exclusions > Goal Exclusions A Bulk Actions dialog box displays. 1. to download a sample CSV file, select **Download Sample File**. 1. In the CSV file, fill in the relevant fields Domain Name, Username, account type (if required) , as relevant 1. Save and upload the file. 1. A status popup appears with the upload status. 1. The Exclusions grid refreshes automatically with the uploaded accounts. ## Searching for Users or Accounts to Exclude 1. Type the user or account name, or the first few characters of the name, in the Search box. You can select the account type - Group or User - where these filters are present. If this option is not available, the default is user account. 1. Select **Add** to add the exclusion or **Clear** to delete the exclusion selected. 1. To search for a current excluded account, type the excluded account name, or the first few characters of the name, in the Search box at the top right of the screen. ### Starts With If you are using the “starts with“ operator (where supported), the application will not display a list of candidates. Type in one or more letters of the prefix of the accounts to exclude from this list. All the accounts in the system that start with the string provided will be excluded. The free text that you type in the Account to be Excluded field when you select the “starts with” operator can only be a user/group name, and cannot include a domain name. ### Deleting Accounts/Groups Select the dropdown menu to the left of a username, and select **Delete**. To delete more than one account, select the accounts to delete, and select the **Delete** icon. ## Removing Accounts from the Exclusion List To remove accounts from the exclusion list: 1. Filter the list of accounts using the filter field. 1. For a single account 1. Select **Delete** from the Actions menu on the row of the account to delete. 1. For multiple accounts 1. Select the required accounts by selecting the checkbox on the account row. 1. Select the **Delete** icon. # General Menu To get to the general menu, go to Settings > General. General settings affect the entire system. ## Path Display An administrator can define the mapping of application paths throughout the business user interface. To define the mapping of application paths, perform the following steps: 1. Define the path in the administrative client. 1. Check the **Translate physical path to logical drive mapping wherever applicable** checkbox if applicable. 1. To exclude administrators, check the **Exclude Administrators** checkbox. Note If there is a preference to see the physical name of the administrator, rather than the logical name, the Exclude Administrators checkbox should be checked. 1. To display the physical path, check the **Allow physical path to be viewed** checkbox. Note If the preference is to see only the logical path (to avoid confusion caused by the display of multiple names) this checkbox should remain unchecked. 1. Select **Save** to save the selection, or **Discard** to discard it. 1. After making and saving changes, delete the cache. ## Overexposed Resources Overexposed resources are resources accessed by groups with “too many” members. The system determines large groups based on basic parameters, and administrators can change those parameters. Everyone and Authenticated Users groups are included by default, but it is possible to further filter (define) overexposed resources by group. To define overexposed resources, perform the following steps: Go to **Settings > General > Overexposed Resources** 1. Check the **Groups containing at least \_\_\_% of user accounts** checkbox to define groups by the percentage of user accounts. (This checkbox is checked by default.) 1. Check the **Groups containing at least \_\_\_ user accounts checkbox** to define groups by the number of user accounts. (This checkbox is checked by default.) 1. Check the **Include Share permissions (on CIFS-based applications)** checkbox to include those share permissions. (This checkbox is checked by default.) 1. To exclude group accounts from the overexposed group, type the account name, or the first few characters of the account name, in the **Exclude Group Account** search box. 1. Select **Save** to save the selection, or **Discard** to discard it. 1. To remove a group from the list, select **x** next to the group name. ## API Authentication This screen enables administrators to view the API authentication. The screen does not display the client secret, but it enables the users to copy the secret to the clipboard To generate a new client secret, select **Generate Secret**. ## Configuring the SMTP Account File Access Manager SMTP Account is used for configuration of the connection to the organization email server to send notifications, reports, and reminders. To configure the SMTP account: 1. Open the SMTP Account configuration screen. **Settings > General > SMTP Account** 1. Configure the account details. **Server Host/IP** The server host details **Port** For the SMTP service connection **Username, Password** Connection credentials **From** This is a unified From field from all Email responses. **Timeout (MS)** The timeout, in milliseconds **SSL** If SSL is required, check this box **Recipient Email** An email address to send the test email to, when selecting the test button. Note Use a non-SailPoint email address. Or, configure your own email during deployment. 1. Select **Send Test Email** to test the configuration by sending a test email to your mailbox and verifying receipt. 1. Select **Save** or **Cancel** to exit. # Message Templates The message templates are used to send alerts and messages to users in various scenarios. For example, if while creating an Access Certification template, an administrator checks the check box to send a reminder, the system will send the reminder automatically, according to the format and parameters of the Scheduled Reminders template. The templates use variables to be replaced by the actual relevant data when sending the message. The available templates are listed above. Edit the templates to fit your company culture and language. To edit a message template, perform the following steps: 1. Open the relevant template. 1. Go to **Settings > Message Templates > [template submenu]** (see list above). 1. Check **Enable Message** to toggle the checkbox and enable the subject and message input fields. 1. To add variables to the heading or message text, select **Insert Predefined Parameters**, and select one or more fields in the dropdown list. The values in the lists vary according to the context. Note The system will replace the values in the dynamic fields with real values when the messages are sent. 1. Select **Send Test Mail** to send a test Email to yourself to check that the information in the Message Template is correct. 1. For templates for scheduled reminders, set the weekday(s) and time for a scheduled reminder in the Send Weekly Reminders section at the bottom of the Scheduled Reminders screen. The default is Wednesday at 13:00. 1. Select **Save** or **Discard** to save (or discard) the template. Note The system saves this template to the web client server to create messages when required. ## Access Certification These are automated emails referring to the access certification process. | Email | Description | | ------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Campaign Invitation | This message is global to all campaigns, but can be overridden for a specific campaign. It is sent to the reviewer with every new campaign pending that reviewer’s decision. | | Schedule Reminders | This reminder is global to all campaigns, but can be overridden for a specific campaign. It is sent to all pending reviewers, per the weekly schedule. | | Access Requests | This email is sent to a user who created an access request, when the request is finalized. In any of the stages: - Approved - Rejected - Fulfilled | ## Data Owners Election | Message | Description | | ------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Welcome Message | A Welcome email message is sent to users when they get their first task, explaining the need for data owners and owner election, and their part in the process. | | New Task | A New Task message is sent to users whenever they receive a new task. | | Pending Activities | A Pending Activities message is initiated (on-demand) by the administrator and is sent to users who do not fulfill their tasks. | | Scheduled Reminder | A Scheduled Reminders message is sent, according to the set schedule, to all users with pending tasks. | ### Review Task A Review Task message is sent to relevant reviewers after a data owner’s election process has concluded. To send a Review Task message, perform the following steps: 1. Go to **Settings > Message Templates > Data Owners Election > Review Task**. 1. Check **Enable Message**. 1. The checkbox it is ticked, and the fields under Subject and Message Template are enabled. Note The system sends this message to the Data Owners election reviewers in the goal Appointment portion of this process. The review task will appear in My Tasks **>** Owners Election. 1. Continue as described above. ### Owner’s Appointment Go to **Settings > Message Templates > Data Owners Election > Owner’s Appointment**. An Owner’s Appointment message is sent once to each of the appointed owners of a resource. The message is supposed to explain the data owner role as access request approver.\ Something along the lines of: Your colleagues have elected you as the Data Owner for the following resource under the `$$APPLICATION\_NAME$$ application: $$RESOURCE\_PATH$$` As a Data Owner you are required to take an active role in protecting the sensitive information within your resource. The processes in which your participation is needed may include reviewing suspicious activity on your resource, reviewing new access requests, and certifying the currently granted permissions. We will approach you once your input is required. Note The system sends this message to users who have been appointed as data owners. ### Company Information The Company Information template contains the name and logo to be included in every email message. To set the details in a Company Information message (sent in emails), perform the following steps: 1. Go to **Settings > Message Templates > Data Owners Election > Company Information**. 1. Enter the company name. 1. Select **Select File** to select a logo image from your drive. The file size cannot exceed 300 x 140 pixels. 1. The logo displays in the Company Logo graphic box. 1. Select **Remove** to remove the logo. 1. Select **Save** to save the Company Information or **Discard** to discard it. ## System Notifications To see System Notification, go to **Settings > Message Templates > System Notifications**. System notifications alert users when a service goes down. While a default message can be used as a notification, users can also change the default message to conform to their company’s particular needs. The following predefined parameters are available: - ServiceName - Server - ServiceType # Task Management In the web client, go to Settings > Task Management. - Tasks - Scheduled Tasks - Task AutoRetry ## General File Access Manager is a task-oriented system, with both interactive tasks (such as querying events) and background tasks (producing reports). Scheduling tasks with parameters allows them to comply with various requirements. File Access Manager has long-running processes, including crawling, permissions collection, and reports. The system executes and tracks these processes using tasks, and runs them in batches. It is thus possible to work in the administrative client while tracking the progress of various processes. Most reports throughout the system have a button or menu item to create a scheduled task, or produce now. Select **Produce Now** to create ad-hoc tasks in the administrative client to run the report. You can track the tasks in the File Access Manager web application, under **Settings > Task Management > Tasks**. When the system creates a task, the following Information popup displays. An File Access Manager service runs this task, and polls the File Access Manager Database periodically to search for new pending tasks. Each service polls the specific types of Tasks for which it is responsible. For example, the Reporting Service polls and handles Report Tasks. User-created tasks and scheduled tasks display in the *Tasks* screen. Note The permission “Show Tasks from All Users” is required to view all system tasks. This permission is granted by default to the administrator role. Without this permission, the system only displays user-created tasks. ## Navigation and menus - Checkbox on the left of a task - select task. - Checkbox on the top of the table - select all tasks on this page. - Select all x items on the top menu - select all tasks on all pages according to the filter. - Unselect all items - unselect all items on other pages except for the current one. - Filter icon on the top right corner - open the filter. - Rows per page on the bottom of the table - select the number of entries per page. ## Tasks This screen shows table with the tasks selected according to the user’s permissions and the filter. The data are updated in real time. On this screen you can cancel, rerun or delete task instances. The filter allows selecting tasks by various parameters, including status, type and date. Selecting a task opens the Task Details panel listing with details detailed description of the task details and status of submitted tasks. ### Task Fields **Name, Type** Task name, task type **Service** The service related to this task. **Server** The server this task is running on. **Status** This field shows the current status of the task, including a progress bar. | Status | Icon | Description | | ----------------------- | ---- | -------------------------------------------- | | Completed | | The task was successfully completed. | | Completed with Warnings | | The task completed, but there were warnings. | | Failed | | The task failed to complete. | | Canceled | | The task was canceled before completion. | | In Progress | | The task is currently in progress. | | Pending | | The task is pending and has not started yet. | Start / end date Create By Parameters ### Task Filter The task screen includes a filter to narrow down the selection of tasks. Select the filter on the top-right corner of the Task screen to open the filter. Note The filter is not visible if there are tasks selected. **Filter fields:** Name, Type, Service, Status, Task that ended before (date field), Created by me only The **service** filter dropdown lists services that have tasks. Select **Apply** to set the filter ### Task Screen Actions Select one or more tasks using the checkbox to the left of each task. Selecting a task will open the top option menu: - *Re-run* - rerun the task(s) selected. Selected tasks that cannot be run will not run. Selected tasks that depend on other tasks to complete before running will run after the prerequisite task runs. - *Cancel* - cancel the running tasks out of the list selected. - *Delete* - delete. ### Task Details Screen Selecting a task opens the Task Details screen, with a description of the task stages. To close the detail screen, select outside the details screen, or select the **X** in the upper corner. ## Tracking Progress in the Task Detail Pane To track a task, perform the following steps: 1. Go to **My Tasks**. 1. Select the task type from the menu bar: 1. Access Certification 1. Access Request 1. Owners Election - suggest owners for a given resource 1. My Requests Each menu will open a list of active tasks assigned to the current user. Select the selection from the actions column to view or perform the assigned task. ## Scheduled Tasks A Scheduled Task tells File Access Manager when, and how often, to execute a specific task repeatedly. For example, a weekly scheduled task can run a weekly Activities Report. The wizards in the File Access Manager administrative client help create Scheduled Tasks. Every wizard with a scheduling screen has a checkbox for creating a scheduled task in the background. While deselecting a checkbox deletes a scheduled task, an attempt to delete a Scheduled Task via the Scheduled Tasks screen results in the display of a warning popup, indicating that another object or process is dependent on this Scheduled Task. The Schedule Task Handler service creates and processes Scheduled Tasks for the relevant services to handle. Except for a few types of scheduled tasks, it is only possible to edit task scheduling (not parameters) from within the Scheduled Tasks screen. ### Scheduled Tasks Filter The Scheduled tasks screen includes a filter to narrow down the selection of scheduled tasks. Select the filter button on the top right corner of the Task screen to open the filter. Note The filter icon is not visible if there are tasks selected. Filter fields: Name - The scheduled task name Type - A drop down list of scheduled task types Status - All, Active, Inactive Select **Apply** to set the filter. ### Scheduled Tasks Fields - Name - Task Name - Type - The type of a Scheduled Task indicates the task actions. The table below lists and describes the task types: | Type | Description and Task Source | | ----------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Access Certification Campaign | Tasks related to Access Certification Campaigns, created from the Access Certification screen. | | Access Certification Campaign Reminder Emails | Reminder emails for a campaign. This task is created for each new campaign that is configured to send reminders. The task is controlled through the Edit Campaign wizard. | | Access Requests Reminder Emails | Controlled through the Access Request screen. | | Application Deletion | One-time task created when deleting an Application. You cannot schedule this task type. | | Archive Events by Filter | Created from the Activities to Archive events. | | Built-in Application Permissions Only Collection | Created from the Permissions Collector or the Edit Application wizard. | | Built-in Business Resource Permissions Only Collection | Created by right selecting a business resource in the Permissions/Permissions and Identities Forensics screen and starting a specific business resource permissions’ collection. You cannot schedule this task type. | | Business Resource Deletion | One-time task created when deleting a Business Resource You cannot schedule this task type. | | Classify Behavioral Rules | A Scheduled Task that classifies data, based on behavioral rules. This task can be scheduled from the File Access Manager Administrative Client under *Policies > Data Remediation Policy > Configuration > Schedule Classify Behavioral Rules*. | | Crawler | Controlled through the Edit Application Wizard. | | Daily Statistics Calculation | An internal, built-in, system-scheduled task that calculates daily statistics on collected activities. | | Data Classification | Different Data Classification tasks. | | Database Clean Up | An internal built-in, system-scheduled task that maintains the File Access Manager database. | | Homegrown Application Identities and Permissions Collection | Controlled through the Permissions Collector wizard of a Homegrown Application. | | Identity Collector Synchronization | Controlled through the Edit Identity Collector wizard. | | Reassign Review Process | A one-time task, created when a review process is reassigned to Access Certification, or Access Request. You cannot schedule this task type. | | Report | Created during report creation or in the Edit report wizard. | | Revert Review Process | A one-time task, created when a review process is reverted in Access Certification or Access Request. You cannot schedule this task type. | | Scheduled Events Deletion | Created in Activities to delete events periodically. | | Service Log Level Update | A one-time task that changes the log level of a service created in the Health Center when performing a service drill down You cannot schedule this task type. | | Users Logical Drives Mappings | Controlled using Access Fulfillment configuration. | **Status** - This field shows the current status of the task, including a progress bar. A scheduled task can be either active, or inactive. **Schedule Type** - The schedule type describes the frequency of running the tasks. - **Schedule Types and Intervals** - Once - Single execution task runs. - Run After - Create dependency of tasks. The task starts running only upon successful completion of the first task. - Hourly - Set the start time. - Daily - Set the start date and time. - Weekly - Set the day(s) of the week on which to run. - Monthly - The start date defines the day of the month on which to run a task. - Quarterly - A monthly schedule with an interval of 3 months. - Half Yearly - A monthly schedule with an interval of 6 months. - Yearly - A monthly schedule with an interval of 12 months. **Last run** - The last time the task ran. Whether successful or not. **Next run** - For scheduled tasks that have future runs scheduled **Parameters** - The run parameters of the scheduled task. ### Editing Schedules To edit the schedule of one or more scheduled tasks, select the scheduled task from the Scheduled Task screen, and select **Edit**. This will open the Edit Schedule panel. Scroll down the panel to see all the input fields. **Frequency type** - see above **Run After** - If selecting Run After, select the task after which this task should run. Note When editing more than one task at the same time, you cannot select Run After. **Start date** - All tasks, except for *Once & Run After*, have a Start Date. That date defines the baseline date for all calculations. For example, daily tasks with two-day intervals run first on the start date. The next run will be two days after the start date (not two days after the scheduling date). **End Date (Ends)** - *Never* - tasks without an end date. - *On* - select an end date. If set, the system does not schedule new tasks beyond the End Date. ## Related Tasks Selecting a task will open the *Related Tasks* panel, listing the instances of the scheduled task that were run, the run dates, task status, and running user. Select outside the panel, or select the **X** on the top right corner of the panel to return to the previous screen. ## Running Tasks To run a task, perform the following steps: 1. In the web client, navigate to **Task Management > Scheduled Tasks**. 1. Select a task or tasks from the list of tasks. - Using the filter to narrow down the list of tasks. - Marking the boxes at the left of each task to select it. - Using the\*\*select all\*\*checkbox at the top of the list-this selects all the tasks on the page. 1. This will open the task menu bar at the top of the Task table. - Edit: - Run Now: - After running a task or tasks, a popup message opens, with a link to the Tasks screen to view the task progress. - *Activate* - turn on the Activate flag for all schedule tasks selected. This will enable the scheduling to run, as it is configured. - *Deactivate* - turn off the activation flag for all scheduled tasks selected. If you deactivate scheduled task, the next run field for these tasks will remain empty. ### Task Auto Retry File Access Manager can set an auto-retry on task, whereby tasks will be automatically run again a preconfigured number of times in case of failure. The tasks that can be retried are configured by task type. By default, most task types are set to auto retry twice. See list below for task types set to auto retry: - Access Certification Campaign Reminder Emails - Access Requests Reminder Emails - Application Deletion - Built-in Application Permissions Only Collection - Business Resource Deletion - Classify Behavioral Rules - Classify Composite Rules - Crawler - Dashboard Widgets Calculation - Data Classification - Global Campaign Reminder - Identity Collector Synchronization - Import Data Classification Results - Import User Scope - eMail Reminder - Report - Report Template - Scheduled Alerts Deletion - Users Logical Drives Mappings Access to this panel is controlled by the permission **Settings > Task Management > Task Auto Retry**. ### Enabling Auto Retry for Tasks 1. In the web client, go to **Settings > Task Management > Task Auto Retry**. 1. Select **Enable Auto Retries for Failed Tasks**. 1. Set the *number of retry attempts* – the number of additional tries the system will run the task. To set the task types that will be retried, complete the following: 1. Select task types from the drop-down list. Note The drop-down list includes all available task types that are not already selected for auto-retry. If all the task types are enabled, the Add Task Type field is disabled. 1. Select **Add** to add the task type to the list. To delete a task type from the list of task types to retry, complete the following: 1. Locate the task type from the task type list 1. Select the trash icon on the row of the task type to delete. 1. Select **Save** or **Discard** to save or discard the changes made on this panel. ## Alerts Introduction Alert rules specify criteria based on system activities that trigger alerts, notifications, and custom responses such as emails, SysLog messages, or UserExit actions. The alerts page can be found at **Compliance > Alert Rules** **Examples of Alert Rules:** - **File Deletion by Unauthorized User**: A file located in `\\FileStorageApplication\HR` is deleted by a user who is not a member of the HR department. - **Suspicious Activity by a User**: A specific user accesses more than 1000 files within one minute, which is flagged as suspicious activity, regardless of whether the action was initiated by the user or malware. # Managing Alert Rules To access and manage alert rules, navigate to **Compliance > Alert Rules**. Select an alert rule to edit it. ## Editing an Alert Rule To edit a rule: Modify the relevant parameters in the **General**, **Scope**, **Filters**, **Triggers**, and **Response** sections of the **Rule Criteria** as needed. Note Administrators can define and customize response options using the administrative client. ## Duplicating an Alert Rule To duplicate an alert rule: 1. Select **Duplicate** from the Actions menu on the alert rule you wish to duplicate. 1. The Duplicate Alert Rule screen appears with all the definitions of the original rule pre-filled. 1. Make any necessary changes. Note Duplicating a discard rule creates a new rule with definitions similar to the existing discard rule. ## Deleting an Alert Rule To delete an alert rule: 1. Select **Delete** from the Actions menu on the alert rule you want to remove. 1. A confirmation prompt appears asking if you are sure you want to delete the rule. ## Scope The Scope setting allows you to define the relevant targets for running an alert rule. - **Scope Inclusion**: This enables users to specify the application type, application, or specific business resource where the alert rule should be applied. - **Scope Exclusion**: This allows users to exclude specific application types, applications, or business resources from the rule’s scope. Note If the same resource is selected for both inclusion and exclusion, the resource will be excluded, as exclusions always take precedence over inclusions. - **Resource Scope Selection**: Users can choose to apply the rule to a specific subfolder by checking the **Including subfolders** checkbox. **Example:** If the business resource “Sensitive folder” contains a subfolder named “Non-sensitive folder,” and the user deselects the **Including subfolders** checkbox, the rule will apply only to the main resource, **Sensitive folder**, and exclude the subfolder **Non-sensitive folder**. ## Filters Note If an application has a Data Enrichment Collector (DEC), the attributes of that DEC will also be displayed. However, if you select multiple applications from the same application type and they share the same DEC, only the common DEC attributes will be shown. If there are no common DECs, only the attributes relevant to the selected application type will be displayed. ### Filter Criteria Filter criteria allow users to define suspicious behavior based on specific parameters. The available filter attributes depend on the Scope you select: **If no scope is selected**, or if applications from different application types are chosen, only the following default attributes will be available: - Action Type - Category - Domain - Event Date - Event Time - Path - User Name **If a specific application type or a single application is selected**, or if multiple applications from the same application type are chosen, only the attributes relevant to the selected application type will be displayed. Users can also load saved queries from **Forensics > Activities Queries** by selecting **Load Query**. This displays a list of all saved queries. ### Query Behavior When a query is loaded, all information in the Rule Criteria section (Scope and Filters) is replaced with the loaded query filters. If a query cannot be loaded, an error message displays. ### Queries Not Available - Queries on alerts (only queries on activities can be loaded) - Mismatched queries - Queries involving users from multiple domains ## Response The Response section allows users to define the actions to take when an alert is triggered. For example, when a new permission is added to a sensitive resource, all Data Owners of that resource can be notified via email. ### Response Options A response may include one or more of the following actions: - **Email**: Send notifications to specific email addresses, and/or to the Data Owners of the resource. Note The Data Owners option is available for **Single Activity Alerts**, but not for **Threshold Alerts**. - **Syslog**: Send the alert information to a Syslog server. - **User Exit**: Trigger a custom user-defined exit process. ### Setting Up an Alert Response 1. Create or edit a Response object in the Administrative Client. 1. Select **Advanced Settings** to choose additional response options. Note The Administrative Client is required to define and customize response options. ### Default Response The File Access Manager Alert Response is an automatic default. This ensures the alert is retained in the database, and users cannot opt out of this response. ## Resource-based Alert Rules Data Owners can activate **Resource-Based Alert Rules** (pre-configured alert rules) from the **Resource > Alerts** screen. Administrators can manage these Resource-Based rules created by Data Owners through the **Compliance > Alert Rules** section, where they can perform the following operations: - View the rule - Modify the rule’s name and description - Change the rule’s status (activate or deactivate) - Delete the rule # Threshold Alert Rules The Activity Analytics service is responsible for calculating thresholds and triggering threshold-based alerts. Activities are evaluated against threshold alert rules by the Event Manager during the activity processing. If activities match the threshold criteria, they are marked as candidates for threshold calculations. The Activity Analytics queries the Elasticsearch defined interval to gather activities candidate for threshold alerts. These activities are aggregated, and when the threshold is met, an alert is issued along with a response based on the threshold alert rule definition. ## Limitations If there is a temporary disconnection between Activity Monitoring and the Event Manager, activities received more than 15 minutes after their original activity time will be stored in the database with the original timestamp. However, they will not be included in the threshold alert calculation. However, if an alert has already been created, activities received after the 15-minute window will still be added to the existing alert record. This will increase the total number of activities associated with the alert. The 15-minute time window helps limit memory usage required for threshold calculations. For adjustments to the time window, consult the Compass forum for best practices. The PS team can change the time window in the database if necessary. If Windows activities share multiple access paths, duplicate activities may be sent for threshold calculation. For example, an activity in `Folder1` accessed by both `\\MyServer\Folder1` and `\\MyServer\C$\Main\Folder1` will be recorded twice. To prevent duplicate activities from affecting threshold calculations, select **Windows** as the application type in the scope and apply the following filter in the **Alert Rule > Rule Criteria Filter** section: - **Attribute**: `Original Access Path (OAP)` - **Operator**: `Empty` All duplicated Activities have the OAP field as part of the original path. Adding this filter causes the Threshold Alert Rule to ignore all duplicated Activities and to calculate only the original Activity. ## Create/Edit a Threshold Alert Rule For instructions on creating a **Threshold Alert Rule**, refer to the relevant section. Note Only Administrators, not Data Owners, can view threshold alerts in Activity Forensics or in Reports. # Troubleshooting Activities The best way to troubleshoot activities is to follow their activity trail. Use a specific Collector Installation and Configuration Guide to troubleshoot a specific monitoring issue for a given Activity Monitor. The lists below are suggestions of what to look for in the various services. # Viewing Existing Alerts To view the current alert rules, navigate to **Compliance > Alert Rules**. All alerts, including those in the **Resources** section, are displayed on this screen. To view resource-based alerts, select **Include Resource-based Rules**. You can filter the alert list by: - **Rule Name** - **Status** – Activate or deactivate an alert rule directly from the main screen, without needing to access the rule details. # File Access Manager Connector Matrix This matrix is as of 8.5. | | | | | | | | | ---------------------------------------- | ------------------------------- | ------------------- | ----------------------- | ----------------------- | ----------------------- | ---------------------- | | **Target System** | **Product** | **Connector Type** | **Activity Monitoring** | **Permission Analysis** | **Data Classification** | **Access Fulfillment** | | Base Product | Microsoft Active Directory | Agentless | ✓ | ✓ | N/A | - | | Microsoft SQL Server | Agentless | ✓ | ✓ | - | - | | | On-Premise File Storage | Microsoft Windows | Local Agent | ✓ | ✓ | ✓ | ✓ | | Microsoft SharePoint | Agentless | ✓ | ✓ | ✓ | ✓ | | | Microsoft Exchange | Agentless | ✓ | ✓ | - | - | | | NFS v3/v4 | Agentless | -\* | ✓ | ✓ | - | | | Generic Table | Agentless | ✓ | - | - | - | | | Linux | Agentless | -\* | ✓ | ✓ | - | | | NAS File Storage | NetApp for CIFS | Agentless (FPolicy) | ✓ | ✓ | ✓ | ✓ | | NetApp for NFS | Agentless (FPolicy) | ✓ | ✓ | ✓ | - | | | EMC Celerra/VNX/Unity for CIFS | Agentless (CEPA) | ✓ | ✓ | ✓ | ✓ | | | EMC Celerra/VNX for NFS | Agentless (CEPA) | ✓ | ✓ | ✓ | - | | | EMC Isilon for CIFS | Agentless (CEPA) | ✓ | ✓ | ✓ | ✓ | | | Hitachi HNAS | Agentless | ✓ | ✓ | ✓ | ✓ | | | DFS for CIFS | Agentless | ✓ | ✓ | ✓ | ✓ | | | Generic CIFS | Agentless | -\* | ✓ | ✓ | - | | | O365 File Storage | Microsoft OneDrive for Business | Agentless | ✓ | ✓ | ✓ | - | | Microsoft SharePoint Online (Office 365) | Agentless | ✓ | ✓ | ✓ | - | | | Mircosoft Exchange Online (Office 365) | Agentless (CEPA) | ✓ | ✓ | - | - | | | Cloud File Storage | Box | Agentless | ✓ | ✓ | ✓ | - | | Dropbox | Agentless | ✓ | ✓ | ✓ | - | | | Google Drive | Agentless | ✓ | ✓ | ✓ | - | | | CTERA | Agentless | - | ✓ | ✓ | - | | | AWS S3 | Agentless | -\* | ✓ | - | ✓ | | | Azure Files | Agentless | -\* | ✓ | ✓ | - | | # Data Classification Data Classification categorizes and tags business resources (BRs) based on the following: - Content - Behavior - Imported designation Classification is done by identifying resources with specific data or resources accessed by specific user types, according to standard and user-defined policies. This section describes the data classification feature in File Access Manager and the operations available on the web application, which can be found by navigating to **Compliance > Data Classification**. ## Overview File Access Manager's Data Classification engine is a mechanism to classify organizational data and apply categories based on both content and behavioral analysis of files and Business Resources (Data Assets) residing on various applications. You can use Data Classification to create policies and rules to address well-known or widely used regulation compliance requirements such as GDPR, CCPA, HIPAA, ICD, LPGD, and more. The Data Classification mechanism provides both content-based and behavioral-based analysis of files and BRs residing on various applications, which facilitates their classification into categories based on those analyses. Content-Based Classification parses and indexes the files’ textual content and searches for specific patterns according to predefined sets of rules. These patterns can consist of sensitive keywords or keyword lists, complex regular expressions representing patterns such as Social Security Numbers (SSNs) and credit card numbers, and other user-defined parameters. Behavioral-Based Classification analyzes the activity information gathered by File Access Manager and can be used to classify business resources (BR) based on the type of users who access the files frequently. **Content-Based Classification** - Searches files for specific content of interest, such as SSNs, credit card numbers, health records, etc. **Behavioral-Based Classification** - Analyzes BRs according to properties of users who access this data. For example, if members of the board of directors or members of the finance department regularly use these BRs. The classification of both content and behavioral data depends on user-configurable criteria. Classification results can serve as a data source on their own and can form the basis of queries on the forensics screens (See the chapter on forensics). However, classification results also serve as an additional information layer, associated with activities and permission data. The classification results layer connects all other layers with data. The Data Classification module supports using external classification of files in one of the following methods: - **DC Import** - Importing a spreadsheet into File Access Manager listing files and directories assigned to categories. - Writing to file properties, and creating rules in File Access Manager, assigning categories to files that contain those properties. These methods can even be used for encrypted files without File Access Manager reading the file content. ## Classification Architecture and Flow Architecture The Data Classification content indexing is performed by the Central Data Classification services and their associated Collectors. Architecture has additional information on the possible deployment models and how to scale the Data Classification Collectors to achieve greater speed and performance. The Central Classification service reads the BRs eligible for indexing and sends them to the Collectors. The Collectors index the files in the received BRs according to the defined data classification policy, and send the results back to the Central Service to be saved in the database. The Collectors no longer keep a persisted full text index on disk, since all the processing is done in-memory. ### Content Classification Process The classification processes (run concurrently and independently) include: - Classification Policy Management and Update - Running a Content Indexing task - Querying and Retrieving Results ### Classification Policy Management and Updates Once a Content Indexing task is issued, the Data Classification Engine reads the most updated policy definition. That policy definition will persist through the duration of the Content Indexing task. Any changes made to the policy definition after the Content Indexing task has been started will not be reflected in the current classification process. ### Indexing Flow The classification engine Content Indexing Task: 1. The central service retrieves the BRs to be indexed from the File Access Manager database, but only when: 1. This is the first indexing run of a business resource 1. The last modified business resource date is more recent than the last business resource indexing date 1. The business resource is included in the Scope of the Application 1. The business resource is not contained in a de-duplicated share 1. If the data classification policy was changed from the last indexing tasks, all the BRs will be re-indexed 1. The central service sends the BRs to the Collectors. 1. The Collector retrieves the list of files in each business resource. 1. Reads the content of each file. 1. Indexes and classifies the file content and sends the results to the Central Data Classification to be saved into the database. ### Data Classification Deduplication Scan In CIFS systems, it is possible for multiple shares to point to the same physical address (where they are considered “duplicate shares”). To minimize the running time of the Data Classification task, these duplicate shares are identified, and shared data is scanned only once. When a user queries the **Forensics** tab of Data Classification, the classification results are reflected through all duplicate shares. The following scenario involves four shares in a Windows server: - Share1 points to D:\\ - Share2 points to D:\\folder1 - Share3 points to D:\\ - Share4 points to E:\\ The results of the deduplication scan will be: - Share1 will be scanned completely. - Share2 will be skipped, since Share1 contains Share2. - Share3 will be skipped, since Share1 is equal to Share3. - Share4 will be scanned completely. When a user queries the **Forensics** tab of Data Classification, the user will receive the results of all shares. ### Limitations and Known Issues If the Crawler excludes BRs in contained shares, Data Classification will not classify those BRs. ### Re-Indexing Scenarios Every data classification policy change will cause all the BRs to be re-indexed on the next indexing task. The assumption is that the policy remains static and unchanged after the implementation and testing phase are completed. File Access Manager provides different features to limit the scope of the indexed BRs to be able to test the policy changes faster, such as Scoping and Run a Specific Resource Classification task. ### File Access Manager Text Search The Data Classification engine uses Lucene as its primary, text-based optimized database. The Lucene database provides term-based search capabilities, based on the textual content extracted and analyzed from indexed files. To extract textual content from various file types and formats, the classification engine uses a proprietary text extraction library, which is able to extract the file content based on its type. Based on the extracted content, the Lucene indexing service parses and analyzes file content into an index of searchable terms. The full content of the files itself is not saved as part of the index, which allows the index to remain relatively small, highly efficient, and optimized for term-based textual searches. When the system compares a Content Classification request with the textual index, it parses and translates the various policy rules into term-based search queries. Query results, representing files that correspond to the rules’ requirements, consist of file names, extensions, and full path locations, along with other attributes. In certain cases, results may include an actual term or phrase that matches the rule-based query, rather than the full content of the file. **Regular-Expressions** - Regular-expression-based rules involves matching regular-expression patterns with a file during the process of reading the file content, and not comparing the pattern with a term-based index. **Lucene’s Indexing Process** - While it parses and analyzes the content data, the Lucene index analyzer eliminates white spaces, certain punctuation characters, and “stop-words” from the content. Stop-words are a predetermined set of frequently used words with diminished semantic significance, such as pronouns and prepositions. Lucene filters stop-words to keep the index manageable, to eliminate “white noise,” and to improve search heuristics. Lucene analyzes and tokenizes file content into searchable terms based on the white spaces and stop-words omitted from the original text. The tokenizing algorithm affects Data Classification policy rules. **Multi-term Phrase-Based Rules** - The Data Classification engine allows both single-term keyword searches and multi-term phrase searches. Lucene omits any “stop-word” contained in a multi-term search phrase. For example, a rule containing the phrase “It was the best of times, it was the worst of times,” will classify the file containing the entire sentence, as well as any file containing a contiguous phrase, such as “best times worst times.” To avoid possible false-positive classification, it is best to restrict multi-term phrase searches to meaningful, contiguous terms. ### Chinese and Logogrammatic Languages Some scripts, such as Chinese, represent words by symbols (logograms), and a single word may consist of one or more logograms. Furthermore, while most languages use white spaces to separate words, Chinese, as well as other logogrammatic scripts often do not separate words by spaces. The combination of these two phenomena, along with Lucene’s omission of white spaces, will cause phrase searches in Chinese (with multiple logograms, separated by spaces) to return positive matches for files containing the same sequence of logograms, regardless of the spaces between them. Thus, a rule containing the phrase “莦 莚 虙贄 蹝 轈”, will classify files containing phrases that consist of these logograms, regardless of spaces. Therefore, the phrases “莦莚虙贄蹝轈,” “莦莚虙贄蹝轈”or “莦莚 虙贄 蹝轈”,and “莦 莚 虙贄 蹝 轈,” will all be classified by the rule defined above. However, single term keyword searches of words consisting of multiple logograms, and phrases not separated by spaces, will return correct, exact match results: a rule containing the term “莦莚虙” will only classify files containing that exact term. If more complex phrases are required, a rule containing multiple phrases with the “Contains All” operator will give the desired results. ## Optical Character Recognition (OCR) File Access Manager can identify text from within image files either directly or embedded in other files – such as scanned documents or a collection of scans stored in a zip file. Files less than 1000 pixels across will not be scanned to avoid less reliable results from low-resolution images. The data privacy engine can analyze files containing sensitive data in image form. Note The optical character recognition process is resource-intensive and should be configured carefully taking the run-time into consideration. It is disabled by default. OCR capability can be added to the scope selected in the **DSAR Scope** screen. ### Enabling Optical Character Recognition In the case of OCR scanning, enabling will cause the next task to re-index the Data Classification. Disabling the OCR capability will not initiate re-indexing. This means that once files are marked as sensitive, we can turn off the resource intensive optical character recognition process without removing this indication, until any other filtering setting is changed. By default, optical character recognition is disabled on the entire scope of the **DSAR**. To enable optical character recognition on a resource, edit the application scope line. 1. Find the desired application from the **DSAR Scope** screen. 1. Select **Edit**. 1. Select **Optical Character Recognition (OCR)** to enable OCR analysis for this application. ### Image Quality and OCR Accuracy The clarity of the input image significantly affects the accuracy of text extraction. For best results, images should have a resolution of 300 dpi and a font size of at least 10 pt. Images with lower resolution can still be processed, however, the accuracy may be reduced. The Document Filters feature automatically checks image quality and skips any image with a width of less than 1,000 pixels, as these are too low for reliable OCR processing. # Application Scope Use this screen to view and set the scope of applications and resources on which to apply Data Classification policies. In the web client, navigate to **Compliance > Data Classification > Application Scope**. The scope list includes only applications with installed Data Classification. It is only possible to install Data Classification on an application in the administrative client. The column **Optical Character Recognition (OCR)** indicates whether the application has OCR activated on part or all of its resources. The scope definition directly affects the time required for Data Classification indexing. Activating Optical Character Recognition on resources is a resource-intensive process, and should be configured carefully. For example, to reduce Data Classification indexing, an Administrator can: - Exclude an application from Data Classification indexing (if “non-sensitive” data is saved by default on that application). - Include a specific resource (one with very important data) for Data Classification indexing. You can specify which resources to use (and which to exclude) from a selected application by selecting the **Edit** button to the right of the application. While the Data Classification status (Active/Inactive) can only be changed from the administrative client, non-administrator users can view the status in the Web application. The Scope definition only takes effect after the next run of the Data Classification task. Only the business resources of an application selected for editing display on the list. ## Editing the Application Scope 1. Select **Edit** to modify the scope (such as folders), and/or the OCR setting of the Data Classification per application. 1. Find the desired application from the **Application Scope** screen. 1. Select **Edit**. This opens the Application Scope Edit screen. To change the scope to include in the Data Classification process: 1. Select the scope type: - **All** – Run Data Classification on all the resources in the application. - **Resource** – Select from a list of resources to include. To exclude resources from the Data Classification process: 1. Select **Add Exclusion** to open the exclusion entry field. 1. Select resources to exclude from the dropdown list. To remove the exclusion of resources from the Data Classification process: 1. Select **Remove Exclusion**. ## Enabling OCR 1. Select **Optical Character Recognition (OCR)** to enable/disable OCR analysis for this application. 1. Select the resources to exclude from the OCR analysis from the dropdown resource tree. Note All resources selected in the Data Classification scope will include all subfolders (or parallel resources, per application) as well. The checkbox “**Including subfolders**” cannot be unselected. Note Changes to the scope or activating the OCR on an application will trigger a re-indexing in the next run of the Data Classification task. Note Deactivating OCR on an application will not trigger re-indexing. Section **Selecting Scope for Alert Rules** has additional information on scope inclusion and exclusion. # Creating a Behavioral-based Classification Rule Note You must enable the “Classify behavioral rules” task in order to run behavioral-based rules. In the process of creating a behavioral-based classification rule, File Access Manager performs an AND operation between the expressions. However, some operators act as an internal OR (for example, the **IN** operator). To create a Behavioral-based rule: 1. Open the rules page by navigating to **Compliance > Data Classification > Rules** 1. Select **+ New Rule > Behavioral Based Rule**. The available Behavioral-based Rule fields include: - **Rule Name** - Rule names are unique. It is best to create a naming convention that avoids using the same name twice. - **Categories** - Enter one or more categories for the rule. To add a new category to the **Categories** list, select **Manage Categories** and add a new item. - **Behavioral Requirements for Rule** - Specifies the threshold and timeframe for categorizing BRs according to the users accessing these files.\ Example threshold configuration: “at least 25% of the users with activities on files in this folder are members of the Finance department.” 1. Define the timeframe and required usage: - **Value** - Percentage required to meet the rule. - **Timeframe** - The timeframe during which to check the rule. 1. In the **Rule Criteria** section, add the general details to the Behavioral-based Classification rule. 1. Select an **Attribute**, an **Operator**, and a **Value** (optional) from the dropdown menus. 1. Create an expression and select **Save**. Note Users can edit or delete existing rule criteria. 1. Add additional rule requirements as needed. 1. Select **Save** to save the new behavioral-based rule. The system adds the rules to the **Rules** list. ## Scheduling Classify Behavioral Rules Task The Classify Behavioral Rules task is a global scheduled task. It is created out of the box, and is disabled by default. This task runs on all scope on supported applications. All applications, besides the ones listed below, support the classify behavioral rules task. | **File Extension** | **Expected file type** | | ---------------------- | ----------------------------------------- | | NFS (Generic) | No activities | | CIFS (Generic) | No activities | | Generic database table | No file, but if one is added it will work | | SQL Server DB | No file | | AD | No file | | DFS | No activities | | Home-Grown | No activities | | NFS (Generic) | No activities | To schedule the Classify Behavioral Rules task: 1. Navigate to **Settings > Task Management > Scheduled Tasks**. 1. Select the task Classify Behavioral Rules on the Scheduled Tasks table on the tickbox on the task row. This will open the options buttons. 1. Select **Edit** to open the scheduling edit panel. 1. Set the task to active / inactive. 1. Change the scheduling parameters as required. # Classification Types Data Classification types include: - Content-Based Classification - Behavior-Based Classification - Composite Classification ## Content-Based Classification The classification engine indexes data based on file attributes and file contents (for text, office, and PDF files). The classification engine determines the file type by the file extension. ## Behavior-Based Classification Behavior-based classification classifies BRs based on actual user activity. An example of a behavior-based classification rule would be to classify BRs as “Finance” if more than 80% of the activities in the last month were issued by users whose department is defined as Finance in Active Directory. ## Composite Classification In order to comply with complex regulations, it is sometimes required to use additional logic with data classification rules by combining the results of several classifications. The composite data classification rule is based on the File Access Manager categories already classified by the Content and Behavioral rules. Note A Data Classification policy cannot have both composite rules and other types of rules. # Data Classification Components The Data Classification process assigns categories to business resources according to rules. Rules are composed of one or more rule criteria. Rule criteria consist of finding a match within files to one or more string or pattern. The strings can be defined as free text, regular expressions, or one stored as a policy object. A regular expression in a policy object may be accompanied by a verification algorithm to further narrow down the search. Note There are policy objects and verification algorithms out of the box for standard searches, or you can create your own to fit your needs. The classification rule is the main data classification component. Rules also contain sub-components that complete the rule structure, simplify the rule management task, and provide extended functions. File properties can be used for classification of files that is performed by the customer manually or using a third-party application. File Access Manager will read the metadata on the files, and can use them for data classification rules. This will include reading metadata from encrypted files. ## Data Categories The data category (the basic component of data classification) is the tag used when a classification rule is satisfied. To define a data category, open the Manage Categories panel from any of the Data Classification screens. For example: 1. Navigate to **Compliance > Data Classification > Policies > Actions > Manage Categories** or **Compliance > Data Classification > Rules > Actions > Manage Categories**. In the Manage Categories window, type the category name in the **Add New Category** section. 1. Select **Add**. The system adds a new data category to the Current Categories list. Users can edit and delete existing user-defined categories from the Current Categories list. Users can also search categories either by name or by checking the **Show user defined categories only** checkbox. ## Data Classification Policy The Data Classification Policy is a logical container for data classification rules. For example, all the rules that belong to HIPAA should be located under the HIPAA policy. The system already contains several predefined policies, and users can create additional user-defined policies. ## Rules Policies set the rules for detecting sensitive data to be protected by compliance regulation or by organizational procedure. ## File Properties File Access Manager indexes standard attributes, including extension, size, and file name, and also indexes attributes for office files. All the file properties are discovered and created during the indexing process. In the web client, navigate to **Compliance > Data Classification > Rules > Actions > Manage File Properties** or **Compliance > Data Classification > Policies > Actions > Manage File Properties** to open the Manage File Properties window. 1. Type in the file property details. 1. Check the **Custom Properties** checkbox, if relevant. 1. Select **Add**. ## Encrypted files In order to classify encrypted files without File Access Manager reading the file contents, you can tag the files locally according to your classification rules, and use these tags for classification rules (See Local Classification). Note If you choose to tag the file using the Tag's property, it will be called Keywords after being uploaded to File Access Manager. ## Local Classification You can use a local classification for files, tagging files with relevant tags. The metadata of the files are uploaded to the File Access Manager database as file properties in the scanning process. These properties can be used to create classification rules manually. The file properties found will be added automatically to the list of available properties for filtering after the first iteration. In order to have these properties available in the initial run of the Data Classification, add the properties to the property list, as described in [File Properties](#file-properties). ## Policy Objects Policy objects are searches, saved for use in rules. For example, predefined policy objects can search for credit cards. Navigate to **Compliance > Data Classification > Policy Objects** to open the Policy Objects page. 1. Select **New Policy Object**. Data classification policy object fields include: **Policy Object Name** - Name of the policy object. **Description** - Free text description. **Type** - The type of search the policy object performs: ```text - **Keyword** A keyword may be one or more words. If multiple words are involved, the entire phrase will be searched. Note that stop words such as "a" or "and" are stripped from the search keywords. If you want to include stop keywords in the phrase, you can use a regex phrase instead. (For a nerd-level description of ignoring stop words, see [stopwords](https://www.elastic.co/guide/en/elasticsearch/guide/current/stopwords.html)). - **Wildcard** Supports the following special characters: - `*` any number of characters - `?` only one character - **Regular Expression** Using standard regex for defining policies. ``` **Values** - Values to search for: ```text - **Single Value** - **List** – A list of matching values. - **Mask Values** (Regular Expression policy objects only) Masking portions of matched values. - **Display the first characters** – number of characters from the left displayed in the matched value. - **Display the last characters** – number of characters from the right displayed in the matched value. ``` **Verification Algorithm** - A code-based algorithm to enable more complex filtering. See Data Classification Verification Algorithms for further details. Policy objects are a good way to reuse searches containing complex definitions. Select **Save** to complete the New Policy Object process. ### Classification Types #### Regular Expressions Within Policy Objects Regular expressions form the basis for many content pattern searches. File Access Manager uses the .NET regular expression engine as its underlying engine for regular expression searches. All regular-expression definitions and searches must conform to the engine’s restrictions, limitations, and standards. When selecting a policy of type Regular Expression, the New Policy Object panel adds the following fields to the New Policy Object panel. **Verification Algorithm** - A standard, out-of-the-box example is the Luhn verification algorithm. This algorithm ensures that all phrases classified as credit cards are, indeed, valid credit card numbers (as far as an algorithm can validate without contacting the bank, of course). When selected, this verification will only be run on strings that conform with the credit card regular expression entered, for example: `^3[47][0-9]{13}$` See Data Classification Verification Algorithms for a full description on creating verification algorithms. **Mask Values** - By default, the regular-expression matches are saved as part of the results. It is recommended to mask the values of the matches to avoid exposing sensitive data in the File Access Manager database. #### Regex Matching and Case Regex matching is case sensitive by default. To make a regex ignore case, use the prefix “(?!)”. For example: “home” will find “home”, but ignore “Home”. The regex “(?!)home” will find “Home”, “HOME” and “HoMe”. #### Identifying Line Breaks using Regex in File Access Manager For parsed files, line breaks are represented by a single CR (`\r`), instead of (`\r\n`) or (`\n`), and therefore not identified by the regex line boundaries `^` and `$`. If we take this regex: `(?m)(^|\s)up($|\s)` and try to match it with the following text (assuming the line breaks are \\r) `going`, `up`, `up`, `and away!`, it will not match anything since the line breaks are not \\n as expected by the regex. In order to identify the start and end of a line, we have to check for the CR explicitly. The issue is that once we identify an end of line character, the cursor has moved past this character, and we can't use this to identify the start of the next line. If we change the regex to look like this `(\r|\s)up(\r|\s)`. It’s going to match only the first up, since the \\r character will be part of the match and thus not part of the evaluation for the next “up.” We need to check the previous and next characters, without moving the cursor. If we try this regex `(?<=(\r|\s))up(?=\r|\s)`, both “up” strings will be matched. This is because of two modifications: - **(?\<=...) positive lookbehind** - When there’s a match, it moves back to assert whether the regex that replaces “...“ is matched, but then discards the match and moves forward to where it was to continue matching. - **(?=...) positive lookahead** - When there’s a match, it moves forward to assert whether the regex that replaces “...“ is matched, but then discards the match and moves back to where it was to continue matching. Combining those two means the match contains only “up” without the preceding or following \\r, so they can be used for more matches. These non-capturing matches are known as zero-length assertions. For more information on lookahead and lookbehind assertions (collectively called lookaround) see . **Examples** - To look for rows starting with "John," you could use: (?\<=\\r|^)John.\*(?=\\r|$) To look for rows ending in "Doe," you could use: (?\<=\\r|^).\*Doe(?=\\r|$) # Composite Rule A composite classification rule lets you combine several rules together to form a more complex criterion. This can include content and behavioral type rules and is defined by category. The data classification matches content or behavioral patterns to rules and assigns categories to resources according to these rules. After running data classification, composite rules use combinations of categories to define complex combinations of simple rules. **Examples:** - Combine Personal Identification Information (PII) in conjunction with health-related information (ICD) to define a rule to identify Personal Health Information (PHI). - Create a rule to list files that have at least two out of one list of categories and must contain another specific category. - Identify all resources that would be defined by rules that belong to category **X**. To define a composite classification rule: 1. Select **one or more categories**, and the created rule will be triggered for any existing rules within the selected categories. **Example Rule:** If we define a rule as follows: Contain at least 2 of PII, ICD This will add all business resources that fulfill any of the rules in the PII category and any of the rules in the ICD category. The value column allows selecting one or more categories from the category repository. ## Triggering the Composite Rules Composite rule tasks are triggered after each data classification task and evaluate results from that application only. - The composite rule runs after all content and behavioral rules, as it is based on their results. - If you change a composite rule, this change will take effect only when a new classification task is executed and triggers the composite rule. Note This task cannot be scheduled. ## Creating a Composite Classification Rule To create a composite classification rule: 1. Open the rules page by navigating to *Compliance > Data Classification > Rules\**. 1. Select **+ New Rule > Composite Classification Rule**. **Rule Name** - Rule names are unique. It is best to create a naming convention that avoids using the same name twice. **Categories** - Enter one or more categories for the rule. To add a new category to the Categories list, select **Manage Categories** and add a new item. 1. In the Rule Criteria section, add the desired combination of categories to trigger the rule. **Operator** - Enter the number of concurrence of categories in the business resource tested for this criterion. ```text Example: - If you want the rule to collect BRs that fit both criteria **C1** and **C2**, set: - **Operator**: `Contain at least 2 of` - **Value**: `C1, C2` ``` **Value** - Enter one or more categories from the search box. 1. Select **Save** to save the criterion. 1. Select **+ Add** to add another criterion. All criteria will be combined with an **AND** operator. 1. Select **Save** to save the new composite classification rule. The system adds the rules to the Rules list. # Content-Based Classification Rules A content-based classification rule specifies file attributes, as well as data patterns within the files, that fit a particular type of data. For example, credit card numbers, driver's license numbers, text files created last month by user `X@domain.com`. Each such rule is associated with a category. ## Creating a Content-based Classification Rule In the process of creating a content-based classification rule, File Access Manager performs an AND operation between each expression. However, some operators act as an internal OR (for example, the `IN` operator). To create a Content-Based rule, complete the following steps: 1. Navigate to **Compliance > Data Classification > Rules**. 1. Select **+ New Rule > Content-Based Rule**. The available Content-Based Rule fields include: - **Rule Name** (mandatory field) - Rule names are unique. It is best to create a naming convention that avoids using the same name twice. - **Categories** - One or more categories to tag files that meet rule requirements. To add a new category to the **Categories** list, select **Manage Categories** and add a new item. 1. In the web client, navigate to **Compliance > Data Classification > Rules > New Rule >**. 1. In the **Rule Criteria** section, add the general details to the Content-Based Classification rule. Users can search for existing rules, using filters. Users can perform the following actions on rules: - **Edit** (only user-defined rules) - **Duplicate** - **Delete** (only user-defined rules) 1. Create an expression and select **Save**. Note Users can edit or delete existing rule criteria. 1. Add additional rule requirements as needed. 1. Select **Save** to save the new content-based rule. The system adds the rules to the **Rules** list. # Creating a Data Classification Policy Creating a data classification policy involves defining several policy details to make the policy unique. Any new policy can be used as a template and the basis for additional policies. To create a new policy: 1. In the web client, navigate to **Compliance > Data Classification > Policies > New Policy**. The available Classification Policy fields / buttons that display in this window include: - **Policy Name** - Policy names are unique. It is best to create a naming convention that avoids using the same name twice. - **Activate/Deactivate Policy** - Users can activate or deactivate a policy using this button. - **Owner** - The login user is the creator of the policy. (This field is read-only.) - **Description** - Free text. 1. Users can add existing rules or create a new rule for a policy: - Add an existing rule, using the **Add Rule** search field. - Select **+New Rule** to add a new rule. The rule you added displays in the Rules Assigned list. Users can perform the following actions on rules: - **Activate/deactivate** - **Edit** (only user-defined rules) - **Remove** 1. Select **Save** to save the new policy. The system adds the policy to the **Policies** list. To search for an existing policy: 1. Navigate to **Compliance > Data Classification > Policies**. Search for existing policies by typing a name or part of a name in the following search fields: - **Policy Name** - **Owner** 1. Search by status by selecting an option from the **Status** dropdown menu. Fine-tune the search even further by selecting an option from the **Scope Type** dropdown menu or by typing a name or part of a name in the **Application Type** search field. You can perform the following actions on a selected policy: - **Activate/deactivate** - **Edit** (only user-defined policies) - **Duplicate** - **Delete** (only user-defined policies) # Data Remediation Policy A Data Remediation policy is a set of policy rules, which govern actions that are run on the basis of the Data Classification process results. Each File Access Manager deployment has a data remediation policy that spans all the deployment’s applications. Each Data Remediation rule consists of: - **Categories** - The data classifications of a file that triggers the specific rule. - **Scope** - Whether the rule should be triggered by application, by application type, or should not be limited by either [unlimited]. - **Script path** - The path to a script to be executed on the files that match this category. Note The script must be written in PowerShell and can accept both the filename and the category as parameters, and return an error message in case it fails. A Data Remediation script is executed on a file that matches one of the Data Remediation rules. Each rule can run a single script. The Data Remediation scripts are executed by the installed Application’s Data Classification service. The service periodically queries the database for new scripts which are pending for execution, and in turn executes them and writes the execution results to the logs. You can track the execution of the Data Remediation rules by generating log reports. To set a Data Remediation Policy, navigate to **Compliance > Data Classification > Data Remediation**. The data remediation has the following options: - **Generate Report** - Run or schedule a report based on the remediation rules, according to the requested time period. - **New Rule** - Create a data remediation rule. Each Data Remediation line has the options **Edit** and **Delete**. Note Data Remediation allows you to run any operation on classified files. This also includes encrypting. # Create a Data Remediation Rule To set a new Data Remediation rule: Navigate to **Compliance > Data Classification > Data Remediation** Fill in the following fields: - **Rule Name** (mandatory) - **Description** - **Categories** - Select at least one category from the dropdown list. - **Script Path** - The path to the PowerShell script to run. Since the script is executed by the data classification service, the path must be relative to the server in which the data classification service is installed. If this action will be run by multiple data classification services serving different applications, all services must be able to access the path. - **Scope Type** - Select the scope to apply to the rule by selecting one of the following: - **All** (default) - **Application Type** - **By Application** - **Application** - Select one or more applications by marking the tickboxes in the dropdown list. - **Application Type** - Select one or more application types by marking the tickboxes in the dropdown list. - **Frequency** - Select an execution interval. - **Run Now** - One-time run. - **Run now and Every X Hours** - The default is 24 hours. Set an interval between 1-99 hours. Select **Save & Run**, or **Cancel**. ## Edit a Data Remediation Rule 1. To edit a Data Remediation rule, navigate to **Compliance > Data Classification > Data Remediation [Select policy] Edit Rule** icon. 1. The Edit Data Remediation Rule screen displays. Follow the steps described above. 1. Select **Save & Run** or **Cancel**. If you click **Save & Run** at any stage of editing a data remediation rule, it will cause the assigned actions to execute immediately. This is true even if no changes were made. ## Delete a Data Remediation Rule To delete a Data Remediation rule, navigate to **Compliance > Data Classification > Data Remediation [Select policy] Delete Rule** icon. ## Log Reports You can track the execution of the Data Remediation rules and actions by generating log reports. To view Data Remediation reports, navigate to **Compliance > Data Classification > Data Remediation**. 1. Select the **Generate Report** menu option. This will open the report dialog box. 1. Select **Produce Now** to produce the report now, or click **Schedule a New Report** to schedule the report. 1. If you selected **Schedule a New Report** in the previous step, select one of the following scheduling options: - Last Day - Last 7 Days - Last 30 Days - All ## Writing a PowerShell Script for Data Remediation The File Access Manager administrator must provide a path to a valid script to perform the desired action. That script must be written in PowerShell and return either nothing (or an empty string) to indicate success, or a string message to specify an error in case of failure. The script receives 2 parameters when it's executed: 1. A string which represents the full path of the file upon which the action should act. 1. A string which represents the category which caused the action to be executed. Any credentials needed for the script to operate must be provided within the script. # Global Rules Global Rules are policy-level classifications, designed to enable complex searches for advanced classification scenarios. They allow Compliance Managers and users to define content classifications criteria that span across multiple data points and categorizes or labels files only when they span multiple data dimensions and satisfy multiple rules. Thus, Global Rules allow Compliance Managers to apply more sophisticated policies to classify their data more accurately, get more targeted results, and reduce compliance clutter. By supporting adjustable thresholds for classifications, Global Rules give compliance professionals the flexibility and agility they need to tailor their compliance suites to the needs of their organization, their internal criteria, and regulatory requirements. Note Policies can only contain one Global Rule. Note Policies provided by SailPoint like the GDPR and PII Policies, have built-in Global Rules. These can be adjusted based on the organization's needs. Note Users are able to add and adjust Global Rules to all user-created policies. Note Adding or removing Global Rules from SailPoint delivered, out of the box, policies is possible. ## Creating a Global Rule To create a Global rule within a user-defined policy, perform the following steps: 1. Navigate to **Compliance > Data Classification > Policies** to open the rules page. 1. Select **+ New Policy**. The available Policy fields include: - **Policy Name** - Policy names are unique. It is best to create a naming convention that avoids using the same name twice. - **Activate/Deactivate Policy** - Users can activate or deactivate a policy using this button. - **Owner** - The logged-in user is the creator of the policy. (This field is read-only.) - **Description** - Users can provide descriptions to the policies they create to better explain what the policy is meant for and designed to do. You can use this description to describe the logic of your Global rules, as well for additional readability. ```text !!! note To add a Global rule to a policy, a user must first add at least one Content rule. This can be done by either adding a new rule or by adding a pre-existing rule using the Search option. We recommend adding Global rules at the end after the Content rules have been added. !!! note Global rule settings are enabled once Content rules have been added. ``` 1. After adding at least one Content rule, select **New Global Rule**. Provide the following information: - **Rule Name** - Unique name for the Global rule. - **Categories** - The resource will be classified by the Categories when the rule is satisfied. 1. For the Rule Criteria, add the type of categories in the Value field. The dropdown will provide a list of only the categories that are set by the content rules defined within the policy. Creating rule criteria allows you to set a condition that will be satisfied when a set of categories are applied. 1. Select **Save** within the Rule Criteria block. 1. Either add another set of rule criteria or click **Save** to save the new Global rule. ## Global Rule Options Within the Policy screen, a user can either **Edit** or **Remove** a Global Rule from the policy. Select the hamburger menu within the Global rule to see these options. - **Edit** – All options can be edited. - **Remove** – The Global rule will be removed from the policy. Note Global rules cannot be created or removed from out of the box policies. They can only be edited. Caution If you remove a Global rule from a policy, you cannot add it back. A new Global rule will have to be created and added to the policy. ## Global Rule – Rules Screen By navigating to the Rules screen (**Compliance > Rules**), a user can see all of the various rules, including global rules that have been created. These rules will also state what type of rule they are. From the Rules screen, Global Rules can only be deleted (with the exception of OOTB global rules). You cannot edit a Global Rule from this screen. Note If a Global Rule is deleted from the Rules screen, it will automatically be deleted from any corresponding policy. Next to the hamburger menu is a downward arrow. A user can select this arrow to view details, such as categories and criteria, about the Global Rule. ### Filter 1. To view only Global Rules, select the **Filter** icon. 1. In the **Type** dropdown, select **Global Rules**. # Import Data Classification Results To import external data classification results, select the data source that contains the results. This data source must have the following fields: - **Category** - **Application name** - **Full path** - **File name** An additional field, **match count**, is optional. Note The final content of the data classification table might contain duplicate categories if the import process and data classification process contain identical categories. These are added as additional lines in the table. To import data classification results from other data sources: 1. Open the **File Access Manager** website. 1. Navigate to **Compliance > Data Classification > Policies** or **Compliance > Data Classification > Rules**. 1. Select the **Actions** menu > **Import Data Classification results**. 1. Configure the import fields by mapping the data source fields to the **File Access Manager** fields. !!! note The import task will import the match count from the external source, in addition to the fields of the categories. The match count field is imported as a number. If the field mapped to **Match Count** is empty or is not a number, the process will load a null into this field. 1. Set a schedule for refreshing the database from the external source. The schedule can be any of the following frequency types: - Once - Daily - Weekly (default value) - Monthly 1. Select **Save** to store the field mapping and scheduling. To follow the task progress, navigate to **Settings > Tasks Management > Tasks** > “**Value from the Scheduled task name field**” task. To cancel the setup of the import, close the window. ## Data Classification Results File Access Manager provides reports of data classification results. You can filter the results by various parameters, including a **match count**—having a certain sensitive category at either more than, or less than a given threshold. ### Data Classification Results – Report To generate a data classification report, perform the following steps: 1. In the web client, navigate to **Reports > Report Templates**. 1. Use the **Classified Data** tag to locate a specific report. 1. To apply a different filter than one of the existing templates: - Create a duplicate template by selecting **Duplicate** from the template dropdown menu. - Set the filter parameters, and select **Run Now** or **Save** the template for future runs. The report will be available in the **My Reports** screen. Note File Access Manager can import data classification results using the **Import Classification Result** capability. This allows for results to be imported from a created data source. # Policy Scope Use this page to view and define the Data Classification scope of your existing policies and adjust each one by specific applications or application types. By default, every policy will include all applications and application types in the scope. In the web client, navigate to **Compliance > Data Classification > Policy Scope**. 1. Select the **Edit** icon on the desired policy. The Policy Scope overlay displays. From here, the **Scope Type** and the **Application Type** or specific **Application** can be edited. - If **Application Type** is selected, supported applications within File Access Manager will display. - If **Application** is selected, a list of the added applications will display. Note If a **Scope Type** is selected, the **Application Type** or **Application** field is mandatory. 1. Select **Save**. After saving the policy scope, a task is created to re-scan all applications associated with the updated policy. # Run Resource Classification Use this feature to run the Data Classification process on a specific business resource, rather than on an entire application. You can test the Data Classification process faster, since you will only be testing a single resource. In addition, you can run Data Classification faster on a single sensitive resource (for example, one on which many changes were made), than on multiple resources. To run Resource Classification, navigate to **Compliance > Data Classification > Policies** or **Rules > Actions > Run Resource Classification**. # Supported Application Data Classification supports the following applications: - Microsoft Widnows - Microsoft SharePoint - NFS v ¾ - NetApp for CIFS - NetApp for NFS - EMC Celerra / VNX / Unity for CIFS - EMC Celerra / VNX for NFS - EMC Celerra Isilon for CIFS - Hitachi HNAS - DFS for CIFS - Generic CIFS - Microsoft OneDrive for Business - Microsoft SharePoint Online (Office 365) - Box - Dropbox - Google Drive - Ctera - Azure Files ## Supported File Types The privacy engine indexes data based on a file’s content and attributes. The system also supports file properties and custom properties for all supported file types. The privacy engine reads file content based on the file extension. Image files can be analyzed and searched for keywords using an optical character recognition (OCR) capability. This is a resource heavy process and is configured separately. See section Optical Character Recognition (OCR). The Data Classification engine supports the following file types /extensions: | **File Extension** | **Expected file type** | | ----------------------------------------- | --------------------------------------------------- | | docx doc xls xlsx ppt pptx | Microsoft Office files | | txt csv | Plain Text (including Comma Separated Values files) | | htm html xml | Web files | | cs js sql | Code script files | | pdf | | | zip gzip tar rar 7zip | Archive files | | Jpeg jpg tif tiff gif png wmf emf bmp pdf | Image files analyzed by the OCR module\* | The system downloads files from cloud-based content stores and non-CIFS application (for example, Box, DropBox, Google Drive, OneDrive, SharePoint and NFS) to a local directory on the server. Once the indexing process finishes, the system deletes the downloaded files from the indexing server. # Transferring Data Classification Policies Between Systems File Access Manager provides an easy way to transfer data classification policies from one system to another through a command-line interface. Administrators can use the import/export tool to import/export custom policies from one server to another. Note Importing Data Classification Policies can only be done between versions listed in the **Data Classification Importer** section within **Import Data Classification Policies**. Note You must be defined as an Administrator in the File Access Manager administrative client. Note You can only execute the import/export tool in its file working directory. To run the Import/Export tool, perform the following steps: 1. Use the Windows command line to navigate to the following directory: `CD % SAILPOINT_HOME%\FileAccessManager\Server Installer\Tools\PolicyExporter` `CD % SAILPOINT_HOME%\FileAccessManager\Server Installer\Tools\PolicyImporter` 1. In the Windows command line, type: `cd {path to the tool directory}` `PolicyExporter.exe {options}` OR `PolicyImporter.exe {options}` Note The tool argument can be a minus sign (-) followed by a letter in upper case, or two minus signs (--) followed by a word in lower case letters. For example: `-U DOMAIN\USER` OR `--user DOMAIN\USER` The tool validates arguments before performing any action, and the system alerts the user if one or more arguments are missing or are invalid. If you do not provide arguments, a Help screen displays. Each Data Classification Policy is assigned with a unique global ID (GUID). When new policies are imported, File Access Manager compares the GUID’s on both policies to identify them uniquely. Note While the name of the tool is Import/Export, the procedural order is to export data classification policies first. ## Exporting Data Classification Policies Data classification policies are exported with their rules, policy objects, categories, file properties, and rule criteria. The tool transfers an output file to the target server for import. The tool also creates a log file, which the File Access Manager technical support team can use as a reference for troubleshooting. If a policy object includes a verification algorithm created by the user, this DLL file will be exported as well. As noted in **Transferring Data Classification Policies Between Systems**, you must have administrative rights in File Access Manager and use the file working directory. To export data classification policies, perform the following steps: 1. Run the tool with the following selected options: - **-O, --output** (Default: `output_policies.bin`): Specifies the output file location. !!! note The output file is in binary format and cannot be edited. The file location can be either absolute (e.g., `c:\program files\Sailpoint\outputs`) or relative (e.g., `..\..\outputs`). - **-A, --all**: The tool exports all policies available from the current system. - **-L, --policies**: The tool exports specific policies. Each policy is specified by its policy name (not case sensitive), and the names should be separated by commas. Example: `PolicyExporter.exe -U domain\user -L “policy1 – my policy”,”POLICY2 – HIS POLICY”` !!! note Select either **-A** or **-L**, since they are mutually exclusive. - **-U, --user** (Required): This is the name of the user to whom data classification policies are exported. It should include both the username and the domain name (if there is one). - **-P, --password**: The user password validates the export. The system will only prompt you three times to provide a password. - **--help**: The Help screen displays. - **–version**: Displays the version information. ## Import Data Classification Policies Data classification policies are exported with their rules, policy objects, categories, file properties, and rule criteria. The tool creates a file with a summary of what was imported and what was not imported. The tool also creates a log file, which the File Access Manager technical support team can use as a reference for troubleshooting. As noted in **Transferring Data Classification Policies Between Systems**, you must have administrative rights and use the file working directory. To import data classification policies, perform the following steps: Note The only way to run an import or export on the tools is by the command line. 1. Run the tool with the following selected options: - `CD %SAILPOINT_HOME%\FileAccessManager\Server Installer\Tools\PolicyImporter` - -I, --input (Input file location) - The exported output file path (the file location can be either absolute (c:\\program files\\Sailpoint\\outputs) or relative (....\\outputs).) - -R, --override (Default: false). The system recognizes a policy by its unique ID, not by its policy name. Override refers to overriding existing data classification policies and policy rules. - -C, --activate (Default: false). Activate refers to activation of all policies immediately after migration. !!! note The option to activate supersedes the policy and policy rule association on the exported server - if the option to activate is specified will all be activated, otherwise will all be deactivated. - -O, --output (Default: output_stats.txt) The output summary file is in the selected location. The file location can be absolute location (c:\\program files\\Sailpoint\\outputs) or relative (....\\outputs). Examples: - --output ....\\imported.log - -O c:\\temp\\stats.txt - -T, --test (Default: false) Any changes made during this simulation of the importation of policies and policy rules are rolled back afterward, so you can see what has been changed without altering any policies or policy rules. - -M, --multi-output (Default: false) - The output summary is written in one or more files, with a time stamp appended to the file name. Example: `output_stats.180507091022.txt` Note When this option is not used, append the content of the result to the same file, along with the time stamp. - U, --user (Required). - This is the name of the user to whom data classification policies are exported, and should include both the user name and the domain name (if there is one). - -P, --password After inserting all parameters and executing the command, the tool will indicate either a success or fail message (displayed in the command line). It will also create a log file which the File Access Manager Technical Support Team can use as a reference for troubleshooting. 1. If the user needs more information about the File Access Manager version, complete the following in the command line. - --help - The Help screen displays. - –version - The version information displays. Note File Access Manager cannot import a Data Classification policy if the policy name exists. Rename the existing policy and rerun the import procedure. Note File Access Manager cannot import a Data Classification rule if the rule name exists. Rename the existing rule and rerun the import procedure. # Data Classification Verification Algorithms You can use verification algorithms in a Data Classification policy object of type Regular Expression to filter the regular expression results. This will enforce additional restrictions and validations on matched phrases. The verification algorithm will take as an input each one of the data classification policy objects’ regular expression match result strings, and will remove results that do not meet the criteria defined within the algorithm. File Access Manager comes with a set of verification algorithms out of the box for standard verifications, such as Luhn, for credit card numbers, or SSN algorithms. In addition, you can write a verification algorithm, upload it to the File Access Manager website, and use it in data classification policy objects. ## Out of the Box Verification Algorithms Verification algorithms for common rules are pre-loaded in File Access Manager: - Luhn (Credit Card Number) - US SSN - Netherlands BSN - Israeli ID - IBAN - South African ID The dropdown list of verification algorithms in the Rule Criteria screen includes out of the box algorithms, as well as algorithms uploaded by the user. ## Creating a Verification Algorithm The assembly must target .NET Standard 2.1 or .NET 8.0. These will be referred to as the supported .NET platforms. - You may write only one implementation class of the `IDataClassificationVerifier` interface per assembly. - It is only possible to upload one assembly per verification algorithm. In case your code requires usage of additional referenced assemblies, you must pack them all into one assembly. Note Verification algorithm assemblies written in previous versions of **File Access Manager** (in .NET Framework 4.5) must be removed, re-written to target one of the supported .NET platforms as mentioned above, and uploaded again. ### Walkthrough 1. Create a new .NET Framework Class Library targeting a supported .NET platform. 1. In your project, add a reference to the assembly `FAM.DataClassification.Verifiers.dll`. This assembly is provided by SailPoint, and contains the `IDataClassificationVerifier` interface. This assembly can be downloaded from Compass. 1. Create a new class that implements the `IDataClassificationVerifier` interface. 1. This class must provide an implementation of the only public method defined in the interface named **“Verify”**. This method takes as an argument a match result string and returns a boolean that denotes if the verification passed or failed. 1. Build your project, and upload the output assembly as described in the **Verification Algorithms** screen. This uploaded verification algorithm will now be available in the verification algorithm dropdown list of the **Policy Object** screen, alongside the other built-in or uploaded algorithms. ## Examples Below is an example of code to create a verification DLL that verifies that the number passed is even. ```text using FAM.DataClassification.Verifiers; namespace VerificationAlgorithmExample { public class EvenNumberVerificationAlgorithm : IDataClassificationVerifier { /// /// Example for a custom verifier that verifies that the input is an even number /// /// A regular expression match result /// True if passed verification, False if failed public bool Verify(string value) { if (long.TryParse(value, out long parsedLong)) { return parsedLong % 2 == 0; } return false; } } } ``` # DSAR Overview Due to an increasing awareness for privacy, regulators have been led to introduce new Data Privacy and Data Protection requirements in order to protect consumer, health, financial and other sensitive information. In recent years as data has become digitized, more prevalent, and more accessible, these laws and regulations are stricter and are being passed more frequently. These laws are passed with the objective of giving control back to individuals over their personal data. However, the Privacy Regulation landscape is becoming more and more complex and compliance is becoming more and more of a challenge. Recent regulations require organizations to identify and detect personal identifiable information (PII) such as Name, Aliases, Addresses / Locations, SSNs, IDs, email addresses, account numbers, etc. Organizations need be able to respond and disclose all occurrence of a person’s PII data upon request. These requests, often referred to as the Right-of-Access and the Right-to-be-Forgotten, are handled by processes called Data Subject Access Requests (DSARs). Also known as a “subject rights request” or a “privacy rights request,” a DSAR is a submission by an individual (or data subject) to a business asking to know what personal information of theirs has been collected and stored, as well as how it’s being used. Individuals can also use a DSAR to ask organizations to take certain actions with their data, such as deleting it, correcting incorrect data, or opting out of future data collection. Enterprises worldwide are faced with the task of responding to these and thousands of similar privacy requests annually – all of which must be completed within strict time frames. Yet, the current processes to do so are both time-consuming and complicated. There are several clear and distinct steps that most DSARs go through. The biggest hurdle for organizations is the data discovery process – locating individual identity information within huge volumes of unstructured data. Another key challenge is coordinating within the organization between the different stakeholders that need to be involved in correlating, validating and remediating the detected information. Verifying that the remediation was successful and orchestrating and managing compliant responses to requesters and auditors are other tasks that need to be completed. This is especially difficult, as current processes used to identify, correlate, and remediate the data, as well as manage compliance responses, are prone to errors, and aren’t scalable. File Access Manager Privacy Engine includes the DSAR Campaign Workflows capability. Automated DSAR campaign workflows leverage AI-Driven NLP-based data discovery and orchestrates data validation, remediation and verification reviews, to address complex compliance requirements, enable quick collaboration, and considerably cut processing time – enabling organizations to scan, identify, report on and collaborate over the remediation of Personally Identifiable Information. ## DSAR Workflow Processing **DSARs** (Data Subject Access Requests) involves several stages: - Submitting the request – An individual submits a request for information to be disclosed, removed, or edited. - Validating the identity – The organization receiving the request must validate the requester's identity to ensure the request is valid and that the information is disclosed only to the individual or an authorized proxy. - Discovering the data – Typically the longest stage. All PII (Personally Identifiable Information) associated with the individual across all organizational data sources is identified. - Validating the data – Once all PII is discovered, the data needs to be validated to ensure it relates to the data subject. - Remediating the data – If the requester asked for data to be redacted, updated, or removed, this stage will address those requests. - Verifying – Once remediation is complete, ensure the data detected was modified or removed. - Responding – As part of the DSAR response, all data about the individual and the processing it went through is reported, packaged, and securely delivered to the requester. ### File Access Manager DSAR Campaign Workflows File Access Manager DSAR campaign workflows address the Data Discovery, Validation, Remediation, and Verification stages. Once data is discovered by the privacy engine, each campaign workflow consists of the following phases: **Phase One – Data Validation** In this phase, the reviewer is presented with the results based on the campaign DSAR query and scope. The reviewer must review the identified files and decide whether they should be included in the DSAR processing or excluded from further processing (e.g., due to a file being detected by mistake). - All decisions made must be committed to complete the review level. - The review process can involve multiple reviewers at each stage, but a decision on each file can only be made by a single reviewer. - When all results have been confirmed or excluded and committed, the campaign will transition to the Data Remediation phase. The campaign status will change to **"Data Remediation in Progress"** (this status may take a few moments to update). Note Information Disclosure DSAR Campaigns do not include a Data Remediation phase. See the DSAR Campaign Purposes section for more information. **Phase Two – Data Remediation** In the Data Remediation phase, all files confirmed for further processing are included. Reviewers will collaborate and report the completion of remediation tasks, such as redacting or removing PII data, or excluding files from remediation due to compliance issues. - After files have been reviewed and acted on, the reviewer must either: - Mark the files that have been acted on as **Done**. - Mark data that cannot be acted on as **Excluded**. - Once all files are marked as Excluded or Done and everything has been committed, the DSAR campaign status will change to **Data Remediation – Completed** (this status may take a few moments to update). Note The status of the campaign may take a few moments to be updated. **Phase Three – Data Verification** The purpose of the Data Verification phase is to verify that the remediation actions were performed correctly and that all detected information has been addressed (whether it was removed, redacted, or changed). Once verification is initiated: 1. A task will be created. Wait until it is finished (this can take a while). 1. The campaign status will change to **Verification in Progress**. 1. When the task is finished, the campaign status will change to **Verification is Done**. Note If the verification task fails, the campaign status will change to **Verification Failed**. To view the campaign verification results, navigate to **Compliance > DSAR Management > DSAR Campaign Details**. **Verification Statuses:** - Failed: If the requested campaign query yields results on a file, it will be marked as Failed. - Verified: If the requested campaign does not yield results on a file, it will be marked as Verified. - Verified with Exceptions: If the requested campaign yields results but with exceptions, it will be marked as Verified with Exceptions. - Unable to Verify: If the file is not accessible or does not exist, it will be marked as Unable to Verify. In this phase, the administrator or compliance manager can decide to: - Override a failed campaign. - Reassign it to another reviewer. - Force it back into the remediation phase. ## Supported Applications Data Classification supports the following applications: - Azure Files - Box - Ctera - DFS for CIFS - Dropbox - EMC Celerra/VNX/Unity for CIFS - EMC Celerra/VNX for NFS - EMC Isilon for CIFS - Generic CIFS - Google Drive - Hitachi HNAS - Microsoft OneDrive for Business - Microsoft SharePoint Online (Office 365) - Microsoft SharePoint - Microsoft Windows - NetApp for CIFS - NetApp for NFS - NFS v3/v4 ## Supported File Types The privacy engine indexes data based on a file’s content and attributes. The system also supports file properties and custom properties for all supported file types. The privacy engine reads file content based on the file extension. Image files can be analyzed and searched for keywords using an **Optical Character Recognition (OCR)** capability. This is a resource-heavy process and is configured separately. See section **Optical Character Recognition (OCR)**. The Data Classification engine supports the following file types/extensions: | **File Extension** | **Expected file type** | | ----------------------------------------- | --------------------------------------------------- | | docx doc xls xlsx ppt pptx | Microsoft Office files | | txt csv | Plain Text (including Comma Separated Values files) | | htm html xml | Web files | | cs js sql | Code script files | | pdf | | | zip gzip tar rar 7zip | Archive files | | Jpeg jpg tif tiff gif png wmf emf bmp pdf | Image files analyzed by the OCR module\* | The system downloads files from cloud-based content stores and non-CIFS application (for example, Box, DropBox, Google Drive, OneDrive, SharePoint and NFS) to a local directory on the server. Once the indexing process finishes, the system deletes the downloaded files from the indexing server. ## Optical Character Recognition (OCR) File Access Manager can identify text from within image files either directly or embedded in other files, such as scanned documents or a collection of scans stored in a zip file. Files less than 1000 pixels across will not be scanned to avoid less reliable results from low-resolution images. The data privacy engine can analyze files containing sensitive data in image form. Note The optical character recognition process is resource-intensive and should be configured carefully, taking the run-time into consideration. It is disabled by default. OCR capability can be added to the scope selected in the **DSAR Scope** screen. ### Enabling Optical Character Recognition By default, optical character recognition is disabled on the entire scope of the DSAR. To enable optical character recognition on a resource, edit the application scope line. 1. Find the desired application from the **DSAR Scope** screen. 1. Select **Edit**. 1. Select **Optical Character Recognition (OCR)** to enable OCR analysis for this application. ## Privacy PII Detection Architecture and Flow The File Access Management Data Privacy feature is powered by SpaCy, an open-source library for advanced natural language processing (NLP) textual analysis. Using the SpaCy AI model, File Access Management can detect names and addresses through contextual analysis of the scanned documents' contents. ### Text PII Detection File Access Management uses various tools to detect PII (Personally Identifiable Information): - Name and Address – Using the SpaCy NER (Named Entity Recognition) module with the SailPoint custom trained model, File Access Management can detect both names and addresses. - Identifications (Social Security Numbers, Employee ID Numbers, etc.) – File Access Management uses regular expressions to identify IDs. - Emails – File Access Management uses SpaCy’s built-in email regular expression pattern to detect email addresses. - Phone Numbers – File Access Management uses SpaCy’s pattern matching feature to detect phone numbers based on predefined formats. The Privacy PII detection engine will attempt to match both local and international phone number patterns if they comply with the standard format of the relevant country. | **Supported Formats** | **Unsupported Formats** | | --------------------- | ----------------------- | | +1.253.215.8782 | 1300030886 | | (212) 465-6471 | 22.4389483 | | (212) 465-6471 | | ## PII Search and Relevancy Scoring The File Access Manager Privacy Engine will search for all submitted PII search criteria. Search criteria marked as "Required" will be mandatory. If a file does not match these criteria, it will not be returned as a result. Search criteria that are not marked as "Required" will not exclude a file if not matched, but will contribute to the overall relevancy score. ### Relevancy Score A document relevancy score signifies the accuracy percentage between the document content and the search criteria. The higher the relevancy score, the higher the probability the information matched belongs to the individual whose details we've entered in the search criteria. The more elaborate and well-defined the search criteria is, the better accuracy the privacy engine can produce. For example, searching for just a first name or a nickname is likely to return a large number of false positive, since there are likely to be many matches of that name. However, searching for a specific email, name, and ID is likely to produce much more accurate results. The relevancy score is calculated based on the number of search criteria and the accuracy of the data the privacy engine was able to match. Each search criteria has a relative relevancy score allocation that contributes to the overall relevancy score. For example, when you perform a search using four search criteria, each criterion has a weight of 25% of the overall score, or a relative score accounting for 25% of the overall score. The overall score will be based on the number of criteria matched. If the search matched only one out of four search criteria, the overall relevancy score would be 25%. If two search criteria were matched, the relevancy score would be 50%, and so forth. A full match of all search criteria would yield a 100% relevancy score match. Name fields offer more granular relevancy scoring. If a name search criteria is matched in its entirety, then it will contribute the full amount of its relative relevancy score. However, Name fields (the Name and Alias fields) are also evaluated for partial matching. In case a name search criteria was partially matched, it will contribute only 50% of it's relative relevancy score to the overall score. For example, with a four-term search criteria, when one of the search criterion is the name "John Smith," the name field will have a 25% relative relevancy score. If the name is matched fully, that is, the name "John Smith" in matched fully in the document, the name search criteria will contribute the full 25% to the overall relevancy score. However, if the name is partially matched, for example, the file contains "John" or "Smith," only half of the relative relevancy score would be accounted for in the document overall relevancy score. Thus, the more search criteria involved in the DSAR query, the less impact partial matching have on the overall score, since the likelihood that the identity search for was actually matched is much higher. So, in the previous example, if we're looking for 4 data points (e.g., ID, Address, Email and Name ) – the search matched the first three and fully matched the name – the relevancy score would be 100%. However, if the first three criteria are matched and the name is matched partially, the relevancy score would be 87%. It is still high, since we hit 4 different data points and there's a high probability the document matched the identity, or individual we're searching for, even if the name was not fully matched. However, if the query is searching just for a name, and the name is partially matched, then the overall score would be 50%, as opposed to a 100% for a fully matched name. Lower probability documents are documents with a low relevancy score. They can easily be excluded from further DSAR processing. The decision to exclude files from further DSAR processing is with the discretion of Privacy Manager and Reviewers. # DSAR Bulk Operations Running a bulk operation allows administrators to submit a list of records to be searched, such as a list of names, emails, and address combinations. These large requests will reach the responsible party in bulk, and will need to be handled in bulk to avoid unnecessary additional work. See Bulk Campaign Creation to understand how to create and run bulk campaign. A user also has the ability to perform bulk actions on campaigns. To see each bulk action available, see Bulk Actions. ## Bulk Campaign Creation To create a bulk campaign, navigate to **Compliance > DSAR > DSAR Management > Bulk Create**. To run a bulk campaign, a data source must be identified. From the drop-down menu, select the appropriate data source for the campaign. File Access Manager allows the user to import campaigns in bulk using a data source. Note If a data source needs to be created or edited, navigate to **Admin > Data Source**. For more information on data sources, see **Data Source Types and Usages**. 1. Select a campaign field to be mapped. Note Multiple aliases and email addresses can be entered. Separate multiple values with a comma. 1. Map at least one **Review field**. This can either be **Review Users** or **Review Groups**. A pop-up displays allowing the user to verify the bulk creation. 1. Select **Create** to store the campaign without running or **Create & Run** to start the campaign. Once the action is taken, select **Yes** or **Cancel**. If **Yes** was select, a message displays stating that a task to run the campaign(s) was created. The progress of the campaign can be monitored at **Task Management > Tasks**. An automatic email will also be sent to the reviewer, notifying them of the new campaign they need to review. ## Running Campaigns in Bulk If a user wants to initiate the data discovery and review process tasks, navigate to **Compliance > DSAR > DSAR Management**. 1. Select the desired number of campaigns. 1. Select **Run Campaigns**. A confirmation pop-up appears, asking the user to confirm the running of the selected campaigns. 1. Select either **Yes** or **Cancel**. ## Verifying Campaigns in Bulk To verify that the personal data identified through the campaign(s) have been remediated, navigate to **Compliance > DSAR > DSAR Management**. 1. Select the desired campaigns. 1. Select **Verify Campaigns**. Note This task will only start with campaign statuses of **Remediation - Completed**. A confirmation pop-up appears, asking the user to confirm the verification task for the selected campaigns. 1. Select either **Yes** or **Cancel**. ## Canceling Campaigns in Bulk To cancel the campaign(s) execution, review process or avoid any further changes to the campaign(s), navigate to **Compliance > DSAR > DSAR Management**. 1. Select the desired campaigns. 1. Select **Cancel Campaigns**. Note This task will only start with campaign statuses of **Data Discovery**. A confirmation pop-up appears, asking the user to confirm the canceling of the number of selected campaigns. 1. Select either **Yes** or **Cancel**. ## Ending Campaigns in Bulk To finalize the campaign(s) review process, end the execution process and prevent any further changes, navigate to **Compliance > DSAR > DSAR Management**. 1. Select the desired campaigns. 1. Select **End Campaigns**. A confirmation pop-up appears, asking the user to confirm the ending of the number of selected campaigns. 1. Select either **Yes** or **Cancel**. ## Deleting Campaigns in Bulk o permanently remove all information related to the campaign(s), including the DSAR query results, progress history, pending and committed conclusions, and associated comments, navigate to **Compliance > DSAR > DSAR Management**. 1. Select the desired campaigns. 1. Select **Delete Campaigns**. A confirmation pop-up appears, asking the user to confirm the deleting of the number of selected campaigns. 1. Select either **Yes** or **Cancel**. ## Remediating Campaigns in Bulk To queue a task to scan all data assets involved in the selected campaign(s) and verify that the personal information identified through the campaign(s) has been remediated, navigate to **Compliance > DSAR > DSAR Management**. 1. Select the campaigns. 1. Select **Remediate Campaigns**. A confirmation pop-up will appear, asking the user to confirm the remediation of the selected campaigns. 1. Select either **Yes** or **Cancel**. # DSAR Campaign Details Once the campaign decision(s) have been made, the campaign creator can review the decision(s) by navigating to **Compliance > DSAR Management** and clicking the desired campaign. On the **Campaign Details** screen, the user will see the following information: - **Purpose** - Type of DSAR that was requested. - **Due Date** - Campaign deadline. - **Status** - Provides the status of the campaign in its current phase. - **Files** - All files that were discovered will be listed along with their full file path. - **Relevancy Score** - This is calculated based on required and non-required fields. The **Identifier** field is required, while the **Name** field is not. Note If both the **Identifier** and **Name** are found, the result will equal 100. If only the **Identifier** is found, the result will equal 50. - **File Status** - The last column will show the status of the files in the campaign. ## Administrator Review If a campaign is in the data verification stage, the user will be able to click on a non-verified or failed report. If the report failed, the user can view the reason for the failed verification. For both non-verified and failed reports, the user will have the option to: - **Exclude** – Ignore the failed verification and provide an optional comment. - **Override** – Override the failed verification and provide an optional comment. Note - If the failed verification was ignored, the status will change to **Verified with Exceptions**. - If the failed verification was overridden, the status will change to **Verified**. - If the verification was successful, the record will show as **Verified**. ## Exclude / Override If multiple records are selected, the user can select the **Exclude/Override Verification** button at the top right of the screen. This allows the user to handle records in bulk, rather than managing each individual record. ## Reassigning Reviewers Compliance administrators can reassign items that are pending review from one reviewer to another. To reassign: 1. Select the desired file(s). 1. Select **Reassign Reviewers**, which opens a new display. 1. Select the current reviewer from the **Current Reviewer** dropdown. 1. Select the new reviewer from the **New Reviewer** dropdown. 1. Comments are not required but can be provided if desired. 1. Select **Reassign**. # Creating a DSAR Campaign To create a DSAR Campaign, open the DSAR Wizard by navigating to **Compliance > DSAR > DSAR Management > New DSAR**. ## General Details 1. Provide an appropriate **Name** and **Description**. 1. Select the **DSAR Purpose** according to the type of campaign requested: - **Information Disclosure** - **Data Redaction** - **Data Deletion** 1. Enter details and instructions for the reviewers to explain the request and what to check for in the validation stage. This text will be displayed in the review screen and the campaign email templates sent out for reviewers. 1. Enter a **Due Date** based on the due date type and date/length of campaign: - **After** – set the length of the campaign. The due date will be set as this interval starting with the date the campaign is started. - **On** – set the actual due date at the time of creating the campaign. 1. Select **Next** to open the **DSAR Query** page. ## DSAR Query 1. Select a **Scope Type** to target specific applications or application types. This will allow for the campaign results to be filtered by specific applications or application types: - **All** – lists all applications defined in the system - **Application Type** – select the appropriate application type(s) - **Application** – select the appropriate application(s) The query consists of one or more field matches. To add a field to the search, select the **+** button. Add at least one search criterion. The more well-defined the search criteria, the more accurate the results. ```text !!! note Multiple aliases and email addresses can be entered. Separate multiple values with a comma. ``` If marked **Required**, this value must be included in the file to satisfy the query. When selecting **Required**, the Relevancy Score will be calculated off that identifier. 1. Select **Next** to open the **Review Process** page. ## Review Process 1. Set one or more reviewers to check this DSAR Campaign's results. Reviewers can be individual users or groups of users. There is an option on the next screen to configure sending invitations and reminders to the reviewers. 1. Select the account type: **User** or **Group**. 1. Select an account by typing part of the name, and selecting from the list. 1. Select **Next** to open the **Summary** page. ## Summary Review your DSAR campaign settings and configure notifications and reminders for reviewers. Using the **Save** button options, you can choose to automatically run the campaign upon saving it, or save and manually run the campaign at a later stage. Key information on the Summary page: - **Due Date** - For campaigns with a fixed due date, or campaigns that had already started. - **DSAR Query** - The query defining the identity to act on. The unique identifier values are partially obfuscated, displaying the last four digits/characters. - **Scope** - Provides the target applications associated with the campaign. - **Request Purpose** - Provides the reason for the campaign. - **Review Process** - Displays the number of reviewers. Click on the number to open a dropdown list of reviewer names. - **Campaign Invitation** - Select this option to have the system send an invitation to all the reviewers. - **Reminders Schedule** - Select this option to send weekly email reminders to all reviewers with pending actions, at 8 AM on Monday (local time). ## Final Steps 1. Select **Save** to store the campaign without running it or select **Save & Run** to start the campaign. Note If the campaign is only saved, the entire campaign will be editable. If the campaign is saved and run, only the General Details and schedule will be editable. # DSAR Management Screen The DSAR Management Screen allows Compliance Administrators to create, manage, and track DSAR Campaigns, monitor their progress, perform actions, and view their current status. Using this screen, the user can create the DSAR campaign, follow the statuses of validating and remediating the data, and also perform data verification. To open the DSAR Management screen, navigate to **Compliance > DSAR > DSAR Management**. ## Managing Columns To add or remove columns from the grid, select the column chooser icon. Next, select **List More** and check/uncheck the required columns. - **Name** - Name of the DSAR campaign - **Purpose** - Reason for the DSAR campaign - **Current Status** - The campaign statuses can be one of the following: - Data Discovery - Data Validation - Remediation – In Progress - Remediation – Completed - Verification – In Progress - Verification – Completed - Completed - Failed - Pending Deletion - Pending Cancel - Cancel - **Due Date** - The DSAR campaign deadline (date). - **Creation Date** - Date the campaign was created. - **Actions:** - **Edit** – opens the Wizard in Edit mode !!! note When editing a campaign, if the campaign hasn't been executed yet, all the campaign's settings and attributes can be edited. However, if the campaign was already executed, only the campaign’s general details can be updated. The DSAR Query and the Review Process settings cannot be changed at this stage. For more information, view [Creating a DSAR Campaign](#). - **Generate Report** – generate the campaign report - **Description** - General information about the campaign - **Owner** - User who created the campaign - **Start Date** - Date the campaign is set to start - **End Date** - Date the campaign is set to end - **Duration** - The amount of time the campaign is active. The number of days between the Start Date and the End Date. If no End Date is available, the current date is used for calculations. ## Selecting Campaigns for Bulk Actions Select campaigns by checking the box in the left column. This opens a multiple-select option at the top of the grid: **Select all [X] Items**. ## Editing an Active Campaign Select the **Edit** icon on the campaign row. Once a campaign has been saved and run, a user can only edit the campaign name, description, review instructions, and due date. The Reminder Schedule can also be edited on the Summary page. Changing any of the due date fields will recalculate the remaining fields according to the new configuration. Switching from a specific date to a time period (e.g., 2 weeks) will clear the due date field. If the campaign has already started, the due date will be recalculated from the start date and time period. ## Editing a Campaign that is Not Active Select the **Edit** icon on the campaign row. If a campaign has been created but not run, a user can edit all settings in the campaign. ## Running a Report Based on a Campaign Select the **Generate Report** icon on the campaign row. For more information on Reports, see **DSAR Reports**. ## Running One or More Campaigns Select the campaigns in the left-hand checkboxes, and select **Run Campaigns**. All inactive campaigns (campaigns that have not run yet) will start running. The due date of these campaigns will be calculated at this time. ## Verifying One or More Campaigns Select the campaigns in the left-hand checkboxes, and select **Verify Campaigns**. This action is available after the campaign reaches Remediation – Completed status, and until it reaches Completed status. The **Verify** action triggers a verification task that rescans the results found during the discovery task and verifies the successful remediation of these records, meaning that the information no longer exists. ## Canceling One or More Campaigns Select the campaign to cancel. ## Ending One or More Campaigns Select the campaign to mark it as **Complete**, despite not having a completed campaign. ## Deleting One or More Campaigns Select the campaigns in the left-hand checkboxes, and select **Delete Campaigns**. ## Filters To filter the results on the grid, select the filter icon on the heading bar. Select the requested criteria. Note The default filter setting is set to show Active campaigns. Select **Apply** to apply the filter, or **Clear All** to clear the filter and repopulate the grid. Tip Make sure no campaigns are selected in order to be able to access the filter icon. ### Filter Options - **Name**: Enter all or part of the campaign name - **Current Status**: Search by the status of the campaign - **Purpose**: Search by entering any of the campaign purposes - **Owner**: Search by the user who created the DSAR campaign - **Due Date**: Select the date type and date/range. Use the date chooser to select dates: - Equals – enter the due date - Last X days – enter the number of days back to select - Next X days – enter the number of days forward to select - Between – enter the date range. Open the date chooser, click the start date, then click the end date. - **Creation Date**: Search by selecting the known date - **Start Date**: If the campaign start date is set, search by selecting the s # DSAR Reports Running a DSAR campaign allows the user to also generate a report. From the DSAR Management screen, select the **Generate Report** icon under the Actions column to create a report for any desired campaign. A message appears notifying that the report is being generated and will be available in **My Reports**. Once the report is complete, a bell notification displays, indicating the report is ready to be viewed or downloaded. When the report is opened, six tabs containing various information will be available. These tabs provide a snapshot of the campaign within its different phases. ## Report Tabs - **Report Summary** - This tab lists the report generation details, DSAR campaign query and scope, campaign details, and aggregations. - **Data Validation** - This tab lists all records and review decisions made during the **data validation** phase. - **Data Remediation** - This tab lists all records and review decisions made during the **data remediation** phase. - **Data Verification** - This tab lists all records and review decisions made during the **data verification** phase. - **Excluded Records** - This tab lists all excluded records, including the review decisions and exclusion comments. - **Information Discovered** - This tab presents all of the **personal information** discovered during the DSAR process. # DSAR Requests Review The DSAR Review page displays all campaigns pending your review. This screen includes tasks to validate and remediate data. To review all DSAR campaigns, navigate to **My Tasks > DSAR**. Note The default filter setting is set to show **Data Validation** or **Data Remediation in Progress**. ## DSAR Campaign Information The following columns are provided: - **Name** - Name of the DSAR campaign. - **Description** - Information about the purpose of the campaign. - **Purpose** - Reason for the DSAR. - **Current Status** - The campaign statuses can be one of the following: - Created & Ready to Run - Data Discovery - Data Validation - Remediation – In Progress - Remediation – Completed - Verification – In Progress - Verification – Completed - Completed - Failed - Pending Deletion - **Due Date**: The DSAR campaign deadline (date). - **Progress**: Indicates how many files within the campaign have been decided on. The page provides the following three predefined options to filter between reviews: - **View All** - **Active Reviews** - **Overdue Reviews** ## Making Campaign Review Decisions The predefined columns are: - **File Name** - Name of the file found in the data discovery phase. - **Full Path** - Location where the file is stored. - **Relevancy Score** - Calculated by the score of the items searched by the item count. - **Matched Terms** - Displays what identifiers were matched from the query. - **Actions** - Select the decision for the file. Available decisions are **Confirm**, **Exclude**, or **Comment**. Reviewers have different options on how to view information. These options display at the top of the Actions column: - **Export Results** - **Filters** - **Column Chooser** ## Export Results Reviewers have the ability to export the results from the grid into a portable format (CSV), so that the results can be shared with other stakeholders who do not have access to **File Access Management**. ## Making Decisions on Selected Campaigns 1. Select the desired campaign to view that particular campaign review page. To select a campaign, click the blue campaign name. 1. Depending on what data was discovered, a variety of files will display. 1. If the user wants to find specific campaigns, there are filtering options at the top left of the grid: - **View All** – View all files that were discovered. - **Pending Commit** – View only files that are waiting to be committed. - **Pending Review** – View only files that need to be reviewed. 1. To the left of each file is a box. Click on the box of the desired campaign to provide your decision. 1. Once a file is selected, a decision can be made one of two ways: - Select one of the newly displayed options at the top of the grid. The options are: - **Clear** – Remove any decisions which have been made but not committed. - **Confirm** – Accepts the record. - **Exclude** – Remove selected record from the decision process. Note If **Exclude** is selected for any record, providing a comment is optional. - Select an action from the **Actions** column. ```text !!! note The actions are the same as above. ``` 1. Select **Commit** once all desired files have been reviewed and a decision has been made. The review will end when all result decisions are made and committed. Note Selecting **Close** takes the user back to the main campaign review page. # DSAR Scope Management Use this screen to define the scope of applications and application types for Data Subject Access Requests. Only applications which support data classification and are governed by/through File Access Management will be available for Data Privacy scope setting. By default, every application will include all resources in Data Privacy scans. By adjusting the scope, you can configure each application to include only a subset of resources in the Data Privacy related task. To access the screen, navigate to **Compliance > DSAR > Scope**. ## Editing the DSAR Scope Note Editing the scope is optional. To edit the DSAR scope, follow these steps: 1. Navigate to **Compliance > DSAR > Scope** and complete the following steps. 1. Find the desired application from the **DSAR Scope** screen. 1. Select **Edit** to modify the scope (such as folders), and/or the **OCR** setting of the DSAR per application. This will open the **Data Privacy Scope Edit** screen. To change the scope to include in the DSAR process: 1. Select the **scope type**: - **All** – run DSAR on all the resources in the application. - **Resource** – select an individual resource and choose whether or not to include all resources nested under it (all child resources). 1. Select **Optical Character Recognition (OCR)** to enable/disable OCR analysis for this application. Note If **Resource** was selected as the scope type, a **Resource** field will display under **Optical Character Recognition (OCR)**. Note The OCR is defined by editing the application in **Admin > Applications > Edit**. 1. Select the desired resource. Note Resources can be searched for using the search field. Note Multiple resources can be selected. # Overview To begin the installation process, first, ensure all the necessary prerequisites are configured. Once that is done, proceed to add a new application to the File Access Manager Administrative Client. After the application is added, install the Activity Monitor, Permissions Collector, and Data Classification services. Important Permissions Collector and Data Classification services is optional. These services should only be installed by someone with a comprehensive understanding of the File Access Manager deployment architecture. For further details on the architecture, refer to the File Access Manager Administrator Guide. # Configuration There are several configurations that have to be accomplished in order for disaster recovery to work. ## Server Designation and Configuration The server designation is either Production or Disaster Recovery, along with the configuration of the services on these servers, is performed using the File Access Manager Server Installer. ## Initial Configuration During the initial setup, select Disaster Recovery (DR) servers by ticking the **Disaster Recovery** checkbox. ## Setting the Active Servers You can set the servers to be active or inactive through the Server Installer. If a server is set to be **"Toggle UP"**, the twin DR server will be in "Sleep State" (idle). If the Production server is in **"Toggle Down"** mode, the twin DR server will be in a running state. The user can set the server status (up or down) from any machine. To set a production server Active/Inactive: 1. Open the Server Installer and connect to an existing database. 1. Select the Production server that will be activated or deactivated and click the **Edit** button. This will enable the following server status buttons: - **Deactivate / Activate**: Toggle the server status, which will automatically toggle the corresponding DR server as well. - **Reset**: Mark the services running on this server as uninstalled. This is necessary when a server should be reinstalled or replaced. 1. Select **Activate / Deactivate** to change the server state. 1. Select **Save**. # Disaster Recovery Flow To enable Disaster Recovery mode, select the production servers and set them back to **Inactive** (see Configuration). This action will automatically set the corresponding DR servers to **Active**. Note Only the Production servers have the **Active / Inactive** button enabled. If the website and/or API servers are down, manual intervention is required for clients to connect. There are two possible ways to recover: 1. In the DNS server, change the target URL of the website/API to point to the disaster recovery environment. This is the recommended action and will likely be the simplest solution. 1. Alternatively, browse directly to the disaster recovery environment address. ## High Availability Configuration Considerations In addition to changing the designation of servers as active / inactive, you have to ensure that the relevant servers are listed in the high availability load balancer. This depends on the types of servers listed in the load balancer: | **Services listed in the load balancer** | **Configuration changes required when changing the disaster mode** | | ------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------- | | All Prod services and DR services | Nothing to change however if you are monitoring the load balancer health checks you will receive many false positives of broken servers. | | Production services only | Update the load balancer to point to the newly activated DR services | | Different load balancer for Production & DR | Change the load balancer address inside the server installer load balancer screen. | Note For the website load balancer configuration, only the second two options are relevant. ## Disaster Recovery Fallback to Production Environment Select the production servers and set them back to Active (see Toggle above). This will set the corresponding DR servers to Inactive. ### Return to Production Requires Installing the Services 1. Select **Reset** on the server configuration screen. 1. Reinstall the services. 1. After completing the installation, wait at least 2 minutes to allow all File Access Manager services to update their configuration. 1. Set the Production servers to **Active**. ### Production Server Has to be Replaced If the production server cannot be restored and a new one is required: 1. In the Server Installer, add a new server to the server list. 1. Continue through the setup and select **Save Configuration**. 1. Restart the Server Installer. 1. Select the new server in the Server Configuration list, select **Edit**, and then **Deactivate** (the new server is not yet ready to be live). 1. Configure the required services on the new server and install them. 1. Wait for at least 2 minutes after the installation has completed. 1. Turn the new server **Active**. ### Fallback Includes the Production Server of the Web Site/API Server In the event that the fallback includes the production server of the website/API server, manual intervention will be required for clients to reconnect. The required action will depend on the recovery action taken in the section **"Switching on Disaster Recovery mode"**: - If the DNS server was changed, it should be reverted to point to the **Production** environment. - If the DNS server was not changed, you should browse directly to the **Production environment** address. ## Elasticsearch Restoration For more detailed information, refer to the [Elasticsearch Restore Snapshot Guide](https://www.elastic.co/guide/en/elasticsearch/reference/current/snapshots-restore-snapshot.html#restore-different-cluster). Note For further details, refer to the Data Backup guide. To perform a restoration, complete the following steps: 1. Stop the following File Access Manager (FAM) services in the DR environment: - File Access Manager Event Manager - File Access Manager Scheduled Task Handler - File Access Manager Central Data Classification - File Access Manager Activity Analytics 1. For each node in the disaster recovery Elasticsearch, locate the `elasticsearch.yml` config file and modify the `path.repo:` value to point to the Production backup base path. 1. Restart Elasticsearch. 1. Register the disaster recovery Elasticsearch cluster to the Production continuous repository as **Read Only**: **PUT \_snapshot/continuous_backup** ```text { "type": "fs", "settings": { "location": "continuous_backup", "readonly": "true" } } ``` 1. For a disaster recovery cluster, temporarily stop indexing and turn off the following features: **GeoIP database downloader** ```text PUT _cluster/settings { "persistent": { "ingest.geoip.downloader.enabled": false } } ``` **ILM** ```text `POST _ilm/stop` ``` **Monitoring** ```text PUT _cluster/settings { "persistent": { "xpack.monitoring.collection.enabled": false } } ``` **Machine Learning** `POST _ml/set_upgrade_mode?enabled=true` **Watcher** `POST _watcher/_stop` 1. Use the cluster update settings API to set **action.destructive_requires_name** to false. This allows you delete data streams and indices using wildcards. ```text PUT _cluster/settings { "persistent": { "action.destructive_requires_name": false } } ``` 7. Delete all existing data streams on the cluster. ```text `DELETE _data_stream/*?expand_wildcards=all` ``` 1. Delete all existing indices on the cluster. `DELETE *?expand_wildcards=all` 1. Copy the name of the snapshot that you want and restore from the Production repository to the disaster recovery Elasticsearch (see step 5 in full cluster instructions). If needing a list of available snapshots: `GET _snapshot/continuous_backup/*?order=desc` Look for the first snapshot with "state": "SUCCESS". 1. When the restore operation is complete, resume indexing and restart any features you stopped: **GeoIP database downloader** ```text PUT _cluster/settings { "persistent": { "ingest.geoip.downloader.enabled": true } } ``` **ILM** `POST _ilm/start` \*\*\*Machine Learning\*\* `POST _ml/set_upgrade_mode?enabled=false` **Monitoring** ```text PUT _cluster/settings { "persistent": { "xpack.monitoring.collection.enabled": true } } ``` **Watcher** `POST _watcher/_start` 1. Reset the `action.destructive_requires_name cluster` setting. ```text PUT _cluster/settings { "persistent": { "action.destructive_requires_name": null } } ``` 1. Unregister the production repository from the disaster recovery cluster, `DELETE _snapshot/continuous_backup`. 1. For each node in the disaster recovery Elasticsearch, find the “elasticsearch.yml” config file and change the “path.repo:” value back to the disaster recovery backup base path and restart Elasticsearch. 1. Register the disaster recovery continuous repository for the disaster recovery Elasticsearch cluster: **PUT \_snapshot/continuous_backup** ```text { "type": "fs", "settings": { "location": "continuous_backup" } } ``` 1. When returning back to Production environment, follow the above instructions. However, replace Production with disaster recovery and vice versa. # Disaster Recovery Troubleshooting The following are possible troubleshooting scenarios that could happen. ## The Reindex Task Marked as Canceled Following a DR Transfer In the following scenario, the Reindex task might fail. If this happens, you will need to run the Reindex task manually. 1. The Production server goes down. 1. The user marks the server **Inactive** in the server installer, which will toggle the parallel server in the DR environment to **Active**. 1. The Reindex activities task starts automatically (this is run by the Scheduled Task Handler service). 1. The server where the Scheduled Task Handler service is running goes down. 1. The Reindex task is automatically canceled. **Action** In this specific scenario, and only if the Reindex task was canceled, create a new reindex task manually. This can be done from the Administrative Client Health Center screen. ## Unable to See Events **Symptom** The following error displays in a log file while you attempt to install the monitoring connector: `ERROR, WBX.whiteOPS.Agents.FilesMiniFilterActivity Monitor.FileMiniFilterActivity MonitorManager,connect, An unexpected error occurred while you attempt to start the mini-filter: System.DllNotFoundException:Unable to load DLL 'wbapi.dll': The specified module could not be found. (Exception from HRESULT: 0x8007007E)—at WBX.whiteOPS.Agents.FilesMiniFilterActivity Monitor.SafeNativeMethods64.start(UInt32 bufferSizeInBytes, UInt32 trustedProcessId)—at WBX.whiteOPS.Agents.FilesMiniFilterActivity Monitor.FileMiniFilterActivity MonitorManager.connect()` **Reason** Visual C++ 2010 redistributable package was not installed as part of the Activity Monitor service installation. **Solution** Perform Step 3 of Activity Monitor Installation, Windows Server Core. ## The Application is Not in the List of Collector Installation Managers **Symptom** The application does not appear in the dropdown list of the Collector Installation Managers in Activity Monitoring. **Reason** Either: - The application was not defined. - The Host Name (as defined in section 5.11) does not match the server's short name on which the Collector Installation Manager was opened. **Solution Steps** 1. Create the application if it does not exist. 1. If the application already exists, ensure that the Host Name is correct. # Forensics Introduction The forensics screens allow administrators to view File Access Manager service data analyses. The tables can be filtered to fit specific needs, and filters can be saved and shared with others as well. Forensic queries can be used to answer questions such as: - Who has accessed files classified as credit cards? - Who can access folders classified as SSN? - Are there users without a password in the system, or users who haven’t logged in for the past six months? # Activity Forensics The Activity Forensics page can be used to track user activities in various areas of interest. To locate the Activity Forensics page, navigate to **Forensics > Activity**. ## Filter The activity forensics filter allows users to focus on set scenarios and areas of interest. When you open the activity forensics page, it loads with the last query used. The query is composed of one or more filters, combined with an **AND** operator. ### Creating a Query 1. Select a field from the **Field** dropdown list. 1. Select an operator. 1. Select or type in a value. For multiple values, start typing part of the value and select items from the dropdown list by ticking the checkbox next to each item. 1. Select **Add** to add this filter to the query list. 1. Repeat the process to add additional filter items to the query. 1. Select **Apply** to run the query and display the results. ### Storing and Sharing Queries The 10 last queries are stored for reuse, with the query timestamp as the name. You can store queries for later use, with a meaningful name, and have the option of sharing them with other users. To store or share queries: 1. Select the **Actions** dropdown menu in the top right corner. 1. Select **Save Query** to open the Save Query dialog box. 1. Type in the query name, and optionally, the name of a user(s) to share the query with. 1. Start typing the user name. To add a user to the share list, select the **+** button. ### Loading Stored Queries To load a stored query, open the query list panel on the left side of the activity forensics page. You might have to click the restore button **>** , if this panel is minimized. Click on a recent query or a stored query to load the query and apply it to the results. ### Saving the Query to a Report To create a report from an Activity Forensics query, select **Generate Report** from the Activities dropdown menu. The report will be available in **Reports > My Reports**. ### Creating a Scheduled Report from a Query You can also create a repeated report from the query by selecting **Schedule Report Template** from the Activities dropdown menu to open the Schedule Report Template panel. # Data Classification Forensics The Data Classification Forensics screen can be found by navigating to **Forensics > Data Classification**. It displays data classification results, based on your active policies. Use filters to focus on specific data. You can sort the results by **Match Count**. The returned records are limited to 10,000 results. Note The Data Classification Results table shows results of the data classification process running in File Access Manager, as well as any data classification results imported from an external source, using the **Import Data Classification Results** feature. This might lead to duplicate entries from the two sources. ## Reports Data Classification reports can be found in the report templates, using the **Classified Data** tag to locate relevant reports. ## Using the Data Classification Forensics Table Change one or more of the default columns by selecting **Display Columns** and choosing one or more columns from the dropdown menu. Currently, all columns display, including the following: **Application** - This column displays all the system applications. **Application Type** - This column displays all the system application types. **Last Updated** - This is the timestamp of the last classification process, in which the file was classified into the specified category. **Result Type** - This is the source of the classification result (**Content**, **Behavioral**, or **Imported Classification**). Note The default column headings, from left to right, are: **Resource Full Path**, **File Name**, **Policy Name**, **Rule Name**, **Categories**, and **Match Count**. You can clear any selections made in the **Policy**, **Rule**, and **Category** search fields by selecting **Clear Selection** on the top right of each field. 1. Select a result type from the **Result Type** dropdown menu: - **All**: All possible result types. - **Behavioral**: Only results from behavioral rules. - **Composite Classification**: Results from composite rules (combining the results of several classifications). - **Content**: Only results from content rules. - **Imported**: Typically, the administrative client imports results from a **Data Loss Prevention (DLP)** product that has already scanned the results to control what data end users can transfer, so there is no need to rescan those results. 1. Type a number in both the **Match Count (greater than)** and **Match Count (less than)** fields to restrict the number of Regular Expression (Regex, the general standard for textual search) results. Note Users can see the resources according to the user scope they have. A result record represents the classification of a certain file by file, rule, and policy. A single file can be classified into multiple rules/policies, resulting in a separate record in the result for each file-to-rule-to-policy relation. The result record consists of default columns, which can be changed based on the users’ requirements: **Resource Full Path** - The full path of the resource in which the file resides. **File Name** - Name of the classified file. **Policy Name** - Name of the policy by which the file is classified. **Rule Name** - Name of the rule by which the file is classified. **Category** - Classification category name used by the rule. Note If the rule result is part of a policy with an active global rule, the global category will also be displayed along with the rule category, as long as it matches the global rule threshold. **Match Count** - This is the maximum number of matches under any rule's requirements contained in the file. This is not an aggregative figure and does not sum up the number of matches in each of the rule requirements for the file. Instead, it represents the highest match count yielded by any of the rule requirements and should be viewed as a sensitivity score attributed to the file, in accordance with the applicable policy rules. For example, if a policy rule contains two rule requirements – one matching credit card numbers with ten occurrences of credit card numbers within the same file, and another matching telephone numbers with eight occurrences of telephone numbers within the same file, the **Match Count** value of the file for that category (assigned by the rule) would be **10** (rather than 18, or 8), since it represents the maximum number of occurrences matching any of the rule requirements within that policy rule. When the result displays a regular expression search, this field is clickable and displays the masked matches of the regular expression. Note The query retrieves the first 10,000 results. Narrow the search to obtain a better fit. ## Filter Complete the following steps to filter data classification forensics: 1. Select the **Filters** button at the top right of the screen. 1. The filter screen displays. The forensics results can be filtered by: - **Policy Name** - **Category** - **Rule Name** - **Result Type** (All, Content, Behavioral, Imported) - **Match Count** (greater than/less than) - **Filter by Scope** ### Filter by Scope 1. Select a scope type (**Application type**, **Application**, or **Resource**) from the **Scope Type** dropdown menu. 1. Select a corresponding resource from the **Resources** dropdown menu. You can clear a selection from this dropdown menu by selecting **Clear Selection** on the top right of the menu. Select **Reset** at the bottom left of the filtering screen to apply all the selected filters. # Identity Forensics The Identities Forensics screen displays users, groups, and their relationships recorded by the system. Use filters to focus on specific data. The page supports reports and campaigns. The displayed output is limited to the first 100,000 results. Navigate to **Forensics > Identities** to see the Forensics page. ## Tabs Note Each tab has a separate filter and stored query list. Select the tab to display different data about users, groups, and their relationships. **Users’ Membership in Groups** - View of users and their group memberships. **Users** - This tab displays users and their attributes, defined in the identity store. **Groups** - This tab displays groups and their attributes, defined in the identity store. Identity queries involve identity stores connected to File Access Manager, regardless of the permissions attached to these identities. # Using Permission Forensics The **Permission Forensics** screen allows administrators to monitor and analyze user and group permissions. On this screen, you can create queries to analyze the permissions of specific groups of users, save and share queries for selecting users and groups, generate reports, run permission scans, and revoke explicit permissions of users. This page supports **reports** and **campaigns**. This component answers questions such as: - Which users have access to what resources? - Which users have not used the permissions granted to them? - Which permissions were granted to each group? - Which groups are not being used? The table displays the permissions according to the level of granularity selected in the filter. When creating a filter, you can define the granularity of the report using the **View by** field, and mark stale permissions on the table according to the unused time selected. Note The query retrieves the first 100,000 results. Narrow the search to obtain a better fit. **Reports** - See [Generating Reports] **Filters** - See [Filters: Creating and Editing a Forensics Query] ## Viewing Permission Forensics The **Permission Forensics** table displays the permissions retrieved by the query run. ```text By default, the data displayed includes the following columns for each permission: - Resource: Business resource full path - Application - User: User name - User Display Name - Group Name - User Domain - Group Domain - User Entity Type - Group Entity Type - Permission: Permission type - Classification Category - Is Inherited - Inherits Permissions - ACL Type Allowed? ``` 1. To change the order of the columns, drag the column titles. 1. To select columns to display, select the **column chooser icon** on the table header bar. 1. Select the columns to display from the dropdown list. 1. Select **Show All / Show Less** to display a full list of columns or only the default columns in the column chooser. This does not change the selection of columns to display in the table. 1. Use the search field to narrow down the list of columns in the column chooser. 1. Select **Reset Columns** to reset to the default selection and order of the columns in the table. The default view is the **Users and Groups** view. You can change the granularity of the output by selecting the **View By** type. These options determine whether to check a user’s direct permissions or permissions granted by groups the user belongs to, as described below: - **Groups & Users Direct Permissions**: This view displays direct Users’ and Groups’ permissions but does not display the Group members. - **Users Direct & Group Membership Permissions**: This view displays user permissions based on direct permission, group membership, and nested group membership. This view doesn't list the users in the groups **Everyone** and **Authenticated Users**. - **Everyone Groups Expanded, Users Direct & Group Membership Permissions**: This view displays user permissions based on direct permission, group membership, and nested group membership, including listing the members of the **Everyone** and **Authenticated Users** groups. Note In the permission forensic screen, the **View By** field can be changed after setting or restoring the filter. ### Mark Stale Permissions Select the time period for stale permissions. The user permissions that were not used for a given time (time period is configurable) are marked in **red**. ## Scope and Hierarchical Search By default, when you select a business resource (BR) to scope its permissions, only the direct BR permissions (not the child BR permissions) display. ## Special Groups - Group Entity Type When creating a filter, you can select the **group entity type** from the **Field** field. In Windows-based environments, the user groups are: - **Everyone**: Includes all users. - **Authenticated Users**: Includes all users without a guest. - **Domain Users**: Includes a group with all users in the domain. By default, any user created is a member of this group, though it is possible to remove that user. ## Owner Permission Field File Access Manager permissions forensics allows identification and tracking of **Owner permissions** in the File Access Manager interface: - A proprietary column, called **"Is Owner Permission"**, indicates whether a given permission is an Owner permission. - A proprietary query attribute is dedicated to filtering **Owner permissions**, allowing queries and/or reports listing the owners of resources. ### Permission Scan for Business Resource The **Permission Scan** collects security information from the scanned **Business Resources (BRs)** and stores it in the File Access Manager database. This includes: - Which users or groups have access to the BR. - Whether the access is inherited. - The types of access such as read, write, full control, etc., depending on the application type. When requesting a permission scan, you can set the resources to scan, and the number of levels below the requested BR to scan. To open the Permission Forensics Screen: 1. Navigate to **Forensics > Permissions**. 1. From the **Global Options** dropdown menu, select **Start Permission Scan**. This will open the **Permission Scan** panel. Select the scan level: - **This Business Resource only** - **This Business Resource and levels 'Level 1-4' and 'All Levels'** 1. Select **Scan** to start the scan, or **Cancel** to return to the **Permission Forensics** screen. ### DFS Support For DFS resources, the Permission Forensics table will show the physical, as well as the logical path of resources. You can create a filter for DFS resources by logical path only. To select a logical path, select Resource on the Select Field drop down menu, then navigate to the required path on the resource tree on the Select Resource dropdown menu. (See Searching for Resources Using a Resource Tree). ### Removing Explicit Permissions Using the Permission Forensics Page This process will revoke explicit permissions from non-normalized resources that are configured for access fulfillment. Permissions that are inherited will not be removed. 1. Navigate to **Forensics > Permissions**. 1. Set a filter, as described in [Filters: Creating and Editing a Forensics Query](#). 1. Select **Apply** to run the filter. 1. Set the **View** to **Groups and Users direct permissions**. 1. In the permission results, select the permission rows to remove by clicking the checkbox on the row. Before selecting which permissions to remove, be sure that: - The **Application** in which the BR resides is configured to support **Access Fulfillment for Direct Permission Removal**. Refer to the "Access Fulfillment for Removal of Explicit Permissions" for more information on how to configure removal of explicit permissions. - The permission is defined directly on the BR. Verify the value in the **Is Inherited** column is **False**. - The selected permission is not a normalized group, created and managed by File Access Manager. 1. Select **Revoke Explicit Permissions**. # User Types File Access Manager is pre-configured with the following capabilities that can access the Web Interface. Additional capabilities can be created, according to the rights the different users require, with the assistance of SailPoint Professional Services or Partners. The user types are: - Administrators - Compliance Managers - Data Owners - Auditors - Other Users | **Capability Screens** | **Administrator** | **Compliance Manager** | **Data Owner** | **Auditor** | | ---------------------- | ----------------- | ---------------------- | -------------- | ----------- | | Dashboard | ✓ | | ✓a | | | Resource | ✓ | | ✓ | | | My Tasks | ✓ | ✓ | ✓ | ✓ | | Reports | ✓ | ✓ | ✓ | ✓ | | Compliance | ✓ | ✓ b | | | | Forensics | ✓ | ✓ c | ✓ | ✓ | | Goals | ✓ | | | | | Settings | ✓ | ✓d | | | a. Data Owners see a limited version of the dashboards that is relevant to the capability. b. The Compliance Manager cannot access the Alert Rules under the compliance menu. c. Compliance Managers have access to the Data Classification Forensics page only. d. Compliance Managers' access to the Settings screen is limited to the Access Certification Message Template. Note For a full description of the permissions set per capability, see the `web_permission` table in the File Access Manager database. Note File Access Manager is highly customizable. Administrators and implementation teams may modify your system or add new capabilities to it that cause it to differ from the table above. ## Administrator The Dashboard is the first screen an Administrator sees. Users with Administrator capability can access all screens and also have the full scope, meaning that they have access to all data. Administrators can access all pages and buttons that data owners can access, including general settings, configurations, and the definition and management of crowd sourcing elections and goals. ## Compliance Manager My Tasks is the first screen that Campaign Managers see. Campaign Managers can access the My Tasks, Reports, Compliance, Forensics, and Settings tabs. ## Data Owner The Dashboard is the first screen Data Owners see. Data Owners can access the Dashboard, Resources, My Tasks, Reports, and Forensics tabs. Data owners handle ad-hoc tasks but are also responsible for the data involved in those tasks. The Resources view displays problems to data owners for them to correct. ## Auditor The auditor capability is intended for users who perform internal audits, and assist in external audits, on user access information within the organization. They can see and manage all reports and well as see and run the forensic screens. Note This capability does not by default have permission to delete reports. ## Other Users My Tasks is the first screen that most users see. Users can access the My Tasks and Reports tabs. Users handle ad-hoc tasks, including: - Reviewing Access Certification Campaigns and Access Requests - Asking for permissions through the Access Request Wizard - Viewing reports # Dashboard Overview Traditionally, IT personnel or security personnel have determined which individuals can access specific operations on specific resources. However, since these personnel are not always directly involved with those resources on a daily basis, they often rely on other personnel to determine who should have access to specific resources. Users who understand the ramifications of data falling into the wrong hands are the best candidates to be data owners of specific resources. The File Access Manager Dashboard provides a bird’s eye view of data vulnerabilities, so that data administrators and data owners can determine what actions to take to safeguard resources, and to prevent data from further exposure. The Dashboard has an Administrator tab (with information specific to administrators) and a Data Owner tab (with information specific to data owners). ## Version Identification If a user needs to know the version of File Access Manager they are operating on, complete the following: 1. Navigate to the Administrator drop down tab in the top right hand corner. 1. Select **About**. The version will be listed at the bottom of the About window. ## Administrator The administrator dashboard features a graphic overview to assist in monitoring the system. Its widgets show various system statistics for detailed analysis, including reports and drill-downs to forensics screens. You can update the widgets on the administrator dashboard either automatically (continuously or once a day, depending on the widget) or manually (when a user clicks the Update Now link). When the Update Now task finishes, the system generates a notification and displays it as a new unread notification that refreshes the Dashboard. 1. Select Update Now to update all widgets in the Administrator tab. A task starts to update tables with information (in the background) for widgets, either automatically (daily) or manually. 1. Select the bell icon to open the Most Recent notifications. The Last Updated date to the left of the Update Now button changes accordingly. ### Data Ownership The Data Ownership widget displays the number of resources with classified data that are missing an assigned data owner (who must review and approve user access to resources). This widget shows the compliance score of each resource and is updated once a day by default. Select **Update Now** to refresh the data. The main components of the Data Ownership widget are: **Generate Report** Select **Generate Report** in the widget to generate a detailed report of resources. The system will send a notification (via the bell icon) when the report is ready. You can access the report by navigating to **Reports > My Reports**. **Score** The score consists of a number and an associated color, as follows: - **0 to 5**: Red (high risk) - **5.1 to 7.5**: Yellow (medium risk) - **7.6 to 10**: Green (low risk) **Counter** The counter displays the number of sensitive resources missing owners. - If the number of resources is one thousand or more, it is expressed in **K** (for example, 10,000 displays as 10K). - If the number of resources is one million or more, it is expressed in **M** (for example, 10,000,000 displays as 10M). ### Sensitive Data Exposure The Sensitive Data Exposure widget shows the number of resources (considered overexposed) containing classified data that are accessible to a large group of users. The widget is updated daily by default and displays the compliance score for each resource. To configure a resource as overexposed, navigate to **Settings > General > Overexposed Resources**. Here, you can view the current definition of overexposed resources and modify the criteria as needed. The key components of the Sensitive Data Exposure widget are similar to those in the Data Ownership widget, as described in the [Data Ownership section](#data-ownership). This widget highlights the exposure of sensitive data and is updated once a day by default. Select **Update Now** to refresh the data. ### System Health Check The System Health Check widget provides real-time monitoring of system services, continuously updating to reflect their status. It displays a list of both active and inactive services, categorized by service name and status. Inactive services indicate a problem, and some of these services may be restarted. The widget shows the total number of active and inactive services, allowing you to quickly assess the system's health. To view a list of all inactive services and their corresponding issues, select the **Inactive** link (highlighted in blue). The Inactive Services screen will appear, displaying a table with the following columns: - **Status**: The current state of the service (e.g., Not Responding, Broken) - **Service**: The name of the service - **Server Name**: The name of the server hosting the service - **Action**: The available actions, such as "Start [Enabled]", "Start [Disabled]", or no action required To restart a service, select **Start** in the corresponding row of the table. Select **Close** to exit the Activity Monitoring Inactive Services screen. ### Activity Statistics The Activity Statistics widget displays a trend graph of activities per application, with each tab representing a different application. You can manage the applications to monitor by adding tabs (by clicking the **+** icon next to the tabs) or by removing tabs (by clicking the **x** icon on the tab). The maximum number of tabs is five. The main sections of the **Activity Statistics** widget are: **Timeline drop-down menu** - Allows you to select a time range for the graph: - Last 24 Hours - Last 72 Hours - Last 7 Days - Last 30 Days **Generate Report tab** - Provides functionality as described in the [Data Ownership](#data-ownership) section. **Activity Statistics graph** - Hover over any point on the graph to see a tooltip with information about the number of activities for a given date and time. Click on the graph to drill down into the activity forensics screen, which shows a list of activities per resource.\ Alternatively, you can navigate to **Resources > Activities** to access this screen. This widget is updated online. Reload the page to refresh the data. ### Alerts in Last 7 Days The Alerts in Last 7 Days widget displays the number of alerts created within the last seven days, particularly highlighting the top five access rules with the most alerts. The main sections of the Alerts in Last 7 Days widget are: **Generate Report tab** - This tab provides functionality as described in the [Data Ownership](#data-ownership) section. **Alerts in Last 7 Days graph** - Hover over any portion of the bar graph to display a tooltip with information about the number of alerts of a specific type, the alert date, and the group for whom the alert was issued. Select a bar on the graph to view the list of classified resources in the selected application. This widget is updated online. Reload the page to refresh the data. ### Active Data Classification Policies The Active Data Classification Policies widget displays the active data classification policies in separate graphs for each policy. Each graph shows the five applications with the most policy-classified resources. The main sections of the Active Data Classification Policies widget are: **Number of Policies** - The number of policies is shown in parentheses after the widget name. Only one policy bar graph is displayed at a time. Use the arrows on the right or left of the graph to switch between different policy graphs. **Generate Report** - This tab is described in the [Data Ownership](#data-ownership) section. **Active Data Classification Policy graph** - This graph shows the number of resources for each of the five top applications for a given policy. Select a bar on the graph to view the list of classified resources in the selected application. This widget is updated once a day by default. Select **Update Now** to refresh the data. ### Active Campaigns The Active Campaigns widget displays a graph showing the progress of active campaigns with a separate screen for each campaign. The main sections of the Active Campaigns widget are: **Number of Active/In Progress Campaigns** - The number of campaigns is shown in parentheses after the widget name. Only one campaign circle graph is displayed at a time. Use the arrows on the right (to display the next graph) or left (to display the previous graph) to switch between graphs of other campaigns. **Generate Report** - This tab is described in the [Data Ownership](#data-ownership) section. **Active Campaign graph** - This circle graph shows the percentage of records for each active campaign, as well as the campaign status: - Approved (green) - Rejected (red) - Pending (gray) Select a bar in the graph to drill down to a screen with a list of pending records per reviewer in a selected campaign. (You can also access this screen by navigating to **Compliance > Access Certification**.) This widget is updated once a day by default. Select **Update Now** to refresh the data. ### Top Sensitive Resources by Activity The Top Sensitive Resources widget displays a table of the sensitive resources with classified data, with the most activities within a selected time frame. The table includes columns for the number of categories and number of activities for each resource listed. Choose the number of categories for a resource to display their names. This widget is updated online. Reload the page to refresh the data. ### Top Users with Pending Tasks The Top Users with Pending Tasks widget displays a table of File Access Manager users with the most pending tasks. Examples of tasks are access certifications and access requests. The table includes columns for the name of the user, the number of the user’s pending tasks, and a button to send a reminder to the user Select the **Send Reminder** icon in the row of the user to send the user a reminder of the tasks still pending. The following alert displays: “Email reminder to [User FullName] is being sent. Notification will be provided upon completion.” This widget is updated once a day (default). Select **Update Now** to refresh the data. ## Data Owners The following subsections describe each of the Data Owner Dashboard sections in detail. ### My Resources The My Resources section is located at the top of the main Dashboard display. The displayed information changes, depending upon the logged-in user’s owned resources. The number in parentheses after the name of the resource is the average score of all the KPIs (Key Performance Indicators). The name of the application and its full path are beneath the Resource name. The KPIs (Key Performance Indicators) change based on the selected resource. Each KPI lists the number of indicators, along with their weighted scores (ranging from 1 to 10), which are also displayed in a color-coded circle graph. The KPIs include: - Overexposed Resources - Overexposed Sensitive Resources - Users with Stale Permissions (permissions older than 12 months) - Stale Data (data older than 12 months, expressed in megabytes or gigabytes) The color-coded scores are: - Red (0-5) - Yellow (5-7.5) - Green (7.5-10) To view the details of a specific KPI with the applicable filters, scope, and permission type, navigate to **Resources > Path** (for example, C:) > **KPI** or select a specific KPI in the Dashboard view. Select a KPI to see details, with the relevant filters, scope, and permission type. Select the Dashboard tab to return to the Dashboard view. ### Did You Know? The Did You Know? section of the Dashboard contains useful information about an owned resource. This includes statistics, resource information about logged-in users, and warnings. The information may highlight users who can access resources with specific permission types or show how many users accessed a specific resource within a defined period. This information is updated for each logged-in user. To navigate the **Did You Know** carousel: 1. Select the **>** to the right (or the **\<** to the left) of the displayed entries. 1. Select a specific **Did You Know?** item to review it. 1. On a tablet, use touch selection and navigation (left or right) to view the information. The carousel displays four items at a time and automatically moves to the next set of four items every 5 seconds. The progress dots at the bottom of the Did You Know? section show how many total groups of information are available. For example, if five dots are displayed, there are twenty pieces of information in total. 1. Select **Review Now** to display the details of any item in the **Did You Know?** section. ### My Tasks The My Tasks section, located at the top right of the Dashboard display, lists the number of pending items in the following categories: - Access Certifications - Access Requests - Owners Election Note You can navigate directly to the **My Tasks** view for a specific task by selecting that task. ### Owner Leaderboard The Owner Leaderboard section of the Dashboard displays information about the data owners with the highest-ranking score per owned resource. Owner Leaderboard scores are ranked only for data owners, displaying the identities and scores of the top five data owners and the score of the logged in user (displayed as “Me”). The Me entry indicates whether the user’s rank has increased (a green arrow pointing up) or has decreased (a red arrow pointing down). # Navigation This section describes the main user interface of the File Access Manager business website, as well as its content and purpose. Across the top of the main screen are tabs for each of the primary File Access Manager website system functionalities, including: - Dashboard - Resources - My Tasks - Reports - Compliance - Forensics - Goals - Settings - Admin The top right portion of the main screen remains the same for all Navigation screens. From left to right, it features: - **New Access Request** – used to open the Access Request wizard (common to all screens: Dashboard, My Tasks, Resources, Settings, and Reports) - **Notifications** – listing outstanding reports and requests - **User Name Tab** - **Change the interface language** - **About** – File Access Manager and SailPoint copyright and patent information. ## File Access Manager Web Interface The opening screen, for most users, is the data owner dashboard, which gives an overall view of the applications being monitored. ### Data Owner Dashboards The Data Owner dashboard is a collection of informational screens for business data owners. Data owners use their dashboards to answer the following questions: - Who accesses data? - Who has access to what data, and what actions can they perform on it? - What sensitive data types reside within these data? - Who are the top active users of the data? - What data / permissions are stale? In addition, data owners can: - Define which actions will trigger a notification to the data owner - Receive reports based on those notifications ## Interface Languages The File Access Manager business website supports interfaces in the following languages : - Chinese (Simplified) - Chinese (Traditional) - Danish - Dutch - English - French (France) - French (Canadian) - German - Hebrew - Italian - Japanese - Portuguese (Brazil) - Spanish - Swedish To change the interface language: 1. Click the arrow next to the user name on the top corner of the screen and select Language. This will open the language selection screen (see image below). Select a language, and then click Save. The language will remain set until the next time you change the language. Note In case the current language is not set to a language you understand, the language selection menu is the only option under the user name menu. This menu will be positioned in the top right, or top left corner of the screen, depending on the current language direction. On the language selection panel, the **Save** button is the button in light blue, the **Cancel** button the one in white. Note The Web Localization chapter of the File Access Manager Administrator Guide describes how to define additional languages. ## Navigating the Data Grid To see more results per page (the default is 10), select the dropdown menu on the left side of the screen to choose 10, 25, 50, or 100 results per page. Use **\<<** and **>>** at the bottom right of the page to from the next and previous pages. ## Time and Date Format The time and date format are taken from the browser setting, according to the language/locale. For example, using a language setting of English (US), will result in a date and time format of: `MM/DD/YYYY H:MM (AM/PM)` This setting is used regardless of the language setting selected in the File Access Manager website. ## Notifications All users are notified of the success or failure of various operations across system tasks and screens. The notification icon is a dark gray bell, located in the notification panel at the top right of each screen. The number displayed next to the bell represents the number of unread notifications (i.e., notifications the user has not yet clicked on). To clear the notification counter, simply open the notification window. If there are no unread notifications, the bell icon will appear without a notification count. ### Notification Panel To view new notifications: 1. Select the gray bell icon in the notification panel. 1. A list of the last ten notifications displays, with the most recent notification at the top of the list. Note New notifications also display the word “New”. This no longer displays after the user clicks on the notification. 1. Select the link (if the link displays, since not all notifications have links) in a selected notification.\ The link redirects the user to the object of the notification, for example, a report or a campaign. # Goals Introduction Currently, the only goal available is the Data Owner’s Election. Data Owners are responsible for protecting the data within a specific resource. Administrators use the Goals process so that individuals who are most knowledgeable about the use of a specific resource can elect (via a crowd sourcing process) the most suitable data owners for that resource. Note By default, the ability to view the Goals tab is assigned only to users with administrator capabilities. ### Running Goal vs Goal A **running goal** refers to each determination of a data owner for a resource in the crowd sourcing process, while a **goal** refers to the collection of all determinations of data owners for resources in the crowd sourcing process. Therefore, a goal is a collection of activities. For example, if the goal is to identify the data owners for five business resources in a file server application, that goal would consist of five running goals — one for each resource. The goal lifecycle stages are: **Goal Creation** - An administrator creates goal activities, specifying the goal type, application, scope, and settings. **Goal Pending for Execution** - After goal creation, but before the system sends emails to participants, an administrator checks the goal status, including the selected goal participants and data owner candidates, to validate successful goal creation. **Election** - After goal execution, participants (who were selected in the creation process) vote for data owners. **Appointment** - Reviewers review the selected data owners, unless the administrator opts for automatic selection of data owners. **Completed** - A goal is considered completed when all goal activities have been completed (e.g., when all data owners have been assigned). # Completed Goals A completed goal is a goal to which an owner has been assigned to the goal resource. The Completed Goals tab displays a summary of the completed goals, including the following information: - Goal Type - Application - Start Date - End Date - Percentage of Goal Completed ## Completed Goals Menu Select the menu button at the top right of the Completed Goals window to display a dropdown menu of status activities. The status actions include: - **View Details**: Displays all the goal details. - **Refresh**: Updates the screen display. - **Reinitialize Goal**: Starts the goal creation process from the beginning. The status will be "Ready for Execution" and the system will delete all votes. This action cannot be undone. - When you select **Reinitialize**, a confirmation dialog will appear, asking if you are sure you want to reinitialize the goal, warning that proceeding will permanently delete all the data for that goal. Select **Yes** to reinitialize, or **No** to return to the **Running Goals** screen. - **Delete**: Deletes the goal. This action cannot be undone. - When you select **Delete**, a confirmation dialog will appear, asking if you are sure you want to delete the goal. Select **Yes** to delete, or **No** to return to the **Running Goals** screen. ### Show Status Select **Show Status** at the bottom right of the Completed Goals box. There are two final candidates pending the review of one reviewer. After a user (for whom a review process was required) has voted, the system will add a review task to the reviewer’s task list. Note One user can be both a final candidate and a reviewer. If a goal is ready for execution, you can view the status of that goal before executing it by selecting the **Show Status** button (to the right of the Execute Now button at the bottom right of each goal marked **Ready for Execution**). Note If goal creation is in progress, the **Execute Now** and **Show Status** buttons will not be available. The only available button is **Refresh**. To view status details for a newly created goal, select **Show Status**. The Data Owners Election will display. ### Resources Tab The Resources section of the Show Status screen displays how many of the total activities (resources) for the displayed goal have been finished. In the **Status** dropdown menu under Resources, the following options are available: - **All**: Displays all the resources in this goal. - **Election**: Displays activities in the Election state (pending completion of voting). - **Appointment**: Displays resources in the Appointment state (pending review). - **Finished**: Displays all the resources for which the Election and Appointment processes have been completed. The bottom right of the Resources section displays the previous (**Prev**) or next (**Next**) screen, and the total number of screens (e.g., ½ indicates the first of two screens). ### The Election Tab The Election section of the Show Status screen displays the Current Results, which is the number of participants (out of the total number of participants) who have voted. Up to five data owner candidates may be displayed, with their names, rank, and percentage of votes received. The first and second place data owner candidates are given prominence. 1. Select **All Participants** at the top right of the **Election Participants** section to view a summary of the election participants. The viewing options are: - **All Participants** - **Voted**: The number of participants who have already voted. - **Pending**: The number of participants whose vote is still pending. !!! note Navigation in the All Participants view of the Election section of the Show Status screen is the same as in the Resources section. 1. Select **Remind** next to a user who has not yet voted to remind that user to vote. 1. Select **Votes** next to a user who has voted to see a list of the people for whom that user voted. 1. Select **See Summary** in the top right of the Election section to return to the Summary view. 1. Select **End Election Process** in the top right of the Election section to end the election process, even if it does not include 100% of the votes. A confirmation dialog appears, asking if you want to end the election process. 1. Select **Yes** to end the election process, or **No** to return to the previous screen. # Creating Goals The **Set New Goal** process consists of the following steps: 1. Goal Type 1. Application 1. Scope 1. Settings 1. Summary To set a new goal: 1. Navigate to **Goals > Set New Goal**. 1. Select the relevant goal type from the available options. 1. Select **Next** to select the Application. 1. Select one of the applications displayed. The resources for this goal will be from the selected application. 1. Select **Next** to set the scope. ## Scope Select resources (one or more) from any of the following categories: - **Top level resources** – Resources for a specific application from the top level of the resource tree. - **Resources that change inherited permissions** – Resources that inherit permissions, with permissions added to those inherited permissions. - **Resources that do not inherit** – Resources that break inheritance. - **All resources** – Resources from the entire resource tree. - Check the checkbox next to one or more resources to select them, then elect **Add** under the resource list to add them as new activities in the current goal. - Check the **Select All** checkbox to select all the resources listed under each category. - The number of resources selected will display in parentheses in Resources Added, and the added resources will be unchecked in the original resource list. - Select **Resources Added** to display a list of selected resources. - Select the blue **X** to the right of any selected resource in the list to deselect that resource. - Select **Save** to save the revised selection of resources. - Select **Next** to open the **Settings** screen. ## Settings 1. In the **Goal Name** text box, type an appropriate name for the goal. There are two methods of finalizing data owners: - **Review Process Required**: A reviewer must approve or reject the selected data owners before their final appointment. - **Automatic**: Appoint selected data owners without a review based on the votes of the participants. If you select **Review Process Required**: - Start typing to select a **reviewer** in the **Reviewers** text box. - Select the blue **X** to the right of any selected reviewer in the reviewer list to deselect them. - Select **Next** to open the **Summary** screen. ## Summary Screen The goal **Summary** screen lists the following information: - **Goal Type** – The goal type (e.g., Data Owners Election) - **Goal Name** – The name selected for the goal - **Application** – The application for which a data owner is to be selected - **Scope** – Number of resources - **Appointment Method** – Either **Review Process Required** or **Automatic** - **Reviewers** – Names of reviewers if the appointment method is **Review Process Required** Select **View List** in **Scope** to view the selected resources. Select **Create Goal** at the bottom right of the Summary screen. A success dialog will display, indicating that the goal was created successfully, and requesting that you execute the goal in Running Goals. Select **OK** to finalize the goal creation. # Running Goals A running goal is a goal in process, in which no owner has yet been assigned to the goal resource. Any number of running goals may be displayed at any given time. Administrators can manage goals more efficiently by viewing the status of the goals before executing them. To view goal status details, perform the following steps: 1. Navigate to **Goals > Running Goals**. 1. The Running Goals screen displays. Important general notifications will display immediately under the **Running Goals** title. Examples of notifications include any goals that have been deleted or have been reinitialized and are ready to start. All goals display: - Goal Type - Application - Start Date If a goal is being created, the message **“Goal creation in progress…”** displays in blue at the bottom left of the goal display. 1. Select **Refresh** in any goal being created to refresh the goal creation progress status. If a goal has been created and is ready to start, the message **“Ready to start…”** displays in green at the bottom left of the goal display. 1. Select **Execute Now** to start the goal. Execution of the goal begins. 1. Select **Show Status** to view the goal status. If a goal has already been started, the percentage of the goal achieved displays. 1. Select **Show Status** to view the goal status. Note Whether you select **Goal Status** in a goal that is ready to start or in a goal that has already started, the status of the running goals will display, based on one of the following filtered statuses (the default being **All**): - **All**: Displays all the resources in this goal. - **Election**: Displays resources in the Election state (pending completion of voting). - **Appointment**: Displays resources in the Appointment state (pending review). - **Finished**: Displays all the resources for which the Election and Appointment processes have been completed. If no candidates were selected as data owners for a given resource, the message **“There were no eligible candidates for the selected resource”** displays to the right of the list of resource statuses. ## Running Goals Menu Select the menu button at the top right of the Running Goals window to display a dropdown menu of status activities. ### Goal Status and Details The following are listed in the dropdown as Goal activities: - **View Details**: Displays all goal details. - **Refresh**: Updates goal status. - **Reinitialize**: Starts the goal creation process from the beginning. The status will be "Ready for Execution" and the system will delete all votes. This action cannot be undone. Note When you select **Reinitialize**, a confirmation dialog will appear, asking if you are sure you want to reinitialize the goal. Select **Yes** to reinitialize, or **No** to return to the Running Goals screen. - **Delete**: Deletes the goal. This action cannot be undone. Note When you select **Delete**, a confirmation dialog will appear, asking you to confirm the deletion of the goal. Select **Yes** to delete, or **No** to return to the Running Goals screen. # Identity Collection The Identity Collector is a software component responsible for synchronizing identity data, such as accounts and attributes, from identity stores. Examples of Identity Collectors are: - Active Directory (the most common Identity Store) - NIS Identity Collector (used in Linux/Unix environments) - Microsoft Azure Active Directory (used for cloud applications) - Data Source Identity Collector You define Identity Collectors by creating a new Identity Collector, which represents the main Active Directory Domain (or Authentication Store). The following section describes how to create or edit an Active Directory identity collector. The process for creating or editing an NIS, Azure, or Data Source Identity Collector is similar to that for Active Directory, with the main difference being the actual configuration. You can also configure and edit Cloud Identity Collectors (e.g., Box, Dropbox, Google Drive, etc.). The Configuring the Permissions Collector section in the Administrator guide outlines how to configure users, groups, and user-groups for homegrown Permissions Collection, which is similar to configuring a Data Source Identity Collector. ## Cloud Identity Collectors Cloud application Identity Collectors are created during the application setup process. Once created, they will be displayed and can be edited through the Identity Collector screen. These Identity Collectors are created through the adding application setup process. You can view the connected fields, join other data sources, and complete dynamic field mapping. For Cloud Identity Collectors, the Permissions Collector Scheduler can be set through the application’s wizard. Note You cannot set a Cloud application as an authentication store. ## Identity Collector Main Page The Identity Collector page displays all previously created Identity Collectors. This screen allows the user to add, edit, remove, sync, and manage Identity Collectors. You can also set the Authentication Store. Note Cloud application Identity Collectors are created during the application setup process. They will be displayed on this screen and can also be edited here. ### Accessing the Identity Collector Page Navigate to **Admin > Identity Collectors** to access the Identity Collector page. To Create a New Identity Collector: 1. Select **Create New**. - **Name** - This is the name of an **Identity Collector**. - **Type** - This refers to the type of Identity Collector (e.g., **Active Directory**, **Azure**, **NIS**, **Data Source**). - **Actions** - The Actions column provides three options: - **Edit** - **Delete** - **More** - **Run Synchronization** - **Set Authentication Store** Note If an **Identity Collector** is set as an Authentication Store, that Identity Collector will display in the first row. ### Filters To filter the results in the grid, select the filter icon on the heading bar and select the desired criteria. Users can filter Identity Collectors by entering a full or partial name, or by selecting a known type. 1. Select **Apply** to apply the filter. 1. Select **Clear All** to remove the filters and repopulate the grid. ### Editing an Identity Collector To edit an Identity Collector, select the edit icon on the row of the Identity Collector you wish to modify. Note The Type field will be disabled and cannot be changed. With the exception of the Type field, every other step in the wizard will be editable. ### Deleting an Identity Collector Note If an Identity Collector is set as the Authentication Store, it cannot be deleted. If an Identity Collector is used in another part of File Access Manager, it cannot be deleted. Additionally, only one Identity Collector can be deleted at a time. To delete an Identity Collector: 1. Select the **delete icon** on the row of the Identity Collector you wish to remove. 1. A confirmation dialog will appear, asking you to confirm the deletion of the selected Identity Collector. # Running the Synchronization Task A user can sync an **Identity Collector** to ensure it has the most up-to-date identities. If any changes are made to the **Identity Collector**, run the synchronization task to update those changes. ### To run the synchronization: 1. Navigate to the **Actions** column on the Identity Collector row. 1. Select **More Options > Run Synchronization**. Note It is recommended to run the synchronization task before selecting an **Authentication Store**. Note Cloud applications cannot run the **Synchronization** task. # Setting an Authentication Store **Authentication Stores** are used by **File Access Manager** to authenticate users across its various interfaces. ### Changing the Authentication Store Changing the Authentication Store from one Identity Collector to another will affect the following: - The users associated with File Access Manager and their access permissions. - It will stop the review processes of all running Access Certification Campaigns and Access Requests. - It may impact predefined review processes. Before changing your Authentication Store, it is recommended to run synchronization on the Identity Collector to ensure you have the most up-to-date results and avoid any loss of user permissions. **To set an Authentication Store:** 1. Select **More Options** on the row of the Identity Collector you wish to set as the Authentication Store. 1. Choose **Set Authentication Store**. Note The newly set Identity Collector will be moved to the top of the grid. Caution Cloud application Identity Collectors cannot be set as Authentication Stores. Caution You can connect the Authentication Store Identity Collector to other Identity Collectors by setting the Same User Field between two or more collectors. This will extend the Access Request's Usage list. When creating a new Identity Collector, a toggle appears in the General Details step to set the Identity Collector as the Authentication Store. Note The toggle to set the Authentication Store will only appear when creating a new Identity Collector if no Authentication Stores are currently enabled. # Active Directory Identity Collector The Active Directory Identity Collector is used to collect the user's and group's existing data. ## General Details To create an Active Directory Identity Collector: 1. Open the Identity Collectors panel by navigating to **Admin > Identity Collectors**. 1. Select **Create New** to open the Identity Collector Configuration Wizard. **Identity Collector General Details:** - Select **Active Directory** as the type. - Provide a name for the **Identity Collector** you are creating. - In the **Advanced Options** section, choose whether you would like to enable **Access Fulfillment**. If enabled, the system can add and/or remove users from groups within this identity collector. 1. Select **Next** to continue. ## Connection Details by DEC You can configure the Identity Collector using either an existing DEC (Data Exchange Connector) or by manually entering connection properties. - Select **By DEC** to populate the Identity Collector with pre-configured data from a DEC. - Select **By Properties** to manually enter connection properties from a list of defined properties. **If you selected By DEC:** 1. Select the relevant **Active Directory DECs** from the dropdown list. Note If you have configured a DEC to connect to **Active Directory**, you can reuse that configuration here. **If by Default Properties:** By default, File Access Manager retrieves several properties from Active Directory, such as Domain, Display Name, and others. To add more properties: 1. Type the desired property in the Properties to Fetch field. 1. Select the **plus icon** to add the property. The properties you retrieve from Active Directory will be available for mapping to Data Dictionary fields later. Note This process can be done for both User Collection and Groups Collection. You need to complete the process by either joining Data Sources as the local key or configuring the Identity Collector in the Dynamic Field Mapping step. Select **Next** to continue. ## Connection Details By Properties If you select **By Properties**, enter the following details in the relevant fields: - **Domain NetBios Name** - Enter the NetBios name of the domain. - **Domain DNS Name** - Enter the system domain name. - **User** - Provide the username associated with this Identity Collector. - **Password** - Provide the password for the Identity Collector. - **SSL** - Select this option if the connection to Active Directory is secure. - **Base DN** - Define the distinguished name of the folder from which identities (users and groups) will be collected. If left empty, the **Base DN** will default to the root, and File Access Manager will collect users and groups from the existing Active Directory server. By default, File Access Manager retrieves several properties from Active Directory, such as Domain, Display Name, and more. You can add additional properties by typing them into the **Properties to Fetch** field and selecting the **plus icon** to add the property. ### Trusted Domains When configuring an Active Directory Identity Collector By Properties, you need to complete the configuration by selecting the relevant Trusted Domains. An internal list of Trusted Domains that were retrieved displays. ## Users Collection Verify that the system has successfully retrieved the requested data. The table displays the first fetched results from the connected Identity Collector, as well as the fetched properties. 1. Select **Yes** or **No** to join this Identity Collector with any existing data sources. A user may want to join data sources to gain additional attributes that can be configured to the Identity Collector. If you select **No**, select **Next** to proceed to the Dynamic Field Mapping screen (optional). If you select **Yes**, you can use one of the Identity Collector fields as the local key to gather additional user fields from other data sources by joining those data sources. ### Join Data Sources (Users) Complete the following steps: 1. Select the desired data source you want to join with from the first dropdown. 1. Select a **Local Key** you want to join. 1. Select a **Remote Key** you want to join it to. Note Select the plus icon to join more data sources. ## Dynamic Field Mapping (Users) This feature allows the user to rename the previously fetched properties by mapping them to a dictionary field, effectively changing their name. Note Dynamic Field Mapping is not mandatory. To create a new data dictionary field: 1. Use the link provided. 1. Once created, select **Refresh** to have the new data dictionary field display in the User Dictionary Field dropdown. 1. From the **Users Dictionary Field** dropdown, select a mapped property. 1. From the **Mapped Field** dropdown, select a value that is to be mapped to the new data dictionary field. Note To add more dictionaries, select the plus icon. Select **Next**. ## Group Collection Verify that the system has successfully retrieved the requested data. The table displays the first fetched results from the connected Identity Collector, as well as the fetched properties. 1. Select **Yes** or **No** to join this Identity Collector with any existing data sources. A user may want to join data sources to gain additional attributes that can be configured to the Identity Collector. If you select **No**, select **Next** to proceed to the **Dynamic Field Mapping** screen (optional). If you select **Yes**, use one of the Identity Collector fields as the **local key** to gather additional group fields from other data sources by joining those data sources. ### Join Data Sources (Groups) Complete the following steps: 1. Select the desired data source you want to join with from the first dropdown. 1. Select a **Local Key** you want to join. 1. Select a **Remote Key** you want to join it to. Note Select the plus icon to join more data sources. Select **Next**. ## Dynamic Field Mapping (Groups) This feature allows the user to rename the previously fetched properties by mapping them to a dictionary field, effectively changing their name. Note Dynamic Field Mapping is not mandatory. To create a new data dictionary field: 1. Use the link provided. 1. Once created, click **Refresh** to have the new data dictionary field display in the **Group Dictionary Field** dropdown. 1. From the **Groups Dictionary Field** dropdown, select a mapped property. 1. From the **Mapped Field** dropdown, select a value that is to be mapped to the new data dictionary field. Note To add more dictionaries, select the plus icon. Select **Next**. ## Final Configurations On the final screen in the Identity Collector wizard, a user can set a couple of final configurations and set the scheduler task. ### Users Collection The following final configurations are optional: - **Email Field Mapping** – Select an email field to be used to send alerts. If your Active Directory is integrated with Microsoft Exchange, you can map the `proxyAddresses` field. Otherwise, select a Users Dynamic Field that is already mapped from the wizard. - **Unique User Accounts Mapping** – This is used to connect the Authentication Store Identity Collector to other Identity Collectors by setting the Same User Field between two or more Identity Collectors, mainly Cloud Identity Collectors, which extends the Access Request's Usage list. ### Scheduler If you wish to create a scheduled task, check the **Create a Schedule** toggle and complete the following: 1. Provide a name for the schedule. 1. The Scheduler is Active by default. If you wish to turn the scheduled task inactive, switch the toggle to **Inactive**. 1. If you want to start the Identity Collector process immediately, select **Schedule**. If you want to schedule the Identity Collector after a specific task completes, select **Run After**. Note If **Run After** is selected, all **Schedule** options will disappear. 1. Select how frequently you want the Identity Collector task to run: 1. **Once** – One-time run. Verify the date selected is in the future. 1. **Hourly** – Select the time and date for the run. Verify the date selected is in the future. Either select a specific end date or select **Never**. 1. **Daily** – Same as hourly. 1. **Weekly** (Set as default) – Select a day or multiple days for recurring runs. Either select a specific end date or select **Never**. 1. **Monthly** – Same as hourly. 1. **Quarterly** – Same as hourly. 1. **Half Yearly** – Same as hourly. 1. **Yearly** – Same as hourly. 1. If you want the task to end on a specific future date, select **On** and then provide the ending date. If the task should run without an end date, select **Never**. 1. Select **Save** to store the Identity Collector without running synchronization or select **Save & Run** to create and synchronize the Identity Collector. # Azure Active Directory Overview Microsoft Azure Active Directory Identity Collector supports standard OAuth 2.0 Authorization for the Azure AD connector. The authorization sequence directs the user through a standard Microsoft O365 consent flow. This grants the File Access Manager Azure AD Connector application the privilege to acquire and refresh access tokens for the relevant Tenant/ Domain. This is a similar configuration to other cloud connectors (like OneDrive). ## General Details To create or edit an Azure Identity Collector: 1. Open the Identity Collectors panel by navigating to **Admin > Identity Collectors**. 1. Select **Create New** to open the **Identity Collector Configuration Wizard**. 1. Select **Azure Files** for the type. 1. Provide a name for the Identity Collector you are creating. ## Connection Details 1. Enter a valid **Tenant Domain Name**. Once entered, select the check mark to the right of the field. 1. Select the link under **Authorization Page** to enter the username and password. The user will then retrieve an authorization code. 1. When the File Access Manager Cloud Application Authorization Service window displays, copy the code provided. 1. Paste the copied code into the **Azure Authorization Code** field. ## Users Collection 1. Verify that the system retrieved the requested data successfully. 1. Select **Yes** or **No** to join this Identity Collector with any existing data sources. A user may want to join data sources in order to gain additional attributes that can be configured to the Identity Collector. If you select **No** to joining data sources, select **Next** to be taken to the **Dynamic Field Mapping** screen, which is optional. If you select **Yes** to joining data sources, you can use one of the Identity Collector fields as the local key to gather additional user fields from other data sources by joining those data sources. ### Join Data Sources – Users Complete the following: 1. Select the desired data source you want to join with from the first dropdown. 1. Select a **Local Key** you want to join. 1. Select a **Remote Key** you want to join it to. Note Select the plus icon to join more data sources. 1. Select **Next**. ## Dynamic Field Mapping (Users) This feature allows the user to rename the previously fetched properties by mapping them to a dictionary field, and therefore changing their name. Note Dynamic Field Mapping is not mandatory. 1. To create a new data dictionary field, use the link provided. Once created, select **Refresh** to have the new data dictionary field display in the **User Dictionary Field** dropdown. 1. From the **Users Dictionary Field** dropdown, select a mapped property. 1. From the **Mapped Field** dropdown, select a value that is to be mapped to the new data dictionary field. Note To add more dictionaries, select the plus icon. 1. Select **Next**. ## Group Collection – Azure Verify that the system has successfully retrieved the requested data. Note For the Azure group data sample, File Access Manager displays each record of the sample data twice. 1. Select **Yes** or **No** to join this Identity Collector with any existing data sources. Joining data sources allows you to access additional attributes that can be configured for the Identity Collector. If you select **No** to joining data sources, select **Next** to proceed to the optional **Dynamic Field Mapping** screen. If you select **Yes** to joining data sources, you can use one of the Identity Collector fields as a local key to gather additional group fields from other data sources. ### Join Data Sources – Groups Complete the following steps: 1. From the first dropdown, select the desired data source you want to join with. 1. Select a **Local Key** to join. 1. Select a **Remote Key** to join it to. Note Click the plus icon to join additional data sources. 1. Select **Next**. ## Dynamic Field Mapping (Groups) This feature allows the user to rename the previously fetched properties by mapping them to a dictionary field, effectively changing their name. Note Dynamic Field Mapping is not mandatory. To create a new data dictionary field: 1. Use the link provided. 1. Once created, click **Refresh** to have the new data dictionary field display in the **Group Dictionary Field** dropdown. 1. From the **Groups Dictionary Field** dropdown, select a mapped property. 1. From the **Mapped Field** dropdown, select a value that is to be mapped to the new data dictionary field. Note To add more dictionaries, select the plus icon. Select **Next**. ## Final Configurations On the final screen of the **Identity Collector Wizard**, the user can set a few final configurations and define the scheduler task. ### Users Collection The following final configurations are optional: - **Unique User Accounts Mapping**: This feature is used to connect the Authentication Store Identity Collector to other Identity Collectors by setting the **Same User Field** between two or more Identity Collectors, primarily for cloud Identity Collectors. This extends the **Access Request's Usage List**. ### Scheduler If you wish to create a scheduled task, check the **Create a Schedule** toggle and complete the following: 1. Provide a name for the schedule. 1. The Scheduler is Active by default. If you wish to turn the scheduled task inactive, switch the toggle to **Inactive**. 1. If you want to start the Identity Collector process immediately, select **Schedule**. If you want to schedule the Identity Collector after a specific task completes, select **Run After**. Note If **Run After** is selected, all **Schedule** options will disappear. 1. Select how frequently you want the Identity Collector task to run: - **Once** – One-time run. Verify the date selected is in the future. - **Hourly** – Select the time and date for the run. Verify the date selected is in the future. Either select a specific end date or select **Never**. - **Daily** – Same as hourly. - **Weekly** (Set as default) – Select a day or multiple days for recurring runs. Either select a specific end date or select **Never**. - **Monthly** – Same as hourly. - **Quarterly** – Same as hourly. - **Half Yearly** – Same as hourly. - **Yearly** – Same as hourly. 1. If you want the task to end on a specific future date, select **On** and then provide the ending date. If the task should run without an end date, select **Never**. 1. Select **Save** to store the Identity Collector without running synchronization or select **Save & Run** to create and synchronize the Identity Collector. # Data Source Overview The Data Source Identity Collector is based on already configured Data Sources. Depending on what is needed, the Data Source fields are configured by mapping them to the mandatory and optional fields. You can map Data Source Identity Collector relationships between users, groups, user memberships within a group, and by group hierarchies. ## General Details To create or edit an Azure Identity Collector: 1. Open the Identity Collectors panel by navigating to **Admin > Identity Collectors**. 1. Select **Create New** to open the **Identity Collector Configuration Wizard**. 1. Select **Data Source** for the type. 1. Provide a name for the Identity Collector you are creating. 1. Within the Advanced Options section, the option to set up Groups is automatically selected. Select if you want to set the Groups Hierarchy. 1. Select **Next**. ## Connection Screen (Users) Important This is the first of four connection screens for the data source. 1. From the dropdown, select an already existing data source you wish to connect to. Note If a data source is recently created, select **Refresh** to view the newly created data source in the dropdown. 1. From the **Username** dropdown, select the appropriate username. 1. If needed, you can map additional data in the **Optional Field** to the system's default properties. This mapped data from the data source will be saved in the database. ## Dynamic Field Mapping (Users) This feature allows the user to rename previously fetched properties by mapping them to a dictionary field, thereby changing their name. Note Dynamic Field Mapping is not mandatory. 1. To create a new data dictionary field, use the link provided. Once created, select **Refresh** to have the new data dictionary field display in the **User Dictionary Field** dropdown. 1. From the **Users Dictionary Field** dropdown, select a mapped property. 1. From the **Mapped Field** dropdown, select a value to be mapped to the new data dictionary field. Note To add more dictionaries, select the plus icon. 1. Select **Next**. ## Connection Details (Groups) This screen only displays if the **Groups** toggle was selected in the General Details screen. Important This is the second of four connection screens for the data source. 1. From the dropdown, select an already existing data source you wish to connect to. Note If a data source is newly created, select **Refresh** to view the newly created data source in the dropdown. 1. From the **Group Name** dropdown, select a mandatory value to be mapped to the data source. 1. If needed, you can map additional data in the **Optional Field** to the system's default properties. This mapped data from the data source will be saved in the database. ## Dynamic Field Mapping (Groups) This feature allows the user to rename previously fetched properties by mapping them to a dictionary field, thereby changing their name. Note Dynamic Field Mapping is not mandatory. 1. To create a new data dictionary field, use the link provided. Once created, select **Refresh** to have the new data dictionary field display in the **Group Dictionary Field** dropdown. 1. From the **Groups Dictionary Field** dropdown, select a mapped property. 1. From the **Mapped Field** dropdown, select a value to be mapped to the new data dictionary field. Note To add more dictionaries, select the plus icon. 1. Select **Next**. ## Connection Details (User Membership in Groups) This screen only displays if the **Groups** toggle was selected in the General Details screen. Important This is the third of four connection screens for the data source. 1. From the dropdown, select an already existing data source you wish to connect to. Note If a data source is newly created, select **Refresh** to view the newly created data source in the dropdown. 1. From the **Group Name** and **Username** dropdowns, select the appropriate values. 1. From the **Group Name** dropdown, select a mandatory value to be mapped to the data source. 1. If needed, you can map additional data in the **Optional Field** to the system's default properties. This mapped data from the data source will be saved in the database. ## Connection Details (Group Hierarchy) This screen only displays if the **Groups** toggle and the **Group Hierarchy** toggle were selected in the General Details screen. Important This is the final screen when connecting data sources. 1. From the dropdown, select an already existing data source you wish to connect to. Note If a data source is newly created, select **Refresh** to view the newly created data source in the dropdown. 1. From the **Child Group Name** and **Parent Group Name** dropdowns, select the appropriate values. 1. If needed, you can map additional data in the **Optional Field** to the system's default properties. This mapped data from the data source will be saved in the database. ## Final Configurations On the final screen of the **Identity Collector Wizard**, the user can set a few final configurations and define the scheduler task. ### Users Collection The following final configurations are optional: - **Unique User Accounts Mapping**: This feature is used to connect the Authentication Store Identity Collector to other Identity Collectors by setting the **Same User Field** between two or more Identity Collectors, primarily for cloud Identity Collectors. This extends the **Access Request's Usage List**. ### Scheduler If you wish to create a scheduled task, check the **Create a Schedule** toggle and complete the following: 1. Provide a name for the schedule. 1. The Scheduler is Active by default. If you wish to turn the scheduled task inactive, switch the toggle to **Inactive**. 1. If you want to start the Identity Collector process immediately, select **Schedule**. If you want to schedule the Identity Collector after a specific task completes, select **Run After**. Note If **Run After** is selected, all **Schedule** options will disappear. 1. Select how frequently you want the Identity Collector task to run: - **Once** – One-time run. Verify the date selected is in the future. - **Hourly** – Select the time and date for the run. Verify the date selected is in the future. Either select a specific end date or select **Never**. - **Daily** – Same as hourly. - **Weekly** (Set as default) – Select a day or multiple days for recurring runs. Either select a specific end date or select **Never**. - **Monthly** – Same as hourly. - **Quarterly** – Same as hourly. - **Half Yearly** – Same as hourly. - **Yearly** – Same as hourly. 1. If you want the task to end on a specific future date, select **On** and then provide the ending date. If the task should run without an end date, select **Never**. 1. Select **Save** to store the Identity Collector without running synchronization or select **Save & Run** to create and synchronize the Identity Collector. # NIS Overview The NIS Identity Collector is used in Linux and Unix environments to collect user's and group's existing data. ## General Details To create or edit an NIS Identity Collector: 1. Open the Identity Collectors panel by navigating to **Admin > Identity Collectors**. 1. Select **Create New** to open the Identity Collector Configuration Wizard. 1. Select **NIS** for the Type. 1. Provide a name for the Identity Collector you are creating. 1. Select **Next**. ## Connection Details Provide the following information: - NIS Server Address - Username - Password - Port ## Users Collection 1. Verify that the system has successfully retrieved the requested data. Note Only the first ten results will display. 1. Select **Yes** or **No** to join this data source to other data sources. Joining data sources allows you to access additional attributes that can be configured for the Identity Collector. If you select **No** to joining data sources, select **Next** to proceed to the optional **Dynamic Field Mapping** screen. If you select **Yes** to joining data sources, you can use one of the Identity Collector fields as a local key to gather additional user fields from other data sources. ### Join Data Sources – Users Complete the following steps: 1. From the first dropdown, select the desired data source you want to join with. 1. Select a Local Key to join. 1. Select a Remote Key to join it to. Note Select the plus icon to join additional data sources. 1. Select **Next**. ## Dynamic Field Mapping (Users) This feature allows the user to rename previously fetched properties by mapping them to a dictionary field, thus changing their name. Note Dynamic Field Mapping is not mandatory. To create a new data dictionary field, use the link provided. Once created, select **Refresh** to display the new data dictionary field in the **User Dictionary Field** dropdown. 1. From the **Users Dictionary Field** dropdown, select a mapped property. 1. From the **Mapped Field** dropdown, select a value to be mapped to the new data dictionary field. Note To add more dictionaries, select the plus icon. 1. Select **Next**. ## Group Collection 1. Verify that the system has successfully retrieved the requested data. 1. Select **Yes** or **No** to join this data source to other data sources. Joining data sources allows you to gain additional attributes that can be configured for the Identity Collector. If you select **No** to joining data sources, select **Next** to proceed to the optional **Dynamic Field Mapping** screen. If you select **Yes** to joining data sources, you can use one of the Identity Collector fields as a local key to gather additional group fields from other data sources. ### Join Data Sources – Groups Complete the following steps: 1. From the first dropdown, select the desired data source you want to join with. 1. Select a **Local Key** to join. 1. Select a **Remote Key** to join it to. Note Click the plus icon to join additional data sources. 1. Select **Next**. ## Dynamic Field Mapping (Users) This feature allows the user to rename previously fetched properties by mapping them to a dictionary field, thereby changing their name. Note Dynamic Field Mapping is not mandatory. 1. To create a new data dictionary field, use the link provided. Once created, select **Refresh** to have the new data dictionary field display in the **User Dictionary Field** dropdown. 1. From the **Users Dictionary Field** dropdown, select a mapped property. 1. From the **Mapped Field** dropdown, select a value to be mapped to the new data dictionary field. Note To add more dictionaries, select the plus icon. 1. Select **Next**. ## Final Configurations On the final screen of the **Identity Collector Wizard**, the user can set a few final configurations and define the scheduler task. ### Users Collection The following final configurations are optional: - **Unique User Accounts Mapping**: This feature is used to connect the Authentication Store Identity Collector to other Identity Collectors by setting the **Same User Field** between two or more Identity Collectors, primarily for cloud Identity Collectors. This extends the **Access Request's Usage List**. ### Scheduler If you wish to create a scheduled task, check the **Create a Schedule** toggle and complete the following: 1. Provide a name for the schedule. 1. The Scheduler is Active by default. If you wish to turn the scheduled task inactive, switch the toggle to **Inactive**. 1. If you want to start the Identity Collector process immediately, select **Schedule**. If you want to schedule the Identity Collector after a specific task completes, select **Run After**. Note If **Run After** is selected, all **Schedule** options will disappear. 1. Select how frequently you want the Identity Collector task to run: - **Once** – One-time run. Verify the date selected is in the future. - **Hourly** – Select the time and date for the run. Verify the date selected is in the future. Either select a specific end date or select **Never**. - **Daily** – Same as hourly. - **Weekly** (Set as default) – Select a day or multiple days for recurring runs. Either select a specific end date or select **Never**. - **Monthly** – Same as hourly. - **Quarterly** – Same as hourly. - **Half Yearly** – Same as hourly. - **Yearly** – Same as hourly. 1. If you want the task to end on a specific future date, select **On** and then provide the ending date. If the task should run without an end date, select **Never**. 1. Select **Save** to store the Identity Collector without running synchronization or select **Save & Run** to create and synchronize the Identity Collector. # File Access Manager Overview When installing File Access Manager, the following is some information that could help in understanding the product and the process of installing. ## File Access Manager Architecture File Access Manager architecture usually requires a central installation with some remote gateways. Most File Access Manager connectors do not require any footprint on the monitored/analyzed system and therefore are installed on File Access Manager servers. In some cases, due to 3rd party vendors (mostly NAS vendors), it is imperative to have a local server at the same physical site where the monitored system is located. For more information on File Access Manager architecture see *“Capabilities and Architecture”* in the File Access Manager Administrator Guide. ## File Access Manager Connector Services Each type of connector has its own prerequisites and its own configuration. See the relevant Connector Installation guide for more information about the connector. ## Sizing Considerations File Access Manager is a scalable solution that enables the distribution of its services and also works in an all-in-one mode. The Administrator Guide has a complete description of the File Access Manager architecture configuration. One of the critical sizing considerations is the amount of disk space required to store activities over time. The table below describes the guidelines. Note For more details on sizing, refer to the File Access Manager Hardware Sizing Guide article on Compass. | **Service** | **CPU** | **Memory** | **Disk** | | ------------- | --------------------------------- | -------------------------------- | --------------- | | Elasticsearch | Minimum of 4 cores, Recommended 8 | Minimum of 8Gb, Recommended 16Gb | 0.5kb per event | Additional factors that affect the required hardware are: - Disaster recovery environment - High Availability solution It is highly recommended to consult with your SailPoint File Access Manager representative to obtain the correct configuration to support your requirements. ## Installation Prerequisites The following provides server support information: | **System** | **Supported Versions** | | --------------------------- | -------------------------------- | | File Access Manager Servers | Windows 2016 / 2019 / 2022 | | Workstation | Windows 7 and above | | Browser | Edge, Safari, Chrome, Firefox | | Database | MS SQL Server 2017 / 2019 / 2022 | ## Database Configuration ### Dedicated Instance We recommend installing File Access Manager on a dedicated instance. This configuration enables independence of configuration and assures resource allocation for the instance. However, we realize that a dedicated instance is a costly solution and therefore might be chosen at a later stage. Some of the File Access Manager requirements can be defined at the instance level and can work in such a way that avoids the definition of specific requirements for shared databases. Note This decision should be part of the sizing process led by your SailPoint File Access Manager representative. ### Required Features File Access Manager uses MS SQL Standard Edition that utilizes the database engine only. No other feature is required. File Access Manager thus enables the use of MS SQL native features for high availability and encryption without any interruption. ### Required Settings The following settings must be chosen for the installation instance: - **FILESTREAM using "Full Access Enabled"**\ Find the SQL Server Configuration Manager. Navigate to the properties of the service and select FileStream. Check all three boxes. - **CLR enabled** (Running .NET code in the database in Safe mode) - **SQL Mixed Authentication** ### Hyper-Threading It is recommended that hyper-threading on physical servers be disabled. ### Storage For a database server running as a virtual machine (of any kind), verify that the drives connected for the database storage are physical disks (dedicated for the virtual machine). - The drives must be separated for Data and Logs. - Format the drives with a 64K allocation unit. ### Backup & Recovery It is recommended that you use a Simple database recovery plan. Choosing any other recovery plan requires scheduled log backups to prevent the log file from overflowing. Data performance may be affected during log backups since File Access Manager is very write I/O intensive. ### Temp Database Note Depending on your database configuration, you might require additional storage allocated for a temp database. Please discuss this with your DBA. Ensure that the database is: - Defined on a separate drive - Physical and formatted to a 64K allocation unit - Allocated a temp database file for each core on the system - Limited in size so that the temp database files and logs do not overgrow the size of the disk ### Recommended Performance | **Metric** | **Requirement** | | ------------------------------ | --------------- | | Disk I/O Throughput (IOPS) | 12K IOPS | | Disk I/O Throughput Rate | 10500 Mb/s | | Throughput in Transactions/sec | 6000 TPS | | Disk I/O latencies for Read | < 8 ms | | Disk I/O latencies for Write | < 1 ms | # Administrative Client Installation The Administrative Client can be installed locally on one of the File Access Manager servers or on any remote station with access to the User Interface service. To run the Administrative Client installation, complete the following steps: 1. Open the Administrative Client Installation folder. This is in the File Access Manager distribution package. 1. Run `ClientInstaller_x64.msi`. 1. Select **Next** to open the Connection Properties window. - In the UI Server field, enter the FQDN of the server that hosts the User Interface service. - In the Service Port field, enter the relevant port (default port is 8005). 1. Select **Next** to open the Destination Folder window. - Enter the destination folder where you want to install the Administrative Client binaries. 1. Select **Next** to open the Ready to install File Access Manager Administrative Client window. 1. Select **Install** to start the installation process. 1. Once the installation completes, a confirmation message appears. 1. Check the **Launch File Access Manager Client** checkbox to open the Administrative Client. Note The first time you open the File Access Manager Administrative Client, a notification to confirm that the SSL certificate has been applied displays. 1. Select **Yes** if the certificate should be trusted. Note The File Access Manager Administrator Guide has additional information on changing the File Access Manager security certificate. 1. Select **Finish**. 1. When logging into the File Access Manager Administrative Client for the first time, use the following database user and the password entered for the administrative client: - **User**: `wbxadmin` 1. After you have logged in successfully, follow the instructions to change the admin password. Note The File Access Manager Administrator Guide has additional information on managing users. With File Access Manager now fully installed, you can now set up Identity Collectors, set up Data Enrichment Collector, add new applications, and more. To set these up: - Login into the Admin Client with `WBXAdmin` and add a user as the admin. - Create a Data Enrichment Connector (DEC). - Login into the website with `WBXAdmin` and create an Identity Collector associated with the DEC. ## Endpoint Support Information See the File Access Manager Connectors support document in Compass. Each connector has a separate installation guide with more information on supported versions and prerequisites. # Advanced Installation ## Disaster Recovery File Access Manager supports disaster recovery by building a parallel backup system as described below. This setup reduces downtime in case physical servers go down. The fail-over between systems is a combination of automatic and manual processes and procedures. For a full description of the disaster recovery procedure, see the Disaster Recovery Plan document or contact Professional Services. ## High Availability File Access Manager supports a high availability configuration. This solution involves configuring duplicate services on additional servers and having the customer deploy a load balancer to manage the service traffic. When a production service or entire server stops for any reason, the load balancer will route the traffic to another service on a different server. The services configuration is performed during the installation phase, as described in this guide. ## High Security Deployment If you require a higher security deployment, refer to Recommended Secured Deployment. ## Authentication Method The File Access Manager login process can use Active Directory, or be integrated with any identity provider (IdP) supporting SAML 2.0-based authentication. Detailed integration steps are available for the following providers: - Azure - Okta - ADFS # Preparing for Installation Before starting the installation, gather the required data, open the required ports, and set up the servers, as described. ## Communication Requirements File Access Manager is a service-oriented solution, and as such, enables the distribution of its services on multiple servers. The model is flexible, and services can be shifted between servers to boost performance. ## .NET File Access Manager requires the latest ASP.NET Core 8.0.x Hosting Bundle. This bundle consists of the .NET Runtime and ASP .NET Core Runtime. You can download the latest 8.0.x Hosting Bundle version from [here](https://dotnet.microsoft.com/en-us/download/dotnet/8.0). Caution Without completing this step, the installation will fail. All servers hosting File Access Manager services, including all Activity Monitors, must have .NET Core 8.0.x installed as a prerequisite for the installation. The administrative client computer and Business Website service server must contain .NET Framework 4.7.2. Note .NET Core and .NET Framework 4.7.2 can be installed on the same server. ### Verifying .NET Core Settings Complete the following steps to verify the version of .NET Core: 1. Open a CMD window. 1. Execute the following command: `dotnet --list-runtimes` The output should consist of at least these two: - Microsoft.AspNetCore.App 8.0.x - Microsoft.NETCore.App 8.0.x If the command did not execute or the two runtimes mentioned above are not in the output list, reinstall or repair the hosting bundle. ## Inter-service Communication File Access Manager uses SSL communications for all its deployed services. SSL communications use Server and Client Certificates which, by default, are self-signed and created when each service is installed. While the operating system may not trust these certificates, File Access Manager components do trust them. It is a best practice for all components to be in a safe, secure network, behind firewalls, even though SSL secured communication is enabled. The table below lists the relationships among the services and clients. | **Service** | **Clients** | **Default Port** | | --------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------- | | Agent Configuration Manager | Activity Monitor Event Manager Central Data Classification Central Permissions Collector Data Classification Collector Permissions Collector Collector Installation Manager | 8000 | | Event Manager | User Interface Central Data Classification Scheduled Task Handler Central Permissions Collection Web Server | 8001 | | Reporting Service | User Interface | 8008 | | User Interface | File Access Manager Administrative Client | 8005 | | Workflow | User Interface | 8008 | | Elasticsearch | Event Manager Reporting Service Scheduled Task Handler User Interface Web Server Activity Analytics | 9200 | | Elasticsearch | Elasticsearch | 9300 | | RabbitMQ | Central Permissions Collector Central Data Classification Permissions Collector Data Classification Collector Activity Monitor Event Manager | 5871 | | RabbitMQ | Schedule Task Handler | 15871 | | Activity Analytics | None | 8010 | ## Environment Variables In some instances, a configured environment requires a proxy server for all File Access Manager server-wide outbound connections. In this case, the use of two environment variables is an option. These specific variables need to be configured on the File Access Manager server(s) hosting the engine/collector/collector sync services that need to communicate with specific endpoints. ### Updating or Changing Environment Variables Both variables can be created and updated within a Windows Server System by navigating to **Properties > Advanced > Environment Variables**. **ALL_Proxy** - The proxy server used on HTTP and/or HTTPS requests in case **HTTP_PROXY** and/or **HTTPS_PROXY** are not defined. ```text Example: `10.10.10.10:8080` ``` **NO_PROXY** - A comma-separated list of host names that should be excluded from proxying. ```text Example: `SOME.DOMAIN.COM, LocalFAMServer1, LocalFAMServer2` ``` After creating these variables, the corresponding File Access Manager services must be restarted for the changes to take effect. Note File Access Manager services need to be able to read from the environment variables. Therefore, it is recommended to create them as System Variables. ## Ensuring HTTP/2 Support Services will only accept http/2 connections (version 8.4 uses gRPC as the communication protocol, the requires http2). Once fully installed, File Access Manager services should work seamlessly with http2. In some cases, some communication middleware components (such as load balancers, e.g.) may not be configured to support http/2, which may cause for communication failure and cause the installation to halt. As a pre-installation step, ensure all servers and communication middleware components are configured to support http/2. # RabbitMQ Ciphers The cipher algorithms used by RabbitMQ can be configured to meet customer requirements using the following steps: 1. Navigate to the server that is hosting the RabbitMQ service and stop the service. 1. Navigate to the RabbitMQ configuration location, generally located at `C:\Program Files\SailPoint\RabbitMQ\data\rabbitmq.config`. 1. With the desired cipher, update the current configuration to include the cipher section in the existing config file in both sections. **OR** 1. Use the following example script to replace the current config file after updating the cipher section with the desired ciphers. **Example Script:** ```text [{rabbitmq_management, [{listener, [{ssl_opts, [ {ciphers, [ "ECDHE-ECDSA-AES256-GCM-SHA384", "ECDHE-RSA-AES256-GCM-SHA384", ]}, {keyfile, "C:/Program Files/SailPoint/RabbitMQ/certificates/key.pem"}, {certfile, "C:/Program Files/SailPoint/RabbitMQ/certificates/rabbitmq.cer"}, {cacertfile, "C:/Program Files/SailPoint/RabbitMQ/certificates/ca.cer"}]}, {ssl,true}, {port,15671}]}]}, {ssl, [{versions, ['tlsv1.2', 'tlsv1.1', tlsv1]}]}, {rabbit, [ {tcp_listeners, []}, {log,[{file,[{level,error}]}]}, {ssl_options, [ {versions, ['tlsv1.2']}, {ciphers, [ "ECDHE-ECDSA-AES256-GCM-SHA384", "ECDHE-RSA-AES256-GCM-SHA384", ]}, {keyfile, "C:/Program Files/SailPoint/RabbitMQ/certificates/key.pem"}, {certfile, "C:/Program Files/SailPoint/RabbitMQ/certificates/rabbitmq.cer"}, {cacertfile, "C:/Program Files/SailPoint/RabbitMQ/certificates/ca.cer"}, {fail_if_no_peer_cert,false}, {verify,verify_peer}]}, {ssl_listeners,[5671]}]}]. ``` Note To find which ciphers are available, run a PowerShell command Get-TlsCipherSuite on the RabbitMQ machine. This will populate a list with a set of IANA names which can be used to search the site Ciphersuite Info to locate the OpenSSL name, which is what RabbitMQ configuration supports. 1. Restart the RabbitMQ service. Note If the configuration file is not properly updated, the service will fail to start. 1. Wait a few minutes and then login to the Admin Client. 1. Navigate to the Health Center > Infrastructure tab and verify RabbitMQ is green. # Recommended Secured Deployment File Access Manager uses self signed certificates, and SSL for internal communication. If you require a higher security configuration, follow these configuration guidelines: - Required Environment - Installation Considerations and Constraints - Post Installation Configuration - Configuring the Process Exploit Mitigation for File Access Manager Services - Enabling New Version Notifications ## Required Environment **Windows Operating System Version** - File Access Manager must be installed on a Windows Server 2019 Datacenter edition, version 1809. **File Access Manager Version** - For a secured deployment, use File Access Manager version 8.1.0.1 or higher. ## Installation Considerations and Constraints File Access Manager should be installed in the default directories (e.g., `C:\Program Files\SailPoint`). These include: - Server Installer - All Services (Core and Collectors) - Administrative Client The File Access Manager database should be created on an SQL Server that is set up with a certificate and enforces encryption. ## Post Installation Configuration Complete the following steps to configure File Access Manager securely: 1. Replace all self-signed certificates with trusted certificates that you must provide. See the section Configuring File Access Manager to Use Local Certificates within the Certifications and SSL Installation Guide. 1. Set up recommended Process Exploit Mitigation for File Access Manager services (Windows Defender settings). Refer to Configuring the Process Exploit Mitigation for File Access Manager Services. 1. Change IIS settings (on which web components are installed) to require SSL. Refer to the File Access Manager Website SSL section within the Certifications and SSL Installation Guide. 1. Set all Active Directory connections to use LDAPS (for Identity Collectors and Data Enrichment Connectors). 1. Enable the File Access Manager New Version Notifications feature. See the Enabling New Version Notifications section. 1. For all these changes to take effect, restart all services or restart the server. ## Configuring the Process Exploit Mitigation for File Access Manager Services Part of the higher security settings involve configuring the Process Exploit Mitigation settings in Windows Defender for the File Access Manager Services, with the following settings enabled: | **Component** | **Setting** | **Location** | | --------------------------------------------- | --------------------------------------------------- | ---------------- | | Control Flow Guard (CFG) | on (default) | System setting | | DEP | on (default) | System setting | | Randomize memory allocations (Bottom-Up ASLR) | on (default) | System setting | | Export Address Filtering (EAF) | on (This requires manual configuration per service) | Program settings | | Import Address Filtering (IAF) | on (This requires manual configuration per service) | Program settings | The system settings should be kept in the default values. Please verify that these settings above are in fact set in the Windows Exploit Protection Settings under the system tab. The program settings can be updated using a script which is part of the File Access Manager deployment package, or manually in the Process Exploit Mitigation tool. Both methods are described below. ### Configuring the Program Settings Using FAM.Exploit.protection.Settings.xml Script You can enable the recommended security settings for File Access Manager using the **FAM.Exploit.protection.Settings.xml** file from the installation folder. To apply the settings, run the following command in an elevated PowerShell window: `Set-ProcessMitigation -PolicyFilePath "Full path to FAM.Exploit.protection.Settings.xml"` This script updates the File Access Manager and configures permissions per service. For these settings to take effect, the services need to be restarted. ### Configuring the Program Settings Using the Windows Defender Settings Tool If you can't run the script described above, or prefer to manually configure the settings, you can use the Windows Defender Settings tool as follows: 1. On the Windows server, open the Windows Defender Settings. 1. Select **App & Browser Control**. 1. Select **Exploit Protection Settings**. 1. Go to the Program Settings tab. 1. For each of the File Access Manager services: 1. Select **+ Add program to customize** to open the parameters panel. 1. Set EAF (Enhanced Anti-Exploit) and IAF (Important Anti-Exploit) to On. 1. Select **Apply** to save the changes. 1. Restart all the modified services, or reboot the server. ## Enabling New Version Notifications SailPoint publishes updates to the File Access Manager periodically, which may include new releases, minor releases, and software patches. When updates are available, the application can send an email to the File Access Manager administrator to notify about the update. This feature is disabled by default. To enable this feature: 1. Update the database with the email address to which the notification email will be sent. Run the following SQL update statement: `update [whiteops].[system_configuration_value] set [value] = N'[ENTER DESIRED eMAIL HERE]' where [name] = N'New Version Message To'` 1. On the Scheduled Task Handler service server, edit the file: ```text %SAILPOINT_HOME%\FileAccessManager\ScheduledTaskHandler\ScheduledTaskHandlerServiceHost.exe.config ``` 1. In the appSettings section, change the **newVersionCheckIntervalInMinutes** from **-1** (which means no check for new versions) to the desired check interval in minutes. 1. Save the file and close it. 1. Restart the Scheduled Task Handler service. After the service restart, an email will be sent to the specified address whenever a newer version is available to download from Compass. ## Removing Unnecessary Banner Information on Web Responses Microsoft’s Internet Information Server (IIS) includes a header with every response that includes the originating server and webserver version. To remove this information, you should configure the IIS to remove the 'Server' header. The method depends on the installed IIS version, as described below: - **For IIS before version 10** - In Windows IIS Manager, you can use the URL Rewrite module to create a rule to rewrite all outgoing messages, replacing the server value in the header with an empty string. A detailed description can be found on MS IIS Support blog below, in the third method "3. Using URLReqrite": - **For IIS version above 10** - Update the SiqWeb web.cofig file `C:\inetpub\wwwroot\siqApi\web.config`. ```text ``` # Troubleshooting Check the issues below for common problems and suggested ways of handling them. ## Users Cannot Log into the Website After First Installation When installing File Access Manager for the first time, the Identity Sync task has to complete its operation in order to get a list of users who can log into the web application. You can follow the progress of this task on the Health Center in the administrative client. The task status is generally displayed in the web application which you cannot access before this task has completed. ## 3rd Party SSO Login Users Cannot Access the Website If 3rd party SSO login users cannot access the website, follow these steps to troubleshoot the issue: 1. Verify that the correct connectivity values were stored in the database. - Table: `system_configuration_value` - Record: `WebSamlConfiguration` 1. The JSON should be similar to the sample below, depending on the SSO provider: - EntityId - The File Access Manager application created in the SSO provider - MetadataUrl - Generated in the process of creating the application above ```text { "EntityId": "FAM_SAML_LogIn", "MetadataUrl": "https://dev-39214733.okta.com/app/exka5w2f1LvL5gpI05d6/sso/saml/metadata", "SignatureAlgorithm": "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256", "CertificateValidationMode": "0", "RevocationMode": "0" } ``` 1. Verify that all the users from the SSO provider were added correctly to the File Access Manager database. The identity collector should upload the users listed in the data source into the following tables: - whiteops.ra_user - crowdSource.[user] ## Connection Errors Following a successful upgrade to version 8.4, services will only accept http2 connections (version 8.4 uses gRPC as the communication protocol, the requires http2). Once fully upgraded, File Access Manager services should work seamlessly with http2. In instances where the customer upgrade halts after a successful Agent Configuration upgrade, one potential cause could be that the communication middleware (such as a load balancer) is not configured to work with http2. The following error will be shown in the log of services trying to connect to the Agent Configuration manager: ```text Unable to connect to test.domain.com with user_name Grpc.Core.RpcException: Status(StatusCode=Internal, Detail="Bad gRPC response. Response protocol downgraded to HTTP/1.0.")at Grpc.Net.Client.Internal.HttpClientCallInvoker.BlockingUnaryCall[TRequest,TResponse](Method`2 method, String host, CallOptions options, TRequest request)at Grpc.Core.Interceptors.InterceptingCallInvoker.b__3_0[TRequest,TResponse](TRequest req, ClientInterceptorContext`2 ctx)at Grpc.Core.ClientBase.ClientBaseConfiguration.ClientBaseConfigurationInterceptor.BlockingUnaryCall[TRequest,TResponse](TRequest request, ClientInterceptorContext`2 context, BlockingUnaryCallContinuation`2 continuation)at Grpc.Core.Interceptors.InterceptingCallInvoker.BlockingUnaryCall[TRequest,TResponse](Method`2 method, String host, CallOptions options, TRequest request) ``` If such errors appear in the log files, make sure all communication middleware components are configured to work over http/2, and the connection is not downgraded to http/1. In case the error appears in a service that is still in version 8.1, the errors may be safely ignored. Once the service is fully upgraded the errors will stop showing in the log. ## Firewall Verification If an installation problem occurs when installing File Access Manager on multiple servers, verify the firewall is not blocking the installation process. ## Access Denied to Business Website If access is denied to the File Access Manager business website, it may be caused by not having proper configuration in IIS. .NET Trust Level in IIS needs to be set to Full to allow for consistent access. Use the IIS Manager to set the .NET Trust Level to Full. This can be found by navigating to Default Web Site > .NET Trust Levels. Select Full (internal) from the dropdown. Select Apply. ## Failed Installation of IIS If File Access Manager did not install the IIS, verify the Request Filtering is turned off. If Request Filtering is on, the File Access Manager business website may fail to load. ## Communication Issues Between Collectors or Activity Monitors and the Agent Configuration Manager The Agent Configuration Manager and the Collectors or Activity Monitors might have trouble communicating with each other. This would result in no activities being collected or failed Crawl / Permission Collection / Data Classification tasks. This could be caused by a registry value interfering with the SSL handshake that usually occurs between those services. This would introduce an extra criterion for the certificate to comply with that isn’t normally part of the procedure, preventing the service from properly identifying itself. This registry value is called SendTrustedIssuerList and it’s located under the following path: `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL`. If this registry value exists and is set to 1 (true), set it to 0 (false). If it doesn’t exist or is set to 0 (false), then this is not the cause of the issue. More information about this registry value can be found here: ## Further Information For further configuration, and installation of the File Access Manager website, see chapter File Access Manager Initial Configuration in the File Access Manager Administrator Guide. # Unattended Installation The installation configuration process stores the configuration in the database and creates a file with the commands for installation of the services on the required servers. These commands can be configured to fit the installation on multiple servers using a distribution tool. **Script Overview** - File Name: `Installation_Command.txt` - File Path: `C:\Program Files\SailPoint\FileAccessManager\Server Installer\Server` ## Installation Command Script The installation command file contains three commands: 1. Install the server installer 1. Install the services required for the current server 1. Return the last error code ### Install the Server Installer This is an MSI installation file that installs the server installer on this server. **Command** - `start /wait msiexec /i "[INSTALLER_PATH]\ServerInstaller.msi" /l*v "C:\FAMInstaller.log" /quiet /norestart TARGETDIR="[TARGETDIR]"` **Parameters** - - INSTALLER_PATH: The path of the msi file - TARGETDIR:Target directory of the application. E.g. : c:\\Program Files\\SailPoint\\ ### Run the Unattended Installer with Database Connection Parameters The script is created without the password. You will have to add it in to the command when you copy it across. **Command** - `start /wait /d "[TARGETDIR]\FileAccessManager\Server Installer\Server" UnattendedInstaller.exe --server "database server name" --database "Database name" --port "1433" --user "database user" --password "[PASSWORD]"` **Parameters** - - TARGETDIR: This should be identical to the targetdir of the previous command - server: Database server name - port: Database server port number - database: Database name - user: Database user name - password: Database password ### Return the last resulting error code 0 – successful installation For further details, check the installation log in `C:\Program Files\SailPoint\FileAccessManager\Server Installer\Server\Logs`. Note File Access Manager identifies which installation tasks are meant for this server, according to the configuration. **Error Codes:** | **Code** | **Description** | | -------- | ------------------------------------------------------------------------------------------------------------ | | 0 | Success | | 1 | Unknown error | | 2 | Unable to perform prerequisites | | 3 | Error in verifying the installation | | 4 | Some services failed to install | | 5 | There is a pending reboot on this machine. Please reboot and re-run the File Access Manager Server Installer | | 6 | Bad arguments were passed to executable | | 7 | Database version not compatible with server installer version | | 8 | Database connection failed | | 9 | Server address resolution failed | # File Access Manager Installation The File Access Manager installation consists of the following phases: - File Access Manager [Server Installer](https://documentation.sailpoint.com/fam/help/installation/fam_install/server_install.html) installation - [Database creation](https://documentation.sailpoint.com/fam/help/installation/fam_install/db_using_installer.html) - [Configuration creation](https://documentation.sailpoint.com/fam/help/installation/fam_install/create_config.html) - Service installation on each File Access Manager Server Note The installation process is logged to the installation logs. Any errors in the installation process or for any references to the logs in error messages, refer to the logs in this folder (according to the installation directory): `C:\Program Files\SailPoint\FileAccessManager\Server Installer\Server\Logs`. # Creating the Configuration The Create / Edit Installation Configuration will be the only option available if this is the first time running the Server Installer. After the first configuration is set, the rest of the options will be available for editing the configuration or uninstalling services. The configuration steps are: 1. Adding and defining the servers as **Production** (default) or **Disaster Recovery**. 1. Assigning File Access Manager services to **Production** and **Disaster Recovery** servers. 1. Storing the installation configuration and installation commands file. 1. Installing in one of two methods: - On the current server using the installation GUI. - Using the pre-configured command file. ## Adding a Server To create the configuration for a new server: 1. In the General Configuration window, define all the servers on which the File Access Manager services will be installed and whether the installed server is a **Production** (Prod) or **Disaster Recovery** (DR) server. These servers should include DR servers and High Availability duplicate servers, if required. This does not include the Windows file server activity monitors; they are added automatically during the installation process and are not displayed. For each server: - In the **Server FQDN** field, enter the server’s Fully Qualified Domain Name (FQDN). - In the **Server Local Name** field, enter the server’s short name (NetBIOS host name). - In the **Installation Path** field, enter the installation path. This becomes the **SAILPOINT_HOME** environment variable on the installation server. This is the path in which the File Access Manager services will be installed. - In the **Logs Path** field, enter the logs path. This becomes the `SAILPOINT_HOME_LOGS` environment variable on the installation server. This is the central folder in which all File Access Manager logs will be written. - If this server is designated as a disaster recovery server, select the **Disaster Recovery** checkbox. For more information about Disaster Recovery servers, read the File Access Manager Disaster Recovery guide. 1. Select **Add**. The server configuration that you specified copies to the Server List. Note File Access Manager services use SSL communication. Within the Server List, a user can edit an existing server. Only the Server FQDN and the Server Local Name are editable. 1. Select **Next**. # Creating a Database Using the Installer To create the database, perform the following steps: 1. Start the installer by opening the SailPoint\\Server Installer shortcut. Note Run in Administrator mode. 1. Select **Next**. 1. When you have read and accepted the End User License Agreement, select the **I have read and accepted the agreement** option and select **Next**. 1. If you are installing File Access Manager for the first time: 1. Select **Create a New File Access Manager Database**. 1. Enter the following information: - **Server\\Instance Path** – typically a server - **Database Name** – default is `FAMBD` - **Port Number** – default is `1433`. When using a dynamic port, input `0` - **Database User Name** – default is `FAM_User` - Enter the **Database User Password** twice in the appropriate fields. - **Import Assemblies Certificate checkbox** - Check this option if the CLR Strict Security Mode is enabled in the database. Using this option will import a certificate into the Master database. This option is relevant only for SQL Server 2017 and above. - Enter the database files path. This folder must exist on the database server. - Enter the file stream files path. - Enter the log files path. This folder must already exist on the database server. - Select the **Authentication Type** from the SQL Server or Windows options. This is the authentication used to log in to the database for the creation of the File Access Manager database. - For **SQL**, type in the SA User Field and password for the system administrator. - For **Windows**, the Server Installer will use the logged-in user to connect to the database. - Enter a **password** (only for the WBXadmin user) for the administrative client user and repeat the password. The password needs to meet the following parameters: - Minimum Length: 12 characters - At least one uppercase and lowercase letter - At least 1 special character 1. If you are installing additional services to an existing File Access Manager installation, select **Use an existing File Access Manager Database**. - Enter the **Server\\Instance Path**. - The **Database Name**, **Port**, and **Database User Name** fields are automatically populated. - Enter the **Database User Password**. 1. Select **Next**. 1. Select **Create / Edit Installation Configuration** and select **Next**. # Performing the Installation You can install using either the Server Installer or Unattended Installation, mostly for installing a system with many servers. ## Installation Using the Server Installer Some notes to consider when installing: - The installation process runs service installers in groups. - When a service starts the installation process, it is listed on the installation window. - When a service is installed correctly, the application adds a checkmark next to the service name, with the comment **Action succeeded**. - If an installation of a service fails, the application adds a warning symbol on the installation line. Check the log file for further details and analysis. Note The installation process at this point can take several minutes. 1. Open the Server Installer if it is not already open. 1. If you changed the configuration with the Server Installer, select **Save Configuration and Perform current Server’s Installation Tasks** to start the installation. 1. If you are using an existing configuration, select **Perform Current Server’s Installation Tasks** to start the configured installation tasks for this server. 1. When the progress bar shows “Finished”, select **Next**. 1. Check the **Open Installation Log** checkbox and click **Finish**. 1. Verify that no errors occurred during the install progress by searching the log for the word **ERROR** (note the capital letters). # Server Installer The Server Installer manages the configuration of the File Access Manager central servers and the installation process. Note After the configuration, the installation process will need to be run for every core server. After downloading the appropriate version of File Access Manager from Compass, navigate to your downloads folder within File Explorer to locate the **Server Installer**. 1. Run the `ServerInstaller.msi` file. The “Welcome to File Access Manager Server Installer Setup Wizard” window displays. 1. Select **Next**. 1. Select the destination folder and select **Next**. 1. Select **Install** to start the installation, or click **Back** to change the installation folder. 1. After the installation processes are complete, the “Completed the File Access Manager Server Installer Setup Wizard” window displays. 1. Verify the **Launch the File Access Manager server installer** checkbox is selected. This launches the Install Wizard of the Server Services. Note If the Server Installer does not automatically launch, this is due to UAC. Please navigate to the directory you installed to, usually `Program_Files\SailPoint\FileAccessManager`. Select **OK** on the UAC prompt and now the shortcuts and auto-launch will work. 1. Select **Finish**. The File Access Manager Installation window displays. 1. Select **Next**. # Service Configuration There are two Service Configuration screens: one for the production environment and one for the disaster recovery environment. Important The services distribution should be planned before installation. SailPoint installation experts are available to discuss these options with you. For each environment, this screen is used for associating services with the relevant servers defined in the Services Configuration window. To configure services, complete the following steps: 1. In the Action Select window, select the **Create / Edit configuration installation** option. 1. Select **Next** to display the Service Configuration window.\ Use the scroll bar to see all the configuration input fields. 1. Select the server to use in the production environment for each service. The dropdown list of available servers only includes production servers. Note When allocating services to servers, make sure any servers dedicated to high availability are not used for the first instance of any services. **Service Ports** - Enter the relevant port information. Make sure to adjust firewall rules, if required. **Agent Configuration Manager** - The Agent Configuration Manager service is a prerequisite for installing all other services. Therefore, the server configured for the Agent Configuration Manager must be installed first. **RabbitMQ** - File Access Manager uses an open-source message broker, RabbitMQ, to distribute operations across multiple services. The File Access Manager Administrator Guide has more information on horizontal scaling in this service. The connection between the message broker and File Access Manager services is secured with SSL. An account is required to handle internal processes between the message broker and File Access Manager server. Credentials can be created automatically or inserted manually. Important When installed in a High-availability environment, RabbitMQ is used to synchronize data between IIS servers, ensuring all users see up-to-date data on the website. If your installation uses more than one IIS, make sure to install RabbitMQ. Note When installing RabbitMQ, the user completing the installation must have a valid **%homepath%** variable. During the installation, the **erlang.cookie** will be copied over using this variable, which could cause the installation to fail if not set. Note RabbitMQ is mandatory for version 8.5 and onward. **Event Manager** - The Event Manager Service can be duplicated and installed on multiple servers. **Central Data Classification** - File Access Manager allows multiple instances of installed Central Data Classification services. The Architecture section of the File Access Manager Administrator Guide has additional information on installation planning. - Click the **+** next to the port to add instances. - Click the **x** to remove instances. **Central Permissions Collection** - File Access Manager allows multiple instances of installed Central Permissions Collection services. The Architecture section of the File Access Manager Administrator Guide has additional information on installation planning. Provide a unique name for each service. This name will be displayed during the application configuration wizard when defining a new application in the File Access Manager Administrative Client. File Access Manager supports installing a non-dedicated Permissions Collector service to handle multiple applications on the same service. You can also install a dedicated Permissions Collector service for an application. The Collector Installation Guide has additional information. Note Requires a distinguished name. Caution Removing a **Central Permission Collector** may orphan associated collectors. Any orphaned collectors should be uninstalled through the **Collector Installation Manager**. **Business Website** - The Business Website installs IIS if it is not yet installed. ## Configuring High Availability Services Perform the following: 1. Add an additional instance of the service by clicking the **+** icon next to the service on the configuration panel. 1. Configure the installer to install the service on a parallel server allocated for high availability. 1. Configure your load balancer to select between these instances. Important The load balancer should be configured for SSL passthrough. It should not terminate the client TLS connection and create a new one between the load balancer and the server. This will cause an authentication error since each client has its own client certificate. | **Service** | **Listening port** | | --------------------------- | ------------------ | | Agent Configuration Manager | 8000 | | Business Website | 80 / 443 | | Event Manager | 8001 | | User Interface | 8005 | Important Event Managers use RabbitMQ as the Load Balancer as of 8.5. ## Elasticsearch Configuration After the Service Configuration screen, select **Next** to open the Elasticsearch Configuration screen. In the **Cluster Node Settings**, configure the desired number of nodes that will comprise the Elasticsearch cluster. Assign each node to a dedicated server and specify the path for the Elasticsearch database folder. Note At least three nodes are recommended. The Credentials Settings section is used to specify a username and password. If left unchecked, a default username and password will be used. Select **Next** to open the Disaster Recovery Service Configuration screen. Repeat the service configuration for the Disaster Recovery environment. The list of servers on this screen will be servers defined previously as Disaster Recovery servers. Select **Next** to open the Elasticsearch Disaster Recovery Configuration screen. Repeat the Elasticsearch configuration for the Disaster Recovery environment. The list of servers on this screen will be servers defined previously as Disaster Recovery servers. Note The Disaster Recovery Service Configuration screen and Elasticsearch Disaster Recovery Configuration screen will only display if there is at least one Disaster Recovery server defined. Note For the Backup Settings section, configure the Elasticsearch backup repository path and settings as explained in the Activity Backup guide. After the Elasticsearch Configuration screen, select **Next** to open the Load Balancer Configuration screen. Note This screen will only be displayed if there is at least one service with multiple instances. ## Load Balancer Configuration The **Load Balancer Configuration** screen lists all the services that support high availability. Services that have not been defined with multiple instances in the previous stage will be grayed out. - **Server Address**: The server address of the high availability server allocated for this service. - **Port**: The port should be unique. Note The **Load Balancer** ports can be different from the ones described in **Inter-service Communication**. ## Website Configuration After configuring the services, the Web Configuration screen will display. ## IIS Settings These settings allow for a non-default IIS installation. - Change the site name and physical path. File Access Manager will install its websites on the specified location. Note Both site name and directory path must be changed for a non-default installation. ## Website Authentication Mode Now you can decide from the following options the type of authentication mode. - **Windows**: Using an Active Directory identity store. - **SAML 2.0**: - Refer to the SAML and SSO Installation Guide for more information. - Using a 3rd party authentication store, such as Okta, ADFS, or Azure. Selecting **SAML 2.0** on the\*Website Authentication Mode opens the SSO provider identification fields: - **Entity ID**: The application name of the relevant SSO provider. - **Metadata URL**: The URL to the relevant SSO provider. These fields are defined when creating an application in the relevant SSO provider. If you haven’t created them yet, see the relevant section within the SAML and SSO Installation Guide: - Creating an **ADFS Application** - Creating an **Azure Application** - Creating an **Okta Application** Alternatively, you can continue with the installation without creating an authentication store. ## Configuration Summary 1. Select the **Save Configuration Only** option. 1. Select **Next**. ### Storing the Configuration The installation process using the server installer creates a text file containing the commands for installation of the services on any server defined in the configuration. The configuration itself is stored in the database. Depending on the method of installation, select the next action (see [Performing the Installation](https://documentation.sailpoint.com/fam/help/installation/fam_install/perform_install.html)). - Select **Save Configuration Only** to save the configuration without installing on this server. - Select **Save Configuration and Perform current Server’s Installation Tasks** to start the installation of the services on the current server. Select **Next** to install the services on the current server. If the services installed require a system restart, the installer will open a popup message requesting a restart. After the restart, run the installer again to continue the installation process. # Service Migration This section relates to moving installed services from their original server and installing them on another server. Services must be uninstalled prior to migrating them to a different server. To migrate services, follow the instructions for each service on the server where the service to be migrated is installed. Important You cannot use the Installation Wizard to move the Elasticsearch database from one server to another. For help with moving the Elasticsearch database, contact the File Access Manager Support Center. ## Source Server – Database Connection To connect to an existing database: 1. Start the installer in `C:\Program Files\SailPoint\FileAccessManager\Server Installer\Server\ServerInstaller`. Note Run in Administrator mode. 1. Select **Next**. The End User License Agreement (EULA) window displays. 1. When you have read and accepted the End User License Agreement, select the **I have read and accepted the agreement** option and select **Next**. 1. The Database Details window displays with the database connection details and the Database User Password filled out. 1. In the Database User Password field, enter the database user password. 1. Select **Next**. ## Source Server – Configuration Modification Note A service migration requires configuring another server to migrate to. To modify the configuration: 1. In the Action Select window, select the **Create/Edit installation configuration** option. 1. Select **Next**. The General Configuration window displays. 1. Add new servers if necessary, as described in the section Adding a Server. 1. The General Configuration window displays. 1. Select **Next**. 1. Change the server of each of the services to be migrated as described in Service Configuration. 1. The Service Configuration window displays. 1. Select **Next** to open the Configuration Summary window. ## Source Server – Configuration Summary 1. Select the **Save Configuration and Perform current Server’s Installation Tasks** option. 1. Select **Next** to uninstall the services to begin migration from the current server. ## Source Server – Uninstallation Process The uninstallation process uninstalls services on this server in groups. - When a service starts the uninstall process, it is listed on the uninstall window. - When a service is uninstalled, the application adds a checkmark next to the service name and a comment "Action succeeded." - When the progress bar shows **Finished**, select **Next**. - Check the **Open Installation Log** checkbox and select **Finish**. - Verify that no errors occurred during the uninstall progress by searching the log for the word "ERROR" (note the capital letters). ## Target Server – Database Connection 1. Connect to the database on the server that will host the migrating service(s) and run the Server Installer. 1. Follow the instructions in Source Server – Database Connection. 1. Select **Next**. ## Target Server – Install Migrating Service(s) To modify the configuration, perform the following steps: 1. In the Action Select window, select the Perform current server’s installation tasks configuration option. 1. Select **Next**. The Configuration Summary window displays, listing the services to be installed. 1. Proceed with the installation by following the instructions at Preparing for Installation. # Uninstalling File Access Manager Note You will uninstall the services when migrating the services to another server. Contact your Product Services support contact for assistance when uninstalling services. | **Feature to Uninstall / Remove** | **Uninstall Method** | | -------------------------------------------------------------- | ----------------------------------------- | | **File Access Manager Administrative Client** | Windows Programs and Features | | Collectors (Permission, Data Classification, Activity Monitor) | SailPoint Collector Installation Manager. | | Elasticsearch | SailPoint script and manual steps | | Java | Windows Programs and Features | | Other File Access Manager Services (including the website) | SailPoint Server Installer | | Folders of application and data created by the installation | File Explorer | | Registry keys created by the installation | Regedit (or similar) | # Cleanup After Uninstalling File Access Manager 1. Delete the SailPoint folder at `%SAILPOINT_HOME%`. By default, this is located at `C:\Program Files\SailPoint` Note If the SailPoint environment variable was removed by the uninstall process, go directly to the installation folder. 1. Delete the Registry Keys created by the File Access Manager installation. - Run RegEdit (or your preferred registry management software). - Delete the `HKEY_LOCAL_MACHINE > Software > whiteboxsecurity` folder. 1. Remove the SailPoint environment variables. - SAILPOINT_HOME - SAILPOINT_HOME_LOGS - SAILPOINT_APP_NAME Note In some configurations, these environment variables are removed by the uninstall process. # Uninstalling the File Access Manager Administrative Client To completely remove the Administrative Client: 1. If the Administrative Client is running, close it. 1. Open the **Programs and Features** window: 1. Go to **Control Panel > Programs > Programs and Features** 1. Right-click **File Access Manager Client** and choose **Uninstall**. 1. Delete the folder `%SECURITYIQ_HOME%\Client`. This is the folder where the Administrative Client was installed. 1. Delete the environment variables: - `SECURITYIQ_HOME` - `SECURITYIQ_HOME_LOGS` # Uninstalling the Collectors The collectors are services that gather information from the connected applications, which is then analyzed by the File Access Manager. The collectors include the following: ```text - Permission Collector - Data Classification Collector - Activity Monitor Collector ``` 1. Open the **Collector Installation Manager**. 1. Click **Uninstall** for each of the collectors. The collectors can be uninstalled in any order. 1. When the last collector has been uninstalled, if no other File Access Manager services are running, the **Connector Installation Manager** will uninstall the **Watchdog service**. **Remove Folders** - Delete the folder `Collectors`. This is the installation folder that you created when downloading the Collector Installation Manager from the SailPoint source. **Remove Registry Keys** - Using a Windows registry editor, remove the folder `HKEY_LOCAL_MACHINE > Software > whiteboxsecurity > WhiteOPS > Components`. If this server has no other services installed, you can remove the entire `whiteboxsecurity` folder. # Uninstalling the File Access Manager Services To uninstall the File Access Manager services: - Uninstall all the remaining services - Cleanup the remaining folders and registry keys ## Server Stop/Start Process File Access Manager servers need to be shut down and restarted in a specific order to ensure proper connectivity between services after the restart. ### Shutdown Process These services may be running individually on their own dedicated File Access Manager servers or may be on servers with shared services. These services or servers must be shut down in the following order: Note Disregard services that are not found in your environment, and proceed to the next service in the order shown here. 1. Activity Monitors 1. Permission Collectors and Data Classification Collectors 1. Central Permission Collection and Central Data Classification 1. RabbitMQ 1. Event Manager and IIS 1. Core and UI Services 1. Elasticsearch 1. Agent Configuration Manager (ACM) 1. Scheduled Task Handler 1. Microsoft SQL Server Database ### Startup Process Services or servers that were shut down in the order shown above must be restarted in this order: Note Disregard services that are not found in your environment, and proceed to the next service in the order shown here. 1. Microsoft SQL Server Database 1. Scheduled Task Handler 1. Agent Configuration Manager (ACM) 1. Elasticsearch 1. Core and UI Services 1. Event Manager and IIS 1. RabbitMQ 1. Central Permission Collection and Central Data Classification 1. Permission Collectors and Data Classification Collectors 1. Activity Monitors ### Validation Steps Follow these steps after restarting the services/servers to ensure that your environment is active and running normally: 1. Open the File Access Manager Administrative Client and click on the **Health Center**. The Health Center should show **GREEN** on all the tabs. 1. Refer to the appropriate application logs to ensure that the services were started without any errors. 1. If the logs show any errors related to connectivity, restart that service through the services.msc window. 1. If you still have difficulty in bringing any services up, contact SailPoint for further assistance. ## Uninstalling Elasticsearch Elasticsearch could be installed either on a dedicated server or on the main File Access Manager server. You must use the Installation Wizard if you want to move the Elasticsearch database from one server to another. If the Elasticsearch database must be moved after installation, contact the File Access Manager Support Center. 1. Open an elevated command line in Windows and run the following commands. After running the commands, close the cmd window: - `"%SAILPOINT_HOME%\elasticsearch-5.1.1\bin\elasticsearch-service.bat" remove` - `setx JAVA_HOME "" -m` Note There is no need to stop the Elasticsearch service before removing it. Note In some instances, the service will still be listed in the WIndows services even though it has actually been removed. A refresh, waiting a few minutes, or a reboot (in extreme cases) will update the services list. We can trust that it has indeed been deleted. 1. From windows Programs and Features, uninstall the Java 8. This program was installed by the installer to support the Elasticsearch. 1. Delete the folder "%SAILPOINT_HOME%\\elasticsearch-5.1.1". This folder stores the Elasticsearch program and configuration files, but not the actual stored data. 1. Execute the following update in the DB, to mark that the Elasticsearch database is uninstalled: ```text declare @server_name nvarchar(100) = N'ELASTICSEARCH SERVER FQDN' delete FROM [whiteops].[installed_service] WHERE install_service_id = 20 and server_id = (select id from [whiteops].[install_server] where name = @server_name) ``` **ELASTICSEARCH SERVER FQDN** - This value must be replaced with the FQDN of the server from which we we wish to uninstall the Elasticsearch. 1. Delete the Elasticsearch data folder. Deleting this folder will delete all the activities it stores, so make sure you want to delete it. If you wish to reinstall Elasticsearch at a later time and use these data, do not delete this folder. 1. If this instance of the Elasticsearch is on a dedicated server - Uninstall the Watchdog service from this server - Open the Server Installer. - Select **Next** till the Action Select page. - Select **Uninstall File Access Manager Features from the current server**. Important This procedure removes all services from this server, including the Server Installer itself. This opens the configuration summary page. In this case, the list of services will be empty. This is normal, since no services besides the watchdog are to be uninstalled. 1. Select **Next** to start the uninstall process. To reinstall Elasticsearch: 1. Install Elasticsearch using the Server Installer. 1. Restart the Event Manager services. Note If you do not delete the Elasticsearch data folder (described below), reinstaling the Elasticsearch will maintain all the data in the website as it was before Uninstalling. ## Uninstall All the Remaining Services This procedure removes all services from the server, including the File Access Manager website and the Server Installer itself. 1. Open the **Server Installer**. 1. Proceed to the **Action Select** page. 1. Select **Uninstall File Access Manager Features** from the current server. 1. Select **Next** to start the uninstall process. Important The File Access Manager Agent Configuration Manager service must be the last service to be removed. It should be removed after the collectors are uninstalled. If collectors or other services are still installed, the Server Installer will display an error message indicating that the services must be removed first. # Configuring File Access Manager to Use Local Certificates File Access Manager uses a self-signed certificate for each of the services. You can configure the system to use your own trusted certificates, using the procedure described in this chapter. To be trusted, server certificates must conform to the following guidelines: - Certificates are signed by a Certificate Authority (CA), trusted by all servers in the organization, whether the CA is commercial or in-house. - Certificates are issued to each server hosting one of the WCF hosting services (as described below). - Certificates' common name should be the Fully Qualified Domain Name (FQDN) of the server. - Certificate Subject Alternative Name (DNS) should be the short name (NetBios) of the server. - The certificate must have the following extensions defined: - **Key Usage**: Digital Signature, Key Encipherment. - **Enhanced Key Usage**: Server Authentication, Client Authentication. The certificate may have other key usages, but it must have at least those mentioned above. # Changing the Certificates for Collectors Changing the certificates of the collectors (Activity Monitor, Permission Collector, Data Classification) using the Collector Installation Manager replaces the SailPoint self-signed certificates with your appointed certificate and deletes the corresponding SailPoint certificate from the certificate store. To replace the certificates for collectors using the Collector Installation Manager, complete the following: 1. Run the Collector Installation Manager. 1. This will open a list of the collectors. You can update separate certificates per collector or use the same certificate for all. 1. Select **Set Certificate for all Services**. 1. If this server does not have a server installer, you will have to update the watchdog certificate manually. Refer to [Installing Collectors on a Server Without Core Services](#). 1. Select your certificate from the dropdown list to update the certificate list. 1. Restart all the services or simply reboot the server. ## Installing Collectors on a Server Without Core Services If you are installing collectors on a server without installing the server installer, the Collector Installation Manager will not replace the watchdog certificate. This must be done manually, as described below. 1. Verify that you have to perform this step: - Check the certificate store (local computer store) after running the Collector Installation Manager. - If there is a certificate called "File Access Manager WatchDog [servername]," the watchdog certificate has not been replaced. 1. Copy the thumbprint of your trusted certificate. 1. Find the certificate you want to use in the certificate store (local computer store). 1. Right-click the certificate to view the details and copy the thumbprint value. 1. Update the thumbprint value in the watchdog configuration file: 1. Locate the Watchdog configuration file at: ```text %SAILPOINT_HOME%\%SAILPOINT_APP_NAME%\WBXWatchDogServiceHost.exe.config ``` 1. Open the configuration file with a text editor, and search for `clientCertificateThumbprint`. 1. Replace the value with the copied thumbprint from your trusted certificate. 1. Save the file. 1. Restart the watchdog service. 1. Delete the SailPoint watchdog service certificate from the computer's personal certificate store. # Changing the Certificates for Core Services This process will replace the certificate for all services except for Elasticsearch and RabbitMQ with your selected certificate. All the SailPoint-supplied certificates will be removed. To replace the certificates with your own, complete the following steps: 1. Open an elevated command line. 1. Run the following command: `"%SAILPOINT_HOME%\FileAccessManager\Server Installer\Tools\FAMCertificateManager\FAMCertificateManager.exe" -a -existingCertificate` 1. Select your certificate from the dropdown list. 1. Restart the services, or reboot the server. Note You can change the certificate for a single service, using the SailPoint tool FAMCertificateManager.exe, using the installed_service.id of that service. Example: FAMCertificateManager.exe -1 -existingCertificate # Changing Certificates for Elasticsearch The Elasticsearch nodes in File Access Manager all use the same certificate for identification when communicating with other nodes or File Access Manager services. This certificate is also used to encrypt communication between the nodes. The Elasticsearch certificate is stored in a PKCS#12 file, which is a standard way of storing certificates and private keys. This is equivalent to the Windows Certificate Store. You will need to provide a certificate with its private key and the CA (Certificate Authority) certificate that signed it. Note The commands below should be run in an elevated command line. If any of the paths contain spaces, surround them with quotation marks (`"`). ## High Level Steps 1. Choose an Elasticsearch node at random. 1. Delete the current certificate from the PKCS#12 file used by Elasticsearch. 1. Provide a certificate with a private key, import the new certificate's pfx/p12 file, and change the certificate alias. 1. Provide the signing CA (Certificate Authority) certificate's `.cer` file and import it into Elasticsearch's PKCS#12 file to trust the certificate within Elasticsearch. 1. Restart the Elasticsearch service. 1. Copy the new PKCS#12 file to the other Elasticsearch nodes and restart them. 1. Insert the new PKCS#12 file into the File Access Manager database using the SailPoint `FAMCertificateManager` tool. ### Detailed Steps 1. Choose one of the Elasticsearch nodes to perform the following steps on. It can be any of the currently installed nodes, no matter the order of installation. 1. Delete the current certificate from the PKCS#12 file used by Elasticsearch: ```text "%SAILPOINT_HOME%\Elasticsearch\elasticsearch- 8.2.2\jdk\bin\keytool.exe" -delete -alias key -storepass "" -keystore "%SAILPOINT_HOME%\Elasticsearch\elasticsearch- 8.2.2\config\fileaccessmanager-elastic-cert.p12" "%SAILPOINT_HOME%\Elasticsearch\elasticsearch- 8.2.2\jdk\bin\keytool.exe" -delete -alias cert -storepass "" - keystore "%SAILPOINT_HOME%\Elasticsearch\elasticsearch- 8.2.2\config\fileaccessmanager-elastic-cert.p12" ``` 1. Provide a new certificate with a private key, import the new certificate's pfx/p12 file and change the certificate alias: 1. Provide a new certificate in a pfx/p12 format using your organization's standard method of obtaining server certificates. It should contain the certificate's private key. 1. Use the following command to import the private key from the new pfx/p12 file into the one used by Elasticsearch: ```text "%SAILPOINT_HOME%\Elasticsearch\elasticsearch- 8.2.2\jdk\bin\keytool.exe" -importkeystore -srckeystore -destkeystore "%SAILPOINT_HOME%\Elasticsearch\elasticsearch- 8.2.2\config\fileaccessmanager-elastic-cert.p12" -deststorepass "" -srcstorepass ``` 1. The import process will generate a default alias for the private key, which is displayed in the last commands output. Set the private key's alias to "key" by running the following command: ```text "%SAILPOINT_HOME%\Elasticsearch\elasticsearch- 8.2.2\jdk\bin\keytool.exe" -changealias -alias -destalias key -keystore "%SAILPOINT_HOME%\Elasticsearch\elasticsearch- 8.2.2\config\fileaccessmanager-elastic-cert.p12" -storepass "" ``` 1. Provide the signing CA (Certificate Authority) certificate's .cer file and import it into Elasticsearch's PKCS#12 file to trust the certificate within Elasticsearch: 1. Provide the signing CA (Certificate Authority) certificate's .cer file using your organization's standard method of obtaining CA certificates. It should not contain the private key, just the certificate itself. 1. Import the certificate using the following command: ```text "%SAILPOINT_HOME%\Elasticsearch\elasticsearch- 8.2.2\jdk\bin\keytool.exe" -importcert -file -keystore "%SAILPOINT_HOME%\Elasticsearch\elasticsearch- 8.2.2\config\fileaccessmanager-elastic-cert.p12" -storepass "" -alias cert ``` 1. Restart the Elasticsearch service. 1. Copy the new PKCS#12 file to the other Elasticsearch nodes and restart them as well. Make sure to copy the file to the same path as the first node, which according to the previous steps should be: `%SAILPOINT_HOME%\Elasticsearch\elasticsearch-8.2.2\config\fileaccessmanager-elastic-cert.p12`. Note This should also be done for the Elasticsearch nodes in Disaster Recovery as well. Insert the new PKCS#12 file into the File Access Manager database, using the SailPoint FAMCertificateManager tool on just one of the nodes: ```text "%SAILPOINT_HOME%\FileAccessManager\Server Installer\Tools\FAMCertificateManager\FAMCertificateManager.exe" 20 - esCertFile="%SAILPOINT_HOME%\Elasticsearch\elasticsearch- 8.2.2\config\fileaccessmanager-elastic-cert.p12" ``` Note 20 is the ID of the first Elasticsearch node. Using the ID of any node will always assign this certificate to the other nodes as well. # Changing Certificates for RabbitMQ To replace the RabbitMQ certificates with your own trusted certificates, provide the following certificate files and keys: - The file containing the public key of the root Certificate Authorities that you wish to implicitly trust, named: `ca.cer` - The file containing the client's own certificate public key, named: `rabbitmq.cer` - The file containing the client's private key in PEM format, named: `key.pem` This can be done using OpenSSL. Examples of the commands are as follows: - `openssl pkcs12 -in famcert.pfx -nokeys -out rabbitmq.cer` - `openssl pkcs12 -in certname.pfx -nocerts -out key.pem -nodes` To configure the RabbitMQ certificate files: 1. Replace the files located under “%SAILPOINT_HOME%\\RabbitMQ\\certificates” with the certificates and key mentioned above. 1. Open the file %SAILPOINT_HOME%\\RabbitMQ\\data\\rabbitmq.config with a text editor, and replace the current files path with the path of your own trusted certificates and key. Then save the file. 1. Delete the SailPoint RabbitMQ certificate from the certificate computer store. The certificate name is “File Access Manager RabbitMQ” 1. Restart the rabbitmq service, the Central Permission Collection Engine(s) and Collector(s) services and the Central Data Collection Engine(s) and Collector(s) services. # File Access Manager Website SSL The File Access Manager website is not affected by general SSL settings. Setting the File Access Manager website to use SSL is not required but is recommended. To use SSL for Website communications, perform the following steps, complete the following steps: 1. Install a certificate on the same server as the File Access Manager page (preferably with the same certificate criteria described above). 1. Open Internet Information Services Manager (inetmgr). 1. Navigate to the Default Web Site, and select **Bindings** on the panel to the right. 1. Select **Add**. 1. Select **HTTPS** on the Type dropdown menu. 1. Select **Select** on the SSL Certificate dropdown menu to use a trusted certificate, preferably one from your organization. 1. Select **OK**. 1. Select **Close**. A manual update must be made in the DB to reflect the website URL. Run the following SQL query: `update [whiteops].[system_configuration_value] set [value] = replace([value],'http','https') where [name]='Web Site URL'` 1. Set the "requireSSL" flag and SSL port in the configuration file. **File:** C:\\inetpub\\wwwroot\\siqApi\\SiqApi.dll.config `` **true:** require SSL **false:** regular http protocol `` **ssl port:** Change this value if you want to change the default 1. When securing cookies, ensure the following is in each web.config file for v1, v2, and siqapi. `”` The web.config files are located at: - V1 - "{website root folder} \\identityiqfam\\v1\\web.config" - V2 - "{website root folder}\\identityiqfam\\v2\\web.config" - SiqApi - "{website root folder} \\siqApi\\web.config" The default installation path for File Access Manager IIS application is “C:\\inetpub\\wwwroot” To make browsing to the page using HTTPS mandatory, perform the following steps: 1. Double-click on SSL Settings while on the Default Website. 1. Select **Require SSL**. 1. Leave “Ignore” on Client Certificates. 1. Select **Apply**. # Configuring to use SAML Authentication The File Access Manager login process can be integrated with any SAML 2.0 identity provider. This guide details integration steps for the following providers: - Azure - Okta - ADFS You can later switch between SAML login and Windows login (See Switching from SAML to Windows Authentication Mode). To support SAML login, complete the following steps. 1. Create a dedicated application within the identity provider for the File Access Manager authentication. 1. Follow the installation instructions for your identity provider: - [Creating an Azure Application](#) - [Creating an Okta Application](#) - [Creating an ADFS Application](#) 1. Follow the File Access Manager installation instructions in this guide, with the following points: 1. On the Website authentication mode screen, select **SAML 2.0** (see [Website Authentication Mode](#)). 1. Do not create an identity store. 1. After installation, set up the authentication on the File Access Manager servers and database to accept the SSO login. Refer to System Settings Required to Support SSO. Important If you are using a load balancer, note that when configuring a system to use SAML authentication, the load balancer should be configured to use a sticky session. # Creating an ADFS Application To connect ADFS as an identity provider for File Access Manager, first create a dedicated application in ADFS. Complete the following steps to create an ADFS application: 1. Log into ADFS and navigate to **Trust Relationships > Relying Party Trusts**. 1. Select **Add Relying Party Trust**. 1. In the opened wizard, enter the following values for the respective steps: 1. **Select Data Source**: Choose **Enter data about the relying party manually** (the last option). 1. Select **Next**. 1. **Specify Display Name:** Enter any name for the relying party trust. This name will later be used during the installation of File Access Manager with the SAML 2.0 option. 1. Select **Next**. 1. Choose Profile: Select the first option: **ADFS profile**. 1. Select **Next**. 1. Configure Certificate. 1. Select **Next**. 1. Configure URL. 1. Select **Next**. 1. Relying Party Trust Identifier: Enter the name specified earlier in the **Specify Display Name** step. - Select **Add**. - Select **Next**. 1. Configure Multi-factor Authentication Settings: Select **I do not want to configure multi-factor authentication**. 1. Select **Next**. 1. Choose Issuance: Select **Permit all users to access the relying party**. 1. Select **Next**. 1. Ready to Add Trust. 1. Select **Next**. 1. Select **Finish**. 1. Check **Open the Edit Claim Rules**. 1. Select **Close**. 1. In the opened **Edit Claim Rules for [App Name]** window, select **Add Rule**. 1. In the opened wizard, select and enter the following data: - **Select Rule Template**: Choose **Send LDAP Attributes as Claims**. - Select **Next**. - Provide the following information for the **Configure Claim Rule**: - **Claim rule name**: `UserInfo` - **Attribute store**: Active Directory - Mapping of LDAP attributes to outgoing claim types: - User-Principal-Name: `Username` - User-Principal-Name: `Name` 1. Select **Finish**. 1. Select **Add Rule** again. 1. In the opened wizard, select and enter the following data: - **Choose Rule Type**: Select **Transform an Incoming Claim**. - **Claim rule name**: Free text - **Claim rule template**: Select **Transform an Incoming Claim** - **Incoming claim type**: Username - **Outgoing claim type**: Name ID - **Outgoing name ID format**: Unspecified - **Pass through all claim values**: Select this option. 1. Select **Finish**. 1. Select **OK**. 1. Right-click the recently created **Relying Party Trust** > **Properties**. 1. Select the **EndPoints** tab. 1. Select **Add SAML**. 1. Fill the following values in all fields: - **Endpoint type**: SAML Assertion Consumer - **Binding**: POST - **Index**: 0 - **Trusted URL**: Enter the following link:\ `https://[SERVER_NAME]/siqapi/login/AssertionConsumerService` where `SERVER_NAME` is the server where the File Access Manager website is installed. 1. Select **OK** on the next two screens. The ADFS application is now set, and the following data will be needed during the installation of File Access Manager with the SAML 2.0 version: - The name of the created Relying Party Trust, e.g., "ADFS_for_FAM_vit". - The URL to the Metadata, which is constant per VM where ADFS is set.\ The URL can be found in the **ADFS Configuration > Service > Endpoints > Metadata** section. When installing File Access Manager, ensure you follow the sections related to **SAML login installation**. # Creating an Azure Application To connect Azure as an identity provider for File Access Manager, you must first create a dedicated application in Azure. Complete the following steps to Create an Azure Application: 1. Log in to Microsoft Azure Portal. 1. Navigate to Enterprise Applications. You can search for **"Enterprise applications"** in the search bar and select it. 1. Select **+ Create your own application** to create the application. - **What's the name of your app?**: Enter any name for your application. - **What are you looking to do with your application?**: Integrate any other application you don't find in the gallery. - Select **Create**. 1. Select the **Single Sign-On** option in the Navigation menu. 1. Select **SAML** as the sign-on method. 1. In the Basic SAML Configuration panel, Select **Edit**. 1. Fill the following fields: - **Identifier (Entity ID)**: This should be entered with `https://` and can be the address of the VM. This data will be used in the Server Installer during the installation of the **SAML** option. - Delete the default value for **Identifier**. - Select the created identifier as the default by checking the checkbox. - **Reply URL (Assertion Consumer Service URL)**: `https://[SERVER_NAME]/siqapi/login/AssertionConsumerService` where **SERVER_NAME** is the VM where the **File Access Manager** website is installed. 1. Select **Save**. 1. In User Attributes & Claims, select **Edit**. 1. Within Required Claim, click on the **Claim name** at the top. 1. In the dropdown Choose name identifier format, select **Unspecified**. 1. In the Source Attribute dropdown, ensure that the selected value is `user.userprincipalname`. 1. Select **Save**. 1. Select the **X** to close the current window. 1. Navigate to **Properties** and verify that **User assignment required?** is set to **No**. 1. Select **Single sign-on** > **Test this application**. The Azure application is now set. The following data will be needed during the installation of File Access Manager with the SAML 2.0 version: - **Identifier** from the **Basic SAML Configuration panel**. - **Federation metadata document URL**:\ Copy the value under **"App Federation Metadata Url"** in the third frame. When installing File Access Manager, ensure to follow the sections related to SAML login installation. # Creating an Okta Application If you are using SAML login connected to Okta for authentication, you need to first create a dedicated application in Okta. 1. Complete the following steps to create an Okta application: 1. Open the **Create a new Application** dialog. 1. Log into **Okta**. 1. Select **Applications** to open the Applications screen. 1. Select **Add Application**. 1. Select **Create New App**. 1. In the Platform, select **Web** and in the Sign-on method, select **SAML 2.0**. 1. Select **Create**. 1. Fill in the Configuration Fields: 1. General Settings: - **Application name**: Enter any name for your application. - Select **Next**. 1. Configure SAML: - **Single sign on URL**: `http://[SERVER_NAME]/siqapi/login/AssertionConsumerService` where `SERVER_NAME` is the VM where the website is installed. 1. Audience URI (SP Entity ID): Enter the name of the application. This will be used later during the installation of **File Access Manager** with the SAML option. Important Additional settings can be found under the **Show Advanced Settings** link. These settings should not be changed. If they are changed, they must also be updated in the File Access Manager installation with the SAML option. 1. Feedback: - **Are you a customer or partner?:** Select **I'm an Okta customer adding an internal app**. 1. Select **Finish**. The application has been successfully created. 1. Select **Identity Provider metadata**. 1. Copy the URL of the opened page. This will be used later during the installation of File Access Manager with the SAML option. ## Adding Users to the Application 1. Select the **Assignments** tab. 1. Navigate to **Assign > Assign to People**. 1. Select **Assign** next to the displayed user. 1. Select **Save** to go back. 1. The user is now selected as Assigned. 1. Select **Done**. 1. The user is now displayed in the Application list. ### Adding Additional Users Additional users or groups can be added through: - **Directory > People > Add Person** - **Directory > Groups > Add Group** Important The user email entered should be an actual email as it is part of the account activation process. ## Assigning Applications to Users 1. Navigate to **Applications > Applications** and select **Assign Applications**. 1. Select the applications and users you want to assign. 1. Select **Next**. 1. Select **Confirm Assignment**. 1. Navigate to **Applications > Applications** and select the **Existing Application**. 1. The **Assignments** tab is selected, verify that all assigned users are displayed in the grid. The Okta application is now set, and the following data will be needed during the installation of the File Access Manager with the SAML 2.0 version: - The name of the created Okta application (e.g., `FAM_SAML_LogIn`). Note This string is case-sensitive in the installation process of File Access Manager. - The **URL** to the **Metadata** mentioned above. When installing File Access Manager, ensure you follow the sections related to SAML login installation. # Switching from SAML to Windows Authentication Mode You can switch the File Access Manager authentication mode from SAML, which uses a local identity provider, to Windows username and password method by changing the setup in the File Access Manager installer. Complete the following steps to switch authentication mode: 1. Set the Authentication Mode in the File Access Manager Installer. 1. Open the File Access Manager installer on the server where the Web Client and IIS are installed. 1. Navigate to the **Select web authentication mode** step. 1. Change the option from **SAML** to **Windows**. 1. Select **Next** through the installation wizard until you reach the end, and then select **Finish**. 1. Change the IIS Authentication Method. 1. Open **IIS Manager**. 1. In the tree on the left-hand side, navigate to **Current Server > Sites > Default Web Site**. 1. Select on the **cdn** folder, then in the **IIS** section, select **Authentication**. 1. Right-select and select **Anonymous Authentication > Disable**. 1. Right-select and select **Windows Authentication > Enable**. 1. Repeat the above steps for the following folders/locations: - `Identityiqfam > v1` - `Identityiqfam > v2` - `SecurityIQBiz` - `SiqApi` 1. **Restart IIS** to apply changes. 1. Create an Active Directory Identity Collector by navigating to **Application > Configuration > Permission Collection > Identity Collectors**. 1. Set a schedule for this identity collector. 1. Navigate to **Applications > Configuration > General Configuration > Authentication Store**, and select the identity collector you created from the dropdown list. This will now configure the Active Directory as the authentication store. 1. Run the scheduled task for the authentication store you created above. 1. Clear the cache of previous sessions in your browser. 1. Open the Website and sign in with any user from the Active Directory authentication store. 1. The SAML Login option and the Logout button will no longer appear in the system. By following these steps, you will have successfully switched the authentication method to Windows Authentication. # System Settings Required to Support SSO After completing the File Access Manager admin client and website installations, you must configure the application to accept SSO login. 1. Log in to the server where **IIS** (Website) is installed to connect to it. 1. Open the **IIS Manager** from the server. 1. Depending on the version and configuration, navigate to one of the following paths: - **The server > Sites > Default Web Sites > identityiqfam > v1\\v2 > Authentication** - **Server > Sites > Default Web Sites > identityiqfam > cdn > Authentication** - **Server > Sites > Default Web Sites > identityiqfam > SecurityIQBiz > Authentication** - **Server > Sites > Default Web Sites > identityiqfam > SiqApi > Authentication** 1. Ensure that **Windows Authentication** is **disabled** for the listed paths. The only enabled option should be **Anonymous Authentication**. 1. Once the authentication settings are adjusted, continue configuring the system according to the settings for your **SSO provider** (e.g., Okta, Azure, ADFS). 1. System Settings to Support SSO - Okta 1. System Settings to Support SSO - ADFS 1. System Settings to Support SSO - Azure # Creating or Editing an Azure Identity Collector ## Azure AD Connector Full OAuth 2.0 Support File Access Manager now offers full support for OAuth 2.0 Authentication for the Azure AD connector. This enhancement replaces the previous Basic Authentication flow, where admins needed to provide user and password credentials, with a more secure and standardized method using OAuth 2.0. The configuration now aligns with other cloud application connectors like OneDrive, ensuring a modern and secure experience. File Access Manager now offers full support of standard OAuth 2.0 Authentication for the Azure AD connector. The new authorization sequence will direct the user through a standard Microsoft O365 consent flow, to grant the File Access Manager Azure AD Connector app the privilege to acquire and refresh access tokens. The new authentication method replaces the previous Basic Authentication flow, that required admins to provide user and password credentials. This enhancement brings full OAuth support to the Azure AD Identity Collector, instead of the legacy user and password approach. This means the configuration will resemble other connectors for cloud applications such as OneDrive. - Configuring the Identity Collector, instead of providing a username and a password, you will click on a link that sends you to a Microsoft login page. - Enter the relevant user credentials and give your consent for the File Access Manager Azure AD O365 Application to access your directory data. - You will then copy the resulting Authorization Code to the appropriate field, which will then be used to generate the first access token. - The access token will be used in all requests to the tenant's Azure AD and will be automatically refreshed when needed. ### Configuration To complete the Azure Identity Collector configuration, follow these steps: 1. In the Identity Collector Configuration Wizard, enter your O365 Domain name, then click on the OAuth User URL link to generate an Authorization Code. 1. You will then be redirected to the Microsoft O365 Login Screen. Log in with the user credentials that should be used by the Identity Collector. 1. You will be prompted to consent to granting access to the File Access Manager Azure Connector. Accept to receive an Authorization Code and continue with generating the Access Token. 1. A final redirect will lead you to the File Access Manager Cloud Application Authorization Service, and will present the received Authorization Code. 1. Copy that code and paste it in the Auth Code field in the Identity Collector Configuration Wizard screen. 1. Select **Next** and complete the Identity Collector configuration flow. Once completed, the Azure Identity Collector will be configured using OAuth 2.0, and the access token will be used for future authentication and data synchronization. ### Permissions The File Access Manager Azure AD Connector requires the following permissions: - Directory.Read.All – this Permission grants read only access to AAD contents (by default, all domain users can read all AAD data). ### Azure Active Directory Connectivity Requirements File Access Manager uses the Microsoft Graph REST API – which works exclusively in HTTPS. The API base path is `https://graph.microsoft.com/v1.0/` where the tenant domain name is the customer assigned domain name on Microsoft cloud. It is usually in the format of `domain_name.onmicrosoft.com`, but might be changed in your configuration. The following is a list of resources that are accessed by File Access Manager using the REST graph API include: - - - } - } - - } ### Administrator Consent Requirements To grant a third-party application (ISV) with the **Directory.Read.All** permission in Azure, administrator consent is required. This consent can be granted by users with one of the following roles: - Global Administrator (Company Administrator) - Cloud Application Administrator - Application Administrator Here is how the process works: During the initial configuration phase (while generating the token for the first time), the service account dedicated to the File Access Manager Azure AD Connector must have one of the above-mentioned roles. After consent is granted, the role can be removed from the user. The consent flow will appear differently depending on the role of the user trying to grant consent: - **Non-admin User**: When a non-admin user tries to access the consent screen, they will be shown an error or denied access, as they do not have permission to grant consent. - **Application Administrator**: When an Application Administrator tries to grant consent, they will be asked to consent to the **Directory.Read.All** permission for the File Access Manager application. This consent grants the application access to read directory data. - **Global Administrator**: When a Global Administrator (Company Administrator) tries to give consent, they will see an additional checkbox labeled "Consent on behalf of your organization." If checked, this will grant permission to the application for all users in the organization, ensuring that no other user needs to give explicit consent. However, this checkbox is optional and not required by File Access Manager, as the application only needs to operate on behalf of the consenting user. Once consent is granted by one of these roles, the File Access Manager Azure AD Connector will be able to authenticate and interact with the directory data as required. The role can be removed after consent has been given, as further actions do not require elevated permissions. ### Avoiding the Administrative Roles Grant To avoid granting an administrative role to the service account during the consent process, even if only temporarily, Azure provides the **AdminConsentRequests** feature. This feature allows non-admin users to indirectly give consent for applications that require admin consent by requesting approval from an administrator. This feature can be enabled at the tenant level and allows setting one of the three administrator roles (Global Administrator, Cloud Application Administrator, or Application Administrator) as viewers who can approve consent requests. The requested is required to provide a justification for granting consent to the application and a request is sent to the administrator listed in the configuration as reviewers. Clicking on **Back to app** would just return an access denied error as access was not yet granted. This screen can be safely closed while waiting for admin consent. The reviewing administrator will either receive an email notifying them of the request, or have to go to the Admin Consent Requests screen and check for new requests. To approve a request, the administrator will go through the Review permissions and consent flow. After an Administrator accepts, non-administrator users will have to go the through token generation sequence again. However, this time the consent screen will be skipped entirely, and the flow will lead directly to the Authorization code. Note This method gives consent to the app on behalf of the entire organization, similar to when a Global Administrator ticks the checkbox to enables the Consent on behalf of your organization, as described above. # System Settings to Support SSO - ADFS To set up SSO with ADFS for File Access Manager, follow the task checklist below, followed by a detailed description of each step: Task Checklist: - **Admin client**: Create an Active Directory identity collector. - **Admin client**: Select this identity store as the authentication store. - **Website**: Log in using the wbxadmin credentials and run the Identity collector task that was recently selected as the authentication store. This will load the ADFS users into the database. - **Website**: Select **SAML login** and sign in to the relevant SSO Provider. - You should now be logged into File Access Manager as the SSO provider user. ## Detailed Settings 1. In the Admin Client, create an Active Directory Identity Collector. Note Instead of creating a new store, you can use the authentication store created during the initial launch of the admin client, and skip the next step. 1. In the Admin Client, select this identity store as the authentication store by navigating to **Configuration > General Configuration > Authentication Store**. 1. Select the Active Directory identity collector created above (or the one used during the initial setup) as the current authentication store. 1. Select **Finish**. 1. Open the website and select **Continue with username and password**. 1. Log in to the system with the wbxadmin username and the password entered during installation. 1. Select **Login**. 1. Navigate to **Settings > Tasks Management > Scheduled Tasks**. 1. Run the Identity Synchronization task that was recently selected as the authentication store. This task will load ADFS users into the database. 1. On the website, select **SAML login**. 1. Sign in using the relevant SSO Provider (ADFS). 1. After logging in, you should be successfully logged into File Access Manager as the ADFS user. # System Settings to Support SSO - Azure To set up SSO with Azure for File Access Manager, follow the task checklist below, followed by a detailed description of each step: Task Checklist: - **Admin client**: Create an Azure identity collector. - **Admin client**: Select this identity store as the authentication store. - **Website**: Log in using the wbxadmin credentials and run the Identity collector task that was recently selected as the authentication store. This will load the Azure users into the database. - **Website**: Select **SAML login** and sign in to the relevant SSO Provider. - You should now be logged into File Access Manager as the Azure SSO provider user. ## Detailed Settings 1. IN the Admin Client, create an Azure identity collector. 1. For the process of creating or editing an Azure identity collector, refer to the **Creating or Editing an Azure Identity Collector** section in the File Access Manager Admin Guide. 1. To choose an identity store as the authentication store, navigate to **Configuration > General Configuration > Authentication Store**. 1. Select the **Azure identity collector** created above as the current authentication store. 1. Select **Finish**. 1. Open the website and select on **Continue with username and password**. 1. Log in to the system with the **wbxadmin** user and the password entered during installation. 1. Select **Login**. 1. Navigate to **Settings > Tasks Management > Scheduled Tasks**. 1. Run the Identity Synchronization task that was recently selected as the authentication store. This step will load Azure users into the database. 1. On the website, select **SAML login**. 1. Sign in using your Azure SSO credentials. 1. After logging in, you should be successfully logged into File Access Manager as the Azure SSO provider user. # System Settings to Support SSO - Okta To set up SSO for Okta with File Access Manager, follow the task checklist below, followed by a detailed description of each step: Task Checklist: - **Website**: Log in using the wbxadmin credentials and create a data source for SSO users. - **Admin client**: Create an identity collector based on this data source. - **Admin client**: Select this identity store as the authentication store. - **Website**: Run the Identity Collector task that was recently selected as the authentication store. This will load the Okta users into the database. - **Website**: Select **SAML login** and sign in to the relevant SSO provider. - You should now be logged into File Access Manager as the SSO provider user. ## Detailed Settings 1. For the website, create a data source for SSO users. Note First time login to File Access Manager using wbxadmin credentials\*\*. 1. Open the website and select **Continue with username and password**. Warning Ensure you use the correct URL. The URL used to log in should match the Redirect URL entered in the **OKTA** application during its creation. If you use **HTTPS**, both the login link and redirect URL in Okta should use **HTTPS**. Warning If you use an **IP address** instead of the server name, both the login link and Redirect URL in Okta should be written with the **IP address**. 1. Log in to the system with the **wbxadmin** username and the password entered during the installation of the system. 1. Select **Login**. 1. Navigate to **Admin > Data Sources > Add New Data Source**. 1. Create a data source containing a list of Okta Users that you want to access File Access Manager. - The data source could be a query from a database table, a local Excel file, or a static table stored in File Access Manager. - The data source should have a single column containing the user login, such as User Principal Name. - The users should be assigned to the File Access Manager application in Okta. - For example, name the data source "OktaUsers" and the column "User Principal Name". 1. For the Admin client, create an identity collector based on this data source 1. Navigate to **Configuration > Permissions Management > Identity Collectors**. 1. Select **New** and select the **Data Source-based Identity Collector**. 1. Enter a name for the collector and uncheck "This application uses Groups". 1. Select **Next** and select the **Data Source** created in the website. 1. Map the **User Principal Name** to **Username**. 1. Select **Next**. 1. In the **Identity Collector Users Collections (3 of 3)**, uncheck all checkboxes (**Users Tree**, **Unique User Accounts Mapping**). 1. Select **Next**. 1. Create a scheduler to define the update frequency for reading new users from the Okta data source. 1. Select **Finish** and wait until the task is completed. 1. Close the Identity Collector Configuration window. 1. Navigate to **Configuration > General Configuration > Authentication Store**. 1. Select the identity collector you created earlier as the current authentication store. 1. Select **Finish**. 1. Navigate to **Settings > Tasks Management > Scheduled Tasks**. 1. Run the **Identity Synchronization task**, which was recently selected as the authentication store. 1. On the website, Select on the **SAML login** button. 1. Sign in to the relevant **SSO Provider** (Okta in this case). 1. If prompted, Select on **Send anyway** and sign in for the first time. You should now be logged into File Access Manager as the Okta user. # Managing Access Certification Campaigns The My Tasks tab provides in-depth detail for users to manage certain aspects of their Access Certification campaigns. ## Viewing Access Certifications To filter campaigns displayed by default, perform the following steps: 1. Select the **Access Certification** tab. 1. Select **Filters** at the top right of the displayed list. 1. Select one of the following options from the **Applications** dropdown menu: - All - [Name of Relevant Application] 1. Select one of the following options from the **Current Status** dropdown menu: - All - In Process - Closed 1. Select one of the following options from the **Due Date** dropdown menu: - All - Overdue - Due Today - Due in 7 Days - **Define Range …** If you select **Define Range …**, a two-month calendar view displays. 1. Select a **start date** 1. Select an **end date** Note The selected date range displays in the **Due Date** dropdown box. 1. Select the **Reset** button below the dropdown menus, on the far right of the screen, to reset all the filters. Note Once you have selected the **Applications**, **Current Status**, and **Due Date** filters, the word **“Filters”** in the Filters button changes from gray lettering on a white background to white lettering on a green background. The filtered **Access Certification** tasks display in a table below the dropdown menus, with the following columns: - **Due Date**: In mmddyyyy format – Displays **Expired** (in red), **Expires soon** (in yellow), or is empty. - **Name**: The name of the campaign. - **Application**: The application related to the campaign. - **Current Status**: The current status of the campaign. - **Progress**: A progress bar, showing the relative progress made in the campaign. - **Actions**: Select the **View** button in the same row as a given campaign to display the access certification details. ### Access Certification Task Details Administrators execute campaigns that generate access certification tasks for the campaigns’ reviewers. This window gives a business user an easy and intuitive way to approve/reject hundreds of thousands of permissions in the selected campaign. It also has advanced filtering capabilities and representation of the permissions, based on grouping criteria, in chart form. To view access certification details for a selected task, select **View** under the **Actions** column of the task to be viewed. The **Access Certification** detailed task screen shows permissions for the business data owner to review. This screen is similar to the task screens for **Access Request**. The displayed columns vary, based upon the administrator’s selections. An administrator can set other columns in an Object’s template in the **Administrative Client**. A detailed task screen of the selected task displays. ### Detailed Task Screen If a campaign has instructions, the left side of the **Access Certification** detailed task screen first row displays the name of the campaign and a link to display the campaign’s instructions. The right side of the first row contains a progress bar that displays how far this task has progressed. The columns in the main **Access Certification** detailed task screen are dynamic. The Actions column options are: - Approve - Reject - Comment - Select The Select options are: - Review History - User’s Permission Paths Note Sort a column in alphabetical or numerical order by selecting any of the column headings. ## Reviewing the History of an Access Certification When you select **Review History**, the Review History box displays. Note If no history is available, the window displays the following text: “There is no Review History to show.” All a reviewer’s selections (approve, reject, comment, history) display the next time the reviewer checks My Tasks. When you select **User’s Permission Paths**, the permission paths display. When finished filtering, select **Approve** to approve the filters, or **Reject** to reject the filters. Select **Commit** to save changes or **Close** to close without saving changes. ### Navigating within the Detailed Task List The bottom of the Detailed Task screen displays the previous (**Prev**) or next (**Next**) screen, and the number of the total number of screens displayed (for example, ½ indicates that the first of two screens displays). To see more results per page (the default is 10), select the dropdown menu on the left side of the screen to choose 10, 25, 50, or 100 results per page. To navigate from the current page to the previous page, select **Prev** or `<` at the bottom right of the page. To navigate from the current page to the next page, select **Next** or `>` at the bottom right of the page. ## Utilizing Bulk Actions To execute bulk actions on all permissions in a current filter, perform the following steps: 1. Select **Bulk Actions**. A dropdown menu displays, showing the number of records in the filter results, with the following options: - **Approve All** – changes all Pending Decision status rows in the current filter results to Pending Commit status - **Reject All** – changes all Pending Decision status rows in the current filter results to Pending Commit status - **Clear All** – changes all Pending Decision status rows in the current filter from Pending Commit status to Pending Decision status. You cannot revert committed rows. 1. Select **Yes** to clear all records, or Select **No** to return to the previous screen. ## Filtering the Filters Select **Filters** at the far right to filter table rows, based on displayed fields, operators, and values, as follows: **Fields** - This includes all the column headings listed above. The static fields that do not display in the table columns are: - **Record Action** – options are **Approved** / **Rejected** - **Record Status** – options are **Pending decision**, **Pending Commit**, **Committed**, and **Not Committed** **Operators** - **Contains** – free text - **Equals** – auto-completes the value (the only choice for the static fields listed above) - **Starts with** – free text - **Empty** – no value - **Value** – values based upon the operator selected ## Viewing Results as Graphs To the right of the Bulk Actions dropdown menu is a **View Graph** dropdown menu that provides various selections of graph views. Graphs are a convenient way to view the results of filtering and are available from the dropdown menu, immediately to the right of Bulk Actions. The graph groups filtered results per the selected field in the menu. There are as many chart views as there are fields. To view filters as a graph, perform the following steps: 1. Select the **View Graphs** dropdown menu and select a chart view. A bar chart view displays, with different colored columns and a key to the chart. - In **Viewing Access Certifications**, **Department** was selected as the chart view, and separate bar charts display for **Dept1**, **Dept2**, and **Null** (No department). - **Viewing Access Certifications** shows a magnified view of the chart key, where different colors are used for tasks: - **Pending** (gray) - **Approved** (dark green) - **Approved and Committed** (light green) - **Rejected** (dark red) - **Rejected and Committed** (light red) 1. Select a chart column. A pop-up screen displays an entire column (with the number of items in parentheses) or a portion of the column (with the number of items in parentheses). 1. Select **Pending for Action**. A dialog displays with the following options: - **Approve All** - **Reject All** - **Clear All** 1. Select **Approve All**, **Reject All**, or **Clear All**. A Question dialog displays, asking for confirmation and providing space for a free text comment (only for **Approve All** or **Reject All**). 1. Select **Yes** to confirm, or Select **No** to return to the previous screen. Alternatively: 1. Select **Entire Column**. A dialog displays with the following options: - **Approve All** - **Reject All** - **Clear All** - **Filter further by** (filtered item) – displays additional selected filtering - **View table by** (filtered item) – displays the table with the applied filters 1. Select **Chart Filtered by** (filtered item). A dialog displays with field options for chart groups. 1. Select a field for chart groups. Note After selecting a field, the chart displays grouped by the new field and filtered by the selected value (in this case, **Dept2**). This is not a bulk action. # Data Owners Election To view Owners Election tasks displayed by default, select the **Owners Election** tab. The **Owners Election** tasks display in a table with the following columns: - **Task Type** – displays the task type (for example, **Elected Data Owner Review** or **Data Owners Election**) - **Issue Date** – the date of the election or review, in **mm/dd/yyyy** format - **Application** – the application of the resource for which a data owner was elected - **Resource** – the resource for which a data owner was elected - **Actions** – select the **View** button in the same row as a given access certification to display the details of that access certification. ## Owners Election Task Details After an administrator has executed one or more goals, those goals will be displayed in the main screen of **My Tasks > Owners’** Election for the user to act. ## Data Owners Election Navigate to **My Tasks > Owners’ Election**. Select the **View** button under **Actions** on the far right of one of the “**Data Owners Election**” task types to display the “**Who owns the following resource?**” screen for that task. The resource name displays at the top left of the screen. In the “**Who owns the following resource?**” screen, the resource is `C:\Windows`. Under the resource, there is a list of files that the logged-in user has used and an indication of how long ago each file was used. ## To vote for a probable data owner: 1. Select the **Vote** button to vote for one or more of the displayed probable data owners.\ The probable data owner’s status changes from a blue thumbs-up with “Approve” on a white background to a white check mark with “Yes” on a green background. 1. Select **Yes** again (which is a toggle switch between “Vote” and “Yes”) to withdraw your vote. 1. Select **Add** to the right of Suggest other user to select a prospective data owner whose name is not already displayed. The "Please choose a user" search box displays. - Type the account name, or the first few characters of the name, in the search box. - A list of accounts displays below the search box, with an indication of the number of results (a maximum of 50 results) displayed. - Select a user’s name. - Select **Add**.\ The user’s name displays, with a green “Yes” button and a blue **x** to the right of the user’s name. If you Select the **x**, it removes the suggested candidate data owner. Note After you have selected a name for the “Other” probable data owner, a new “Other” probable data owner displays. You can vote for up to two “Other” data owner candidates. Note If you attempt to vote for more than two “Other” data owner candidates, the following error message displays: “You cannot add more than two other users.” 1. Select **I Don’t Know** if you do not know for whom to vote.\ Selecting “**I Don’t Know**” cancels all the votes. 1. Select **Commit** in the "Who owns the following folder" screen to complete the election process. Otherwise, select **Discard** in that screen to discard the voting results.\ The Commit choice is not available until you have voted for at least one candidate. 1. If you Select **Discard**, a question dialog displays, asking whether you want to discard all actions taken.\ Select **Yes** to discard all the actions or select **No** to return to the “**Who owns the following folder?**” page. Note If a smaller screen is used, the display adjusts responsively to accommodate the information differently. You can view the files used by selecting “**Files you used in this resource**.” ## Elected Data Owner Review To review the results from the Data Owners Election and to make a final decision for a probable data owner: 1. Navigate to **My Tasks > Owners’ Election**.\ The **Elected Data Owner Review** task displays. 1. Select **View** under Actions to the far right of the “Elected Data Owner Review” task type. 1. The Review Owners’ Election screen displays.\ The left and middle portions of the screen display the names of the first and second place candidates (as well as the third and fourth place candidates, depending upon the system settings) and the percentage of eligible voters who completed voting for those candidates. The right portion of the screen displays the names of the runner-up candidates. 1. Select **Approve** under the name of an elected owner to approve of that elected owner. 1. Select **Reject** under the name of an elected owner to disapprove of that elected owner. Note Since each approval or disapproval is independent of the others, it is possible to approve or disapprove of some or all the elected owners, and it is possible to select **Approve** or **Reject** under the same candidate if you change your mind. 1. Select **Commit**. Note It is not possible to select **Commit** until you have approved or rejected all the candidates (not the runners-up). # New Access Request Wizard The New Access Request Wizard assists users in submitting new access requests, either for resource permissions, group memberships, or both. Access the New Access Request Wizard by selecting **New Access Request** at the top right of the main window. At any step (after the first step) of the New Access Request Wizard, you can return to the previous step by selecting **Previous**, or you can cancel the wizard by selecting **Cancel** (both located at the bottom right of the New Access Request window). To run the New Access Request Wizard, perform the following steps: 1. Select **New Access Request**. 1. The **Which Request Type?** window displays. 1. Select **Recommended** from the list under “Which Request Type” (the default choice). 1. Select one of the request types: - **Administrative Groups** (group membership) - **Shares & Folders** (resource permissions) - **SharePoint Resources** (SharePoint resources permissions) ## Administrative Groups 1. Select **+Request Access** under Administrative Groups. The button changes from (gray letters on a white background) to (white letters on a green background) to indicate that this access request is now selected. 1. Select **Next** at the bottom right of the screen. Note At the bottom right of each screen, Select: - **Cancel** to cancel all your selections on this screen, or - **Previous** to return to the previous screen, or - Select one of the path milestones at the top of the screen, immediately under "New Access Request," or - **Next** to proceed to the next screen. The **Which Account?** window displays. Note If the logged-in user is associated with more than one account, the wizard displays those accounts in the **Which Account?** window. The logged-in user will be associated with more than one account if the administrator configured the **Unique User Account Mapping** in the Identity Collector configuration in the administrative client. If there is only one account, the wizard skips the **Which Account?** step and displays the **Which Groups?** step. 1. Select the account to access by Selecting the **+** sign to the right of the name of the account. The plus sign next to the selected account changes to a check mark, and the account changes from gray letters on a white background to white letters on a blue background. Note Deselect accounts by unchecking the check mark next to the selected account. - The selected account name displays after the word **Selected** at the top of the window. - Select **Next**. The **Which Groups?** window displays, with the top 50 results of available groups. These groups are all from the Authentication Store, which is the main domain containing all users and groups. Note You can also search for a group by typing the name of the group in the **Search** box at the top of the list of available groups. 1. Select the groups by Selecting the **+** sign next to the name of each group to be selected. 1. The plus sign next to the selected groups changes to a check mark, and the number of selected groups displays in the **Groups Selected** box, to the left of the **Search** box. Note Deselect groups by unchecking the check mark next to the selected groups. - The selected group names display after the word **Selected** at the top of the window. - Select **Next**. The **Why?** window displays. 1. Select **I’m a new member of my team** or **Other**. If you Select **Other**, provide a reason for the request in the box below **Other**. 1. Select **Finish** at the bottom right of the window. If the access request process succeeds, an Information dialog displays, noting that “Your request was successfully submitted.” 1. Select **OK**. The **My Requests** button shows the updated total number of requests. 1. Select **View** on the right side of each request to view the details of that request. Note The File Access Manager Administrator Guide provides additional information in the section **Permissions / Access Requests**. ## Shares & Folders 1. Select **+Request Access** under Shares & Folders. The button changes from (gray letters on a white background) to (white letters on a green background) to indicate that this access request is now selected. 1. Follow Steps 2-5 in [Administrative Groups](#administrative-groups). Note If there is only one account, the wizard will skip the **Which Account?** step and will display the **Which Permissions?** step. 1. Select **Next**. The **Which Permissions?** window displays. 1. From **Step 1: Select Resource**, select a resource or type the name of the resource in the search box above the list of resources. Notes Select **Clear** at the bottom right of the **Step 1** window to clear the selection and select another resource. If a label was added, it will display next to the resource name. 1. From **Step 2: Choose a permission type**, select a permission type or select the same permissions as those of a colleague (another user). 1. If you select **Permission Types**, select one of the available types. 1. If you select **Same as colleague**, either select one of the users (only if that user has relevant permissions) in the list or type the name of a user in the search box above the list of users. !!! note Select **Clear** at the bottom right of the **Step 2** window to clear the selection and select another user. !!! note At the bottom right of each screen, select: ```text - **Cancel** to cancel all your selections on this screen, or - **Previous** to return to the previous screen, or - Select one of the path milestones at the top of the screen, immediately under “New Access Request,” or - **Add Another Permission** to add an additional permission, or - **Next** to proceed to the next screen. ``` 1. Follow Steps 8-13 in [Administrative Groups](#administrative-groups). ## SharePoint Resources 1. Select **+Request Access** under SharePoint Resources. The button changes from (gray letters on a white background) to (white letters on a green background) to indicate that this access request is now selected. 1. Follow Steps 2-8 in [Shares & Folders](#shares--folders). ## File Servers, SharePoint, Exchange Tabs 1. Select **+Request Access** under one of the displayed file server applications. The button changes from **+ Access Request** (gray letters on a white background) to **Subscribed** (white letters on a green background) to indicate that this access requested is now selected. 1. Follow Steps 2-8 in [Shares & Folders](#shares--folders). ## Active Directory Tab 1. Select **+Request Access** under one of the displayed file server applications. The button changes from **+ Access Request** (gray letters on a white background) to **Subscribed** (white letters on a green background) to indicate that this access requested is now selected. 1. Follow Steps 2-8 in [Shares & Folders](#shares--folders). Note Regarding Step 6, select one of the following permission types: CreateChild, DeleteChild, ListChildren, ReadProperty, WriteProperty, DeleteTree, ListObject, Delete, ReadControl, WriteDacl, and WriteOwner. ## Other Applications Tab 1. Select **+Request Access** under one of the other applications. The button changes from **+ Access Request** (gray letters on a white background) to **Subscribed** (white letters on a green background) to indicate that this access requested is now selected. 1. Follow Steps 2-8 in [Shares & Folders](#shares--folders). Note Regarding Step 6, select one of the available permission types, which vary, depending upon the application selected. # Viewing My Requests My Requests displays a list of requests pending review. To filter My Requests tasks displayed by default, perform the following steps: 1. Select the **My Requests** tab. 1. Select one of the options from the **Request Type** dropdown menu. 1. Select one of the options from the **Status** dropdown menu. 1. Select one of the options from the **Review Conclusion** dropdown menu. 1. Select one of the options from the **Fulfillment Conclusion** dropdown menu. 1. Select one of the options from the **Request Date** dropdown menu. If you select **Define Range…**, a two-month calendar view displays, as shown in **Viewing Access Certifications**. 1. Select a **start date**. 1. Select an **end date**. The selected date range displays in the **Due Date** dropdown box. 1. Select **Reset** below the dropdown menus, on the far right of the screen, to reset all the filters. Note After you have selected the **Applications**, **Status**, and **Due Date** filters, the word **"Filters"** in the **Filters** button changes from gray lettering on a white background to white lettering on a green background. The filtered **My Requests** tasks display in a table below the dropdown menus. ## My Requests Task Details To view request details for a selected task, perform the following steps: 1. Select **View** under the **Actions** column of the task to be viewed. 1. The **My Requests** view screen displays. ## My Requests View The first line contains the name of the access request (granting or revoking a request or a group of requests) on the left, and a **View Details** button on the right. 1. Select **View Details** to view the details of the access request. The second line lists the following information from left to right: - **Requested by** – The user requesting the access request - **Due Date** – The date the request was initiated - **Current Status** – The status of the request, for example, “Review in Process” The third line lists the reason(s) for the request. The details of the request are in a table under the third line, with the following columns: - User - User Domain Name - User Display Name - Request Type - Permission/Group Name - Resource Full Path - Review Conclusion - Fulfillment Conclusion Note The following entities may view an access request: - The user who submitted the request - The user for whom access was requested # Reports File Access Manager provides advanced report generation capabilities. Reports can be generated using report templates in the File Access Manager website, or initiating reports from tables in the File Access Manager Administrative Client. Regardless of where reports are generated, all reports can be retrieved in the File Access Manager website. Reports make processed data available to the appropriate data owners. ## Sharing Reports File Access Manager sends reports to the recipients defined in the **Viewable by** section of the report. The system sends an email with a link to the report only to recipients with permission to download the report. If a recipient forwards that link to a user without permission to download a report, the recipient will not be able to download the report. ## Deleting Reports To open the report management screen, navigate to **Reports**. 1. Double-click on a report to display the report details. The **Report Details** window appears under the **Reports** window. 1. Select **Refresh** to refresh the Reports list. 1. Select **Delete** to delete a selected report. Note This option is available only to users with the **System > Reports > Delete** permission. ## Editing Reports The following fields are available when editing a customized report: - Custom fields to display (where supported) - Recipients list - Name - Description - Scheduling Note It is not possible to change the query filter of a saved customized report. To edit the parameters for a customized report: 1. Navigate to **Reports**. 1. Select a scheduled report from the list that you want to edit. 1. Select **Edit**. The **Welcome to the Schedule Report Wizard** screen will display. 1. Select **Next** on the **Schedule Report Wizard** welcome page. The **Report Configuration** screen will show the name in the **Name** field. 1. Type a description in the **Description** field. 1. Double-click in the **Viewable By** field to view a list of users who can access the report. 1. Select a user’s name and click the **+** sign. The user’s name will appear in the box under the **Viewable By** field. 1. Check the **Send to Data Owners** checkbox to send the report to data owners. 1. Relevant queries will appear in the **Query** section of the **Report Configuration** screen. 1. To send the configuration to the system without configuring a report schedule, select **Finish**. Note If you select **Finish**, a confirmation pop-up will appear:\ “You are creating a report without a scheduler. Do you wish to continue?” - Select **Yes** to save the report without configuring a schedule. - Select **No** to return to the **Report Configuration** screen. 1. If you select **Yes**, a warning pop-up will display: This indicates that you logged into the client with a local File Access Manager user, rather than an Active Directory user. Only Active Directory users can create reports because File Access Manager requires the user’s email and identity to generate the report. To schedule the configured report: 1. Select **Next** to go to the **Report Configuration** screen. 1. Check the **Create a Schedule** checkbox to set a schedule, or select **Finish** to send the report configuration to the system without a schedule. If you select **Finish**, a confirmation pop-up will appear. - Select **Yes** to send the configuration without a schedule. - Select **No** to return to the **Report Configuration** screen. If you select **Yes**, a warning pop-up will display. ### Editing Scheduled Reports in the Administrative Client Scheduled reports created in the Administrative Client can be edited in the **Reports** table. The following fields can be modified: - **Name** - The name of the report. - **Description** - Information about the report. - **Viewable by** - The audience with which the report is shared. This includes the users (or groups of users) who can view the report. - **Scheduling** - Available to users with the **Report Templates Administrator** permission. - **Sharing** - Available to users with the **Report Templates Administrator** permission. - **Displayed column** - Available on certain types of reports. # Report Actions Navigate to **Reports** to view the various report actions. Note It is not possible to delete a scheduled report. - **(Right click) Run Now** - Run the report and send it to all recipients. - **(Right click) Run Now and Send Only to Me** - Run the report and send it to the current active user. ## Report Operations To manage report operations, follow these steps: 1. Navigate to **Reports**. 1. Double-click on a report to display its details. The **Report Details** window opens under the **Reports** window. 1. **Select Refresh** to refresh the list of reports. 1. **Select Delete** to delete a selected report. Note This option is available only to users with the **System > Reports > Delete** permission. # Using Report Templates Report templates are available to provide built-in reports tailored to the type of user accessing them. For example: - Administrators and users with the **Report Templates Administrator** permission can see all report templates. - Data owners can only see templates that are shared with them. - Non-administrators or non-data owners do not see any report templates. To use File Access Manager’s built-in report templates for standard and customized reports, navigate to **Reports > Report Templates** screen on the File Access Manager website. ## Manage Report Tags You can assign one or more tags per report to help find them later. ### Managing Tags Note This option is available by default to the Administrator capability only. Note System tags cannot be deleted. The **Delete** option (a trash can icon) is disabled for system tags. To manage report tags: 1. Select **Manage Tags** to change or delete report tags. 1. The **Tag Management** screen displays. Available options: - **Hide system-defined tags** (by checking the checkbox) - **Search for tags** - **Edit tags** - **Add customized tags** To edit a non-system tag: 1. Click the **Edit** option (a pencil icon) next to the tag. 1. It is not possible to use a name that already exists or have a blank tag. 1. Click **Save** next to the edited tag to save it. To save all changes, click **Save** at the bottom of the **Manage Tags** screen. ### Filter Reports by Tags The **Filter by Tags** panel on the left can be used to filter relevant report templates. Available options: - **Search field**\ Type in the report tag. Available tags will be filtered as you type.\ Select one of the available tags to filter the report templates displayed. - **Created by me**\ Select this checkbox to filter out your own report templates. ## Run a Report or Create a Scheduled Report To run the report with settings other than the default parameters, select **Duplicate** from the template menu. Set the desired report parameters, scheduling times, and other setup fields. Note When scheduling a report, be aware that time is only reflected in UTC, not local time. 1. Click **Run Now** to run the report immediately. 1. Click **Save** to save the template for future use. # Resource Overview The resource tab allows you to view different governance dimensions on managed resources within applications governed by File Access Manager. All onboarded applications will display within the resource tree on the left panel. Each application will have its own nested resource tree. A resource within an application can be a file share, folder, SharePoint site, database, storage object, etc. Individual files are not represented as "resources" managed by File Access Manager, unless they have unique permissions assigned to them. In this case, they will be represented as individual managed resources. The Resource tab includes the following tabs: - Activities - Permissions - Data - Alerts - Owners # Alerts Tab The Alerts tab allows you to enable or disable already preset alerts. To add or edit alerts for the Resource tab, navigate to **Compliance > Alert Rules**. For more information on how to create or edit alerts, see the Alerts Guide. # Data Tab This tab helps identify the data distribution, the data level of staleness, and the usage frequency all from within a certain resource. Each rectangle represents a contained / nested resource. Usage information is aggregated and presented based on the most recent usage of data within each resource. A heat map will display the resources from a hierarchical point of view. The resources will display in blocks of color based on when the last time they were accessed. The color legend is above the heat map to the right. Note The size of the block indicates the size of the folder. Selecting a block will display the data analysis dialog which provides insight as to what type of content is within that resource block, what type of sensitive information is within the block and who is the owner of the resource block. # Owners Tab The Owners tab provides visibility into the ownership status of the data within a resource. This view shows all the users and owners of a particular resource. The user also has the capability to alter data owners here. With the Usage percentages displayed, File Access Manager provides activity information to help the user make a more informed decision about who owns certain folders within a resource. To fine-tune the data displayed, use the **Usage Statistics** bar to have more refined data. You can adjust the timeframe or the actions performed within the folder. ## Adding Owners to Resources Within the table, a list of the most active users on a resource is displayed. If a user is not selected as an owner, select the **+Add Owner** button to add them. If a user is not listed within the table and needs to be added as an owner to the resource, select **Add New Owner** within the **Current Owners** window and search for them. # Viewing Activities After performing the crawler task, the Activities tab displays all of the aggregated data. Here you are able to view the most and least frequent users, resources, activity types, and can perform various actions. It provides a high-level overview of activity trends and common usages, as well as the most common actions taken on certain resource hierarchies. ## Resource Tree When a resource has been selected from the Resource Tree to the left, all information within that resource will display. A user can search for a resource, like a folder, share, site, or Personal Drive, in the search bar. You can view the information by selecting the **Users**, **Resources**, or **Actions** tabs. - **Users** – displays users that have performed actions - **Resources** – contained resources within this resource - **Actions** – action performed within this resource Note You can display the content by either **Most Frequent usage** or **Least Frequent usage**. ## Viewing Users The three-line menu to the right of each set of users provides a circular way to view the data associated with this high-level resource. When viewing users on a resource, all activities that a particular user has done will display in blue under their name. Select the blue activities link to see what that user has done on the resource. ## Viewing Resources A user can view the child resources nested under the current selected resource. ## Viewing Actions When viewing actions on a resource, you are able to view the most and least frequent actions on a particular resource. Selecting the blue link below the action will display all actions performed and by whom. ## Viewing the Permission Path This function allows the user to view how someone has access to certain resources. To view a permission path, select the user name. The colored legend at the top will provide additional context as to the frequency of usage on that particular permission. Namely, how long it has been since the user has used the permission or had access granted to it. This colored legend helps identify stale and unused permissions that can be removed to reduce risk associated with unnecessary exposure and over-permissive and unused access. The branches leading from the user to the resource will display in a color which corresponds to the legend. Each branch represents an access path through which a user is granted access to the resource. That path can represent a direct permission, access granted through a group, or a nested group membership. Groups can be expanded to show the members and sub-groups nested under them. # Filter Parameters Select either **Most Frequent** or **Least Frequent** to change the order of what is displayed. Select the **Timeframe** dropdown to change the duration of time to alter the displayed results. # Viewing Permissions The Permission tab provides four different views on a resource: - **Simple** — High-level view. Shows who has direct access to what. You can filter the results by the permissions type (menu on the left panel). - **Tree** — Gives the view from a resource perspective on the entire resource. Each user within the resource will have a three-line menu displayed next to their name. - **Overexposed** — Accessible by everyone or a larger part of the organization. The definition for overexposed can be configured through the **Overexposed Resources** section within the **General** tab under **Settings**. There are three different scope or view types: - Unique Permissions or Sensitive Data - Unique Permission only - Sensitive Data only - **Excess** — View users who overlap and have redundant access paths granting similar or excessive permissions to the same resource. ## Editing Permissions File Access Manager supports OOTB and custom fulfillment of removing permissions. An administrator can change the permissions level a user has by selecting **Add Permission** or **Remove Permissions**. Complete the following to edit permissions: 1. Search for the user you are adding permissions for. 1. Provide a reason why they are being granted the permissions. 1. For the **Permission Type**, a user can choose between either **Permission Type** or **Same as Colleague**: - **Permission Type** – Choose between the various action types to give permission. - **Same as Colleague** – Search for a colleague to give the same access as that person. 1. Select **Send Request** to initiate an Access Request on this new permission. # Rest API Overview The REST API service is a service that allows external services to communicate with File Access Manager. ## Supported Protocols - HTTP - HTTPS If the REST API service is installed on a server with a valid TLS certificate (see *Installation guide – “Configuring File Access Manager to Use Local Certificates”*), then the REST API service will bind to that certificate when starting and will use the HTTPS protocol. ## OAuth 2.0 The Client ID is automatically generated during installation (or upgrade). Client parameters are located in the “API Authentication” screen in the File Access Manager website. # API Authentication Screen This screen can be found by navigating to **Settings > General > API Authentication**. On this screen, you can do the following: - Check your Client ID and Client Secret - Generate a new Client Secret **Get Token - Sample Request** `curl -X POST http://[HOST_FQDN]:8011/token -d "grant_type=client_credentials&scope=api&client_id=[CLIENT_ID_URL_ENCODED]&client_secret=[CLIENT_SECRET_URL_ENCODED]` Note Make sure to use the correct URL scheme (http/https) and service port. the default port is 8011. **Get Token - Sample Response** `{ "expires_in":86400.0, "scope":"api", "access_token":"eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6IjZjNTZlMDJlLWJmNTMtNDE1Mi1hZDZmLTI3ZDhhYWVkZGIzNSJ9.eyJhdWQiOlsibHl1K3ZPU3N3Qk1xZkxXbzBhbU9nQT09Il0sImlzcyI6Imh0dHA6Ly9sb2NhbGhvc3Q6ODAxMSIsInNjb3BlIjpbImFwaSJdLCJpYXQiOjE2NzQ2NDA3MjUuMCwiZXhwIjoxNjc0NzI3MTI1LjB9.Qy3zG8Fj4i6aP4H4r5gLLI9DTPaXzFRrhsv3dWoAZlPvSfDT9oJzCMTPJQnz1OR4-CIN2lu8j482fArDwJ9WlkwuGi8aciUzvMrO6-wl90kDvKfiV60GlZFoEVjXebKnkyi1SRF_5l8IJ7VsHFGl91wzhPnVxLZfM8zy82tfWFyu_nXaNq1MGQY3e54KUeVo29rXoARvKGBxrbvSoLmiBthUHU0INzsddb7aaGyf9uPHLninhGouhU9XPB7DVg0zMF6VF67xDMdzV9WA8iw5Duz7c8oSln8pHaj8mEF4AXLBdQtCwLVeOLvaeuHeoThayhZgaOPEOz5n952G8a9Tfg", "refresh_token":"40a5d02f-7570-4659-9e59-97dfbb726ece", "token_type":"Bearer" }` Using the access_token value can make requests to any REST endpoint using “Authorization: Bearer” in the header. **Sample REST endpoint request header parameter** `{"Authorization":"Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6IjZjNTZlMDJlLWJmNTMtNDE1Mi1hZDZmLTI3ZDhhYWVkZGIzNSJ9.eyJhdWQiOlsibHl1K3ZPU3N3Qk1xZkxXbzBhbU9nQT09Il0sImlzcyI6Imh0dHA6Ly9sb2NhbGhvc3Q6ODAxMSIsInNjb3BlIjpbImFwaSJdLCJpYXQiOjE2NzQ2NDA3MjUuMCwiZXhwIjoxNjc0NzI3MTI1LjB9.Qy3zG8Fj4i6aP4H4r5gLLI9DTPaXzFRrhsv3dWoAZlPvSfDT9oJzCMTPJQnz1OR4-CIN2lu8j482fArDwJ9WlkwuGi8aciUzvMrO6-wl90kDvKfiV60GlZFoEVjXebKnkyi1SRF_5l8IJ7VsHFGl91wzhPnVxLZfM8zy82tfWFyu_nXaNq1MGQY3e54KUeVo29rXoARvKGBxrbvSoLmiBthUHU0INzsddb7aaGyf9uPHLninhGouhU9XPB7DVg0zMF6VF67xDMdzV9WA8iw5Duz7c8oSln8pHaj8mEF4AXLBdQtCwLVeOLvaeuHeoThayhZgaOPEOz5n952G8a9Tfg"}` **Refresh Token** The following is a sample to refresh the token: curl -X POST http://\[HOST_FQDN\]:8011/token -d "grant_type=refresh_token&scope=api&client_id=[CLIENT_ID_URL_ENCODED]&client_secret=[CLIENT_SECRET_URL_ENCODED]&refresh_token=[CLIENT_REFRESH_TOKEN_URL_ENCODED]" The token expiration is 24 hours by default. The refresh token expiration is 1,440 hours (60 days) by default. Note This can be changed in the "SailPoint.Fam.Server.RestApiService.dll.config" file. This change will require all the REST API services to be updated and restarted. # Endpoints - POST / Activities The activities endpoint allows an external service to provide File Access Manager with activities for only the following application types: - CIFS - NFS - Linux - AWS S3 - Azure Files Note Since these activities follow the same path as any activity in File Access Manager, they can be enriched with DECs and data classification information. They can also produce alerts. **Sending activities request data sample** ```text [ { "applicationName": "APPLICATION NAME1", "timestamp": "2022-12-18T10:40:58.9839062Z", "userName": "administrator", "objectName": "file_name.txt", "action": "Read", "resource": "\\\\host\\share1\\temp\\foler Name", "userDomain": "acme", "extraProperties": { "ipAddress": "1.2.3.4", "objectNewName": "", "newResource": "", "fileExtension": "txt", "objectType": "File", "oldName": "", "oldResource": "" } }, { "applicationName": "APPLICATION NAME2", "timestamp": "2022-12-18T13:40:58.9839062Z", "userName": "john_doe@acme.com", "objectName": "personal_details.xlsx", "action": "Write", "resource": "\\\\host\\e$\\data", "userDomain": "", "extraProperties": { "fileExtension": "txt", "objectType": "File" } } ] ``` **Mandatory Fields:** - applicationName - timestamp (ISO 8601) - userName - objectName - action - resource **Sending activities response sample** The following is an activities response sample describing one successful activity and one failure: ```text { "successfulActivities": 1, "activityResponses": [ { "activity": { "applicationName": "APPLICATION NAME2", "timestamp": "2022-12-18T13:40:58.9839062Z", "userName": "john_doe@acme.com", "objectName": "personal_details.xlsx", "action": "Write", "resource": "\\\\host\\e$\\data", "userDomain": "", "extraProperties": { "fileExtension": "txt", "objectType": "File" } }, "errorMsgs": [ "Application 'APPLICATION NAME2' not found or isn't supported. Discarding activity." ] } ] } ``` # What is the SCIM API? The File Access Manager SCIM API provides access to the File Access Manager platform. The API is standards-based, built upon the RESTful SCIM 2.0 specification. You can use this API to access File Access Manager API endpoints, which allow you to programmatically interact with objects within the File Access Manager. ## SCIM Protocol SCIM (System for Cross-Domain Identity Management) is an HTTP-based protocol that makes managing identities in multi-domain scenarios easier to support through a standardized RESTful API service. It provides a platform-neutral schema and extension model for representing users, groups, and other resource types in JSON format. We implement SCIM with the following restrictions: ### Filter operators Currently, we only support the "and" logical operator between filter expressions ("or" is not supported). ### Filter special characters If filter expression values include the reserved URL characters `" '$-_.+!*'(),' "`, they need to be changed to their encoded value. ### Sorting Currently, we do not support SCIM Sorting capabilities (SortBy and SortOrder). Each method implements its own sorting by default. ## Getting Started For more information about the SCIM 2.0 specification, as described in SCIM Protocol above: 1. Ensure you have File Access Manager version 8.0 or higher installed. 1. Read the File Access Manager documentation. 1. Participate in the forums. Ask questions, read about requested and upcoming functionality, and assist others. # Authentication SailPoint SCIM API uses the following methods of authentication: ## Basic Authentication Basic Authentication is used to allow access to the API. It is a simple technique for enforcing access controls to API resources because it doesn’t require session IDs, cookies, or login pages but instead uses standard fields in the HTTP header. For more information on Basic authentication, please see [RFC 1945 - Section 11](https://tools.ietf.org/html/rfc1945#section-11) and [RFC 2617](https://www.ietf.org/rfc/rfc2617.txt). Support for Basic Authentication will continue to exist in future releases. Basic Authentication can be used by File Access Manager internal users that have the "API User" role. You can create internal users and grant them the role using the administrative client. ## OAuth 2.0 The Client ID and Client Secret are automatically generated during installation (or upgrade) of versions 6.1 and above. For upgrades from version 6.1 or above, the client ID and client secret will remain the same. You can find the client parameters in the “API Authentication” screen in the File Access Manager website. ## API Authentication screen **Navigation** The screen can be found under **Settings > General > API Authentication**. **General** On this screen you can: - Check your Client ID and Client Secret - Generate a new Client Secret **Get Token - Sample Request** `curl -X POST http://localhost/identityiqfamapi/token -H 'content-type: application/x-www-form-urlencoded' -d 'grant_type=client_credentials&client_id=6779ef20e75817b79602&client_secret=mY5zM5nh7MR8gpj5yG9iIQ%3D%3D'` **Get Token - Sample Response** ```text { "access_token": "gCV2VxetE7vgRxG77pqztGSs-3lWLTJhLG5K3dL7YbtyV6Ys1z0CnTcmv__NwTuOdIcUq4_bM9q2xRPa8I4ab7JW31T6XVZ70eMLdAnOy3tgZpaz3UWTJwfLKEi8pqN6ZcF57kYmSKWrBYOabmY9JrvWtqSLsTBaX9ALWgK2JADHMvpXsbqjkI2MV9xh3nIYKyTX0mW8EOZx9JhtqC3XIQ", "token_type": "bearer", "expires_in": 1199, ".issued": "Thu, 09 Aug 2018 08:00:21 GMT", ".expires": "Thu, 09 Aug 2018 08:20:21 GMT" } ``` Using the access_token value, you can then make requests to any SCIM endpoint using the "Authorization: Bearer" in the header. **Sample SCIM endpoint request header parameter** ```text { "Authorization": "Bearer gCV2VxetE7vgRxG77pqztGSs-3lWLTJhLG5K3dL7YbtyV6Ys1z0CnTcmv__NwTuOdIcUq4_bM9q2xRPa8I4ab7JW31T6XVZ70eMLdAnOy3tgZpaz3UWTJwfLKEi8pqN6ZcF57kYmSKWrBYOabmY9JrvWtqSLsTBaX9ALWgK2JADHMvpXsbqjkI2MV9xh3nIYKyTX0mW8EOZx9JhtqC3XIQ" } ``` ## Supported Protocols - HTTP - HTTPS # Endpoint Details and Usage ## Applications **GET /v2/applications/{id}** - Retrieves the Application by ID. ### Filter Filter is not supported. ### Attributes Returns all attribute values by default. ### Paging Paging is not supported. Returns a specific application. ### Sample Requests `./identityiqfamapi/scim/v2/Applications/2` ## BusinessResources **GET /v2/businessresources** - Retrieves a list of Business Resources according to a given query. The results are sorted by name. ### Filter All attributes to filter by are optional. If no filter is specified, the first 1000 records are returned. #### Supported Filter Attributes - **name** - Can be used to filter by the business resource name.\ **Operators supported**: contains, starts with, and equals\ **Constraints**: Cannot be sent with the fullPath filter attribute. - **fullPath** - Can be used to filter by the business resource full path.\ **Operators supported**: equals\ **Constraints**: Must be sent with the `parentApplicationId` attribute filter. Cannot be sent with the `name` filter attribute. - **parentApplicationId** - Can be used to filter by the business resource application id.\ **Operators supported**: equals\ **Constraints**: Must be sent with `name` or `fullPath` filter attributes. - **isDfs** - Use this filter attribute to get business resources from DFS applications.\ **Operators supported**: equal\ **Valid values**: “false” (default), “true” or "both"\ **Constraints**: Must be sent with `name` or `fullPath` filter attributes. - **owners** - Use this filter attribute to get business resources that have data owners assigned to them.\ **Operators supported**: present (pr) only - **parentResourceId** - If sent, the response will contain only the direct children of the parent resource.\ **Operators supported**: equals\ **Constraints**: Cannot be sent with other filters besides `parentApplicationId`. ### Attributes Returns all attribute values by default except for the `owners` attribute.\ The `owners` attribute value will be returned if it was specifically requested in the `attributes` parameter.\ The `owners` attribute can only be used when the `owners` filter is present in the query. ### Paging - **startIndex** - The 1-based index of the first result in the current set of list results (starts from 1). - **count** - The number of objects returned in a list response per page.\ **Max page size** = 200.\ If no filter is specified, or a filter is sent with the `name` attribute without the `parentApplicationId` attribute, the first 1000 records are returned. Paging parameters are irrelevant in these 2 cases. ### Sample Requests - `/identityiqfamapi/scim/v2/BusinessResources?filter=name co "MyFolderName"` - `/identityiqfamapi/scim/v2/BusinessResources?filter=fullPath eq "\\server\share\folder1" and parentApplicationId eq "2"&count=200&startIndex=1` - `/identityiqfamapi/scim/v2/BusinessResources?filter=owners pr&attributes=owners` - `/identityiqfamapi/scim/v2/BusinessResources?filter=name sw "DFS folder" and isDfs eq "both"` ### Parameters - **filter** [string] (query) - To filter results, use the following syntax: `attributeName operator “value”`. - **attributes** [string] (query) - To retrieve specific attributes values, add the `attributeName` to the `attributes` query part. - **startIndex** [int($int32)] (query) - An integer indicating the 1-based index of the first query result. - **count** [int($int32)] (query) - An integer indicating the desired maximum number of query results per page. ## Capabilities **GET /v2/Capabilities** - Retrieves a list of capabilities, the rights for each capability, and associated users and groups, according to the given query. The results are sorted by capability name. ### Filter The attributes to filter by are optional. If no filter is specified, the list will include all the capabilities. #### Supported Filter Attributes - **capabilityName** - Returns the capability selected.\ **Operators supported**: contains, starts with, and equals. - **rightName** - Returns all capabilities that contain this right.\ **Operators supported**: contains, starts with, and equals. - **userUniqueIdentifier** - Returns capabilities that this user belongs to, either directly, as part of a group, or a nested group, depending on the value of the filter `searchNested`.\ **Operators supported**: equals\ **Format**: The filter must be entered in the form 'domain\\user'. - **searchNested** - Determines how to search for users within the groups.\ **Default value**: False\ **True**: Return capabilities that contain this user as a direct member, or a member through nested groups (e.g., capability A contains Group B -> Group C -> User D).\ **Constraints**: Must be sent with the filter `userUniqueIdentifier`. ### Attributes All attributes are of type "always" and must be returned.\ All attributes are of type "readOnly". ### Paging Paging is not supported. ## DataClassificationCategories **GET /v2/DataClassificationCategories** - Returns a list of categories containing the categories in the File Access Manager database, according to the requesting filter. For each category, it returns the id, name, and description. ### Filter The attributes to filter by are optional. If no filter is specified, all the data classifications are returned. #### Supported Filter Attributes - **categoryName** - Returns the data classification category requested.\ **Operators supported**: contains, starts with, and equal. ### Attributes All attributes are of type "always" and must be returned.\ All attributes are of type "readOnly". ### Paging Paging is not supported. ## DataClassificationResults **GET /v2/DataClassificationResults** - Returns the data classification results for the requested application and path. For each file analyzed, it lists the policy, rule, and categories that triggered the classification. ### Filter The attributes to filter by are optional. If no filter is specified, all the data classification results are returned. #### Supported Filter Attributes - **applicationId** - Return business resources from this application.\ **Operators supported**: equals\ **Constraints**: Must be sent with the filter ‘fullPath’. - **fullPath** - Can be used to filter by the business resource full path.\ **Operators supported**: equals\ **Constraints**: Must be sent with the filter ‘applicationId’. ### Attributes All attributes are of type "always" and must be returned.\ All attributes are of type "readOnly". ### Paging Paging is not supported. ## Groups **GET /v2/groups** ### Parameters - **queryOptions.filter** [string] (query) - To filter results, use the following syntax: `attributeName operator “value”`. - **queryOptions.attributes** [string] (query) - To retrieve specific attributes values, add the `attributeName` to the `attributes` query part. - **queryOptions.startIndex** [int($int32)] (query) - An integer indicating the 1-based index of the first query result. - **queryOptions.count** [int($int32)] (query) - An integer indicating the desired maximum number of query results per page. ## IdentityUsers **GET /v2/identityusers/{id}** - Retrieves a specific IdentityUser, where ID in the request is the ID of the identity. ### Filter Filter is not supported. ### Attributes Returns all attribute values by default. ### Paging Paging is not supported. Returns a specific IdentityUser. ### Sample Requests - `/identityiqfamapi/scim/v2/IdentityUsers/135` **GET /v2/identityusers** - Retrieves a list of IdentityUsers according to a given query. ### Filter #### Supported Filter Attributes - **uniqueIdentifier** - The domain\\username representation of the IdentityUser.\ **Operators supported**: equals. - **ownedResources** - Returns only users that are owners of business resources.\ **Operators supported**: present (pr) only.\ **Constraints**: Cannot be used with the `uniqueIdentifier` attribute. ### Attributes Returns all attribute values by default. ### Paging - **startIndex** - The 1-based index of the first result in the current set of list results (starts from 1). - **count** - The number of objects returned in a list response per page.\ **Max page size** = 200. ### Sample Requests - `/identityiqfamapi/scim/v2/IdentityUsers?filter=uniqueIdentifier eq "domain\username"&count=200&startIndex=1` - `/identityiqfamapi/scim/v2/IdentityUsers?filter=ownedResources pr&count=50&startIndex=2` ### Parameters - **filter** [string] (query) - To filter results, use the following syntax: `attributeName operator “value”`. - **attributes** [string] (query) - To retrieve specific attributes values, add the `attributeName` to the `attributes` query part. - **startIndex** [int($int32)] (query) - An integer indicating the 1-based index of the first query result. - **count** [int($int32)] (query) - An integer indicating the desired maximum number of query results per page. ## PATCH /v2/identityusers/{id} Update specific IdentityUser's owned resources. Should pass the IdentityUser Id in the URL. Returns the updated IdentityUser object. ### Request This is a SCIM Patch request that is based on JSON Patch. The body of each request MUST contain the “schemas” attribute with the URI value of `urn:ietf:params:scim:api:messages:2.0:PatchOp` and the Operations object. The Operations object has 3 parts: “op” for operation, “path” for the attribute, and “value” for the new resources. **Operation - “op”** - **Add** - Adds the new resource to the owned resources list. If the resource already exists, it does not add the resource, but the action is successful. - **Remove** - Removes all resources from the owned resources list. Does not currently support removing specific resources, any value is ignored. - **Replace** - Replacing all owned resources\\specific resource, with given resources as value. The specific resource to be removed can be passed in the filter under "path". If the value is empty, it will remove the specific resource, if given. If not, it removes all resources. **Path - "path"** - Supports “OwnedResources” attribute only, the only writable attribute of the User object. Any other attribute will return an error of unsupported. **Value - "value"** - Must contain the FullPath and ParentApplicationID of the BusinessResource, see example below. ### Sample Request **URL** - /identityiqfamapi/scim/v2/IdentityUsers/135 **Add body:** ```text { "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"], "Operations": [ { "op": "add", "path": "ownedResources", "value": [ { "fullPath": "\\server\\share\\folder1", "parentApplicationId": "1" }, { "fullPath": "\\server\\share\\folder2", "parentApplicationId": "1" } ] } ] } ``` **Remove body:** ```text { "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"], "Operations": [ { "op": "replace", "path": "ownedResources", "value": [ { "fullPath": "\\server\\share\\folder2", "parentApplicationId": "1" }, { "fullPath": "\\server\\share\\folder3", "parentApplicationId": "1" } ] } ] } ``` **Replace body (with filter):** ```text { "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"], "Operations": [ { "op": "replace", "path": "ownedResources[fullPath eq \"\\server\\share\\folder1\" and parentApplicationId eq \"1\"]", "value": [ { "fullPath": "\\server\\share\\folder2", "parentApplicationId": "1" }, { "fullPath": "\\server\\share\\folder3", "parentApplicationId": "1" } ] } ] } ``` ## KPIs **GET /v2/KPIs/** - Returns the values of the KPI requested. The KPI name must be from the valid list below. ### Filter The **name** filter is required. If no filter is specified, or if the name is not in the list of valid KPIs, the API will not return results. - **Supported logical operators**: None - **Supported grouping operators**: None ### Supported filter attributes: - **name**: The name of the KPI to return - **Operators supported**: equals - **Format**: String #### Valid values: - 'Sensitive Resources Missing Owners' - 'Overexposed Sensitive Resources' ### Attributes - **Name**: Name of the KPI - **Count**: The KPI value (for example: The number of sensitive resources without data owners) - **Score**: All attributes are of type "always" and must be returned.\ All attributes are of type "readOnly". ### Paging Paging is not supported. ### Sample Requests ``` /identityiqfamapi/scim/v2/kpis?filter=name eq ``"Overexposed Sensitive Resources" ``` # Endpoints The following are various types of endpoints that can be accessed by the SCIM API. ## Applications An Application is the name of the File Access Manager component that represents the monitored system (such as Microsoft Outlook, Active Directory, and file servers). File Access Manager monitors and analyzes permissions of built-in applications. The **File Access Manager Server Installation Guide** contains a complete list of supported built-in applications. **Endpoint Description:** The API provides information about applications that are configured in File Access Manager. It allows you to retrieve a list of all defined applications (which are configured in File Access Manager) or a specific application. ## Business Resources **Endpoint Description:** The API provides information about business resources of the organization (folders, shares, etc.). It enables searching for business resources by folder name (full or partial) across all defined applications (servers) or in a specific application. You can query Business Resource owners using this Endpoint. This endpoint can be used to build a resource tree, using the `parentResourceId` filter. ### Business Resource Type Mapping One of the returned business resource parameters is **type** (number). The table below describes the types according to the returned type ID: The content of the table may vary according to the application types installed. | **Business Resource Type ID** | **Business Resource Type** | **Business Resource Type ID** | **Business Resource Type** | | ----------------------------- | ------------------------------- | ----------------------------- | ------------------------------ | | 0 | Folder | 1 | Active Directory Computer | | 2 | Active Directory Container | 3 | Active Directory Domain | | 4 | Active Directory Group | 5 | Active Directory OU | | 6 | Active Directory User | 7 | SharePoint Document | | 8 | SharePoint List | 9 | SharePoint List Item | | 10 | SharePoint Site | 11 | Unknown | | 12 | Folder | 13 | SharePoint Web | | 14 | Exchange Folder | 15 | Exchange Mailbox | | 16 | Exchange Public Folder | 18 | UserSAMAccountName | | 24 | Active Directory GPO | 25 | Active Directory GPO Container | | 801 | Windows Cluster Server Name | 908 | Google Folder | | 909 | Google User | 910 | Dropbox Folder | | 911 | Dropbox User | 912 | Box Folder | | 913 | Box User | 914 | Box File | | 950 | SharePoint File | 951 | SharePoint Hidden List | | 952 | SharePoint Hidden Folder | 953 | SharePoint Hidden File | | 1000 | Active Directory Builtin Domain | 1100 | Dfs Namespace | | 1101 | Dfs Link | | | ## Capabilities Capabilities are objects defining access rights within the File Access Manager module. A Capability includes: - Capability name and description - Rights that each capability has - Users and groups associated with each capability **Endpoint Description** The API retrieves a list of capabilities, including the capability description, the rights each capability includes, and associated users and groups. Optional filters include capability, right, and user names. ## DataClassificationCategories Data Classification categories describe the different types of sensitive data which the File Access Manager can identify, according to the data content and context. **Endpoint Description** The API retrieves a list of all File Access Manager Data Classification categories. An optional filter of category enables calling a single category record. ## DataClassificationResults The Data Classification mechanism provides the ability to discover and classify resources and files containing sensitive information, according to configurable rules and policies. **Endpoint Description** For each resource requested, this endpoint returns an object including the file name, policy, rule, and categories that triggered the classification for this file, as well as the number of times a category match was found. This endpoint supports DFS addresses, if the DFS applicationId is requested. ## IdentityUsers Identities are collected from different identity repositories, such as Active Directory, Azure, and NIS. This information is used in Permissions Collection, as well as to analyze users, the relation between users, groups, users’ membership in groups, the structure of groups, and other information. **Endpoint Description** The API provides information about the Identity Users collected by File Access Manager’s Identity Collectors. It allows querying them and changing their business resources’ ownership. ## KPIs **Endpoint Description** The API returns the count and score of KPIs calculated in File Access Manager. This is a read-only endpoint. ## Permissions **Endpoint Description** The API provides information about a user or group’s direct permissions on each business resource. Unlike other objects, the Permission object does not stand on its own and its ID cannot be used as a filter. This means that getting a permission object by ID is not supported (`/Permissions/[identifier]`). The reason there is no ID for a permission lies in the underlying data model of how permissions are stored. Since most application types support an inheritance model, permissions in File Access Manager are stored only for business resources which are uniquely managed. Uniquely managed business resources are either business resources which do not inherit their permissions, or business resources which inherit permissions but add more on top of them. A business resource which fully inherits its permissions without adding to them, only holds a reference to the parent business resource it inherits the permissions from. A single permission is uniquely identified by the following attributes: - identity id (either user or group) - identity type - user or group - business resource id - permission type id - inherited - a single user/group can have the same permission on a business resource, once as an inherited permission and another as a non-inherited explicit permission - allow/deny - a single user/group can have the same permission on a business resource, once as an allow permission and another as a deny permission In some application types, the first four attributes would be enough to uniquely identify a permission. These are application types that do not support an inheritance model and allow/deny permissions, or partially support an inheritance model without allow/deny, such as SharePoint, where a business resource can either inherit its permissions or be uniquely managed, but cannot inherit and add on top of it. # Permissions **GET /v2/permissions** - Retrieves a list of Permissions according to a given query. ## Filter All attributes to filter by are optional, but at least one should be selected. ### Supported filter attributes: - **userUniqueIdentifier**: Supports the equal operator only. Must be in the form of 'domain\\user'. If the domain is empty, must be in the form of 'user' only.\ **Description**: The parameter can be used to specify the user. This is the domain\\user representation in each Identity Collector type: - **Active Directory**: domain is the Netbios name of the domain, user is the samAccountName - **Azure Active Directory**: domain is the fqdn of the Azure AD domain, user is the user upn - **NIS**: domain is empty, user is the user name in the NIS server - **Google Drive**: domain is empty, user is the user email - **Box**: domain is the Box domain, user is the user email - **Dropbox**: domain is the Dropbox Team name, user is the user email - **groupUniqueIdentifier**: The domain\\groupname representation of the identity group.\ **Operators supported**: equal\ **Constraint**: The filter cannot contain both the filters userUniqueIdentifier and groupUniqueIdentifier. - **classificationCategory**: Use this filter attribute to get permissions that have classification categories assigned to their business resource.\ **Supports**: the operators `present` and `equals`. - **fullPath**: Can be used to filter by the permission’s business resource full path.\ **Supports**: the equal operator only. Must be sent with the `applicationId` attribute filter. - **applicationId**: Can be used to filter by the permission’s business resource application id.\ **Supports**: the equal operator only. To query permissions in DFS applications, you must use this attribute with the DFS application id. - **permissionTypeName**: Use this filter attribute to get permissions with a specific permission type (Read, Write, etc.).\ **Supports**: the equals operator only. - **inherited**: Use this filter attribute to get permissions by their inheritance value.\ **Supports**: the equals operator only and the values “false” (default), “true” or "both". ### Attributes Returns all attribute values by default except for the `classificationCategories` attribute of business resource.\ The `classificationCategories` attribute value is returned if it was specifically requested in the attributes parameter. ### Paging - **startIndex**\ The 1-based index of the first result in the current set of list results (starts from 1). - **count**\ The number of objects returned in a list response per page.\ **Max page size** = 200.\ Only the first 100,000 results are returned in pages. If the requested page exceeds 100,000 results, an error of `tooMany` will be returned. Results are ordered by the Id of Groups’ Permissions and then by the Id of Users’ Permissions. ### Sample Requests - `/identityiqfamapi/scim/v2/Permissions?filter=applicationId eq "1"` - `/identityiqfamapi/scim/v2/Permissions?filter=classificationCategory pr` - `/identityiqfamapi/scim/v2/Permissions?filter=fullPath eq "\\server\share\folder1" and applicationId eq "2"&count=200&startIndex=1` - `/identityiqfamapi/scim/v2/Permissions?filter=permissionTypeName eq "Full Control"&attributes=classificationCategories` - `/identityiqfamapi/scim/v2/Permissions?filter=inherited eq "both"` ### Parameters - **filter** [string] (query)\ To filter results, use the following syntax: `attributeName operator` - **attributes** [string] (query)\ To retrieve specific attributes values, add the `attributeName` to the attributes query part. - **startIndex** [int($int32)] (query)\ An integer indicating the 1-based index of the first query result. - **count** [int($int32)] (query)\ An integer indicating the desired maximum number of query results per page. ### DELETE /v2/users/{userId} **GET /v2/users** ### Parameters - **filter** [string] (query)\ To filter results, use the following syntax: `attributeName operator` - **attributes** [string] (query)\ To retrieve specific attributes values, add the `attributeName` to the attributes query part. - **startIndex** [int($int32)] (query)\ An integer indicating the 1-based index of the first query result. - **count** [int($int32)] (query)\ An integer indicating the desired maximum number of query results per page. # Test Connection After the configuration of one of the following applications is complete, verify it was properly configured by running the **Test Connection** task. After running the test connection, you will be able to view the connection status on the **Applications** main page. ## Applications that can run the Test Connection task are: - NetApp - CIFS - Isilon - SharePoint Online - SharePoint - OneDrive # Run a Test Connection To view or run an application's connection status to File Access Manager, go to **Admin > Applications** to view the Applications page. ## For Multiple Applications: 1. To view a list of all the test connection supported applications, select **View Test Connections**. 1. Using the selection boxes to the left of the applications, select the applications that need validation. 1. A single application or multiple applications can be selected. 1. Select **Run Test**. 1. A pop-up message will display saying the connection task has started. To view the result, go to **Test Connection Detailed View**. Up to four different separate tasks are run for the Test Connection task. These tasks are: - The primary test connection task - The permission collection task - The data classification task - The activity monitoring task ## For a Single Application 1. Select the more options button within the Actions column. 1. Select Test Connection. 1. Select Run Test. A user can also select **Refresh a Status**, which refreshes the grid and displays the latest results, or **View Task Status**, which takes a user to the Task screen to view a relevant task. ### Filter Using the filter ability, a user can view all applications that support the Test Connection feature based on their test connection statuses. 1. Select the **Filter** icon. 1. Under the **Test Connection Status** drop-down, select the statuses you want to search for (either **Passed**, **Warning**, or **Failed**). 1. Select **Apply**. 1. The applications with the selected status will display. To clear the filter results, select the **View All** button at the top of the grid. # Test Connection Detailed View To see more detailed information about the status of a specific application, select the **more options** button within the **Actions** column. 1. Select **Test Connection**. 1. A new overlay will display providing further information about the configuration status of the application. ## Task Details - All tasks associated with the application that were run are displayed in the **Check Name** column. - The particular service the task is tied to displays in the **Service Name** column. - The server in which the application is housed displays in the **Server Name** column. - The status of the connection displays in the **Status** column: - **Passed** – The configuration of the application was successful. - **Failed** – The configuration of the application was not successful. A dialog displays providing a reason and/or a suggestion on how to fix the issue. - **Warning** – A pop-up will display with an explanation of the error and a recommendation for solving the issue. If any task fails or has warnings, an information icon displays to the right of the **Status** column. Select the information icon to see the reason for the failure and a recommendation on how to fix it. If any task fails within the application configuration, the whole test connection will fail, which displays on the main **Application** page. ## Available Buttons There are three buttons at the bottom of the overlay that the user can select: - **Run Test** – Runs the test connection task. - **Refresh Status** – Refreshes the grid and displays the latest results. - **View Task Status** – Takes the user to the task screen and displays the relevant task. # Overview The Collector Bulk Installer installs and uninstalls Windows File Server Activity Monitors, Permission Collection, and Data Classification Collectors in an unattended fashion. It simplifies the installation process when many services need to be installed. The installer is run from the command line, and it needs to be supplied with parameters. When installing Windows File Server Activity Monitors, these parameters will be automatically created for you. In other cases, you will need to adjust these parameters manually based on the Windows File Server Activity monitor command. ## Prerequisites Make sure your system fits the descriptions below before starting the installation. 1. File Access Manager requires the ASP.NET Core 8.0.x Hosting Bundle. This bundle consists of .NET Runtime and ASP .NET Core Runtime. 1. When installing a Windows File Server Activity Monitor: - Verify all prerequisites described in "Integrating Windows Server with File Access Manager" were followed. - Install the Visual C++ 2010 redistributable package to ensure the Windows File Sever Activity Monitor works properly. - The Visual C++ 2010 redistributable package can be found in the installation files under Collector\\vcredist_x64.exe. # Command Template CollectorBulkInstaller.exe --log "" --agent-conf-url ":8000" -h "" --system-guid "" --valid-cert-hashes "" -e "ENGINE_NAME" ## Parameters **INSTALL\\UNINSTALL FLAG** - **-i** = installation - **-u** = uninstallation **SERVICE TYPE** - **1** = All (this option is only relevant for uninstall) - **2** = Windows File Server Activity Monitor - **3** = Permission Collector - **4** = Data Classification Collector **log** - The home folder for SailPoint Application logs. Default: **C:\\Program Files\\SailPoint\\Logs** **agent-conf-url** - Fully Qualified Domain Name (FQDN) of the server which hosts the **Agent Configuration Manager Service**. **h** - The home folder for the SailPoint installation. Default: **C:\\Program Files\\SailPoint** **system-guid** - The unique system GUID of this installation. **valid-cert-hashes** - The server certificate hashes that are used to authenticate the **Agent Configuration Manager Service**. **e** - (Optional) Needed only when installing a new collector. Specifies the engine name that this new collector will be attached to. - Alternative name: **-engine-name** - Example: For engine with the service name **"File Access Manager Central Data Classification - [ENGINE_NAME]"**, use the name **"[ENGINE_NAME]"**. **n** - (Optional) Needed only when uninstalling a collector. Specifies the collector service name. - Alternative name: **-collector-name** - Example: For collector with the service name **"File Access Manager Central Data Classification - [ENGINE_NAME] Collector 1"**, use the name **"[ENGINE_NAME] Collector 1"** or the full name **"File Access Manager Central Data Classification - [ENGINE_NAME] Collector 1"**. # Creating the Command Line The command line can be created automatically when creating a new Windows File Server application. It must be manually adjusted for other needs (either installing or uninstalling). ## Creating a Command Line Automatically When installing an Activity Monitor, a user can create a command line automatically by following these steps: 1. From the File Access Manager business website, navigate to **Admin > Applications** and locate a **Windows File Server** application. 1. Under the **Actions** column, select on the ellipsis icon (`...`). 1. Next, select **Download Installation File**. The file containing the installation command will be downloaded. ## Creating a Command Line for Other Cases It is not possible to automatically generate the command line for other cases. You will need to manually adjust it based on the Windows File Server application command. ### Uninstall All The installer has the ability to uninstall the collectors without specifying a specific collector. This option will uninstall all the Data Classification collectors, Permission Collection collectors, and Windows File Server activity monitors only. This option is useful when you want to decommission a server with collectors. The advantage is that the command is identical for all servers. ## Command Examples ### Windows File Server Activity Monitor **Installation** CollectorBulkInstaller.exe -i 2 --log "C:\\Program Files\\SailPoint\\Logs" --agent-conf-url ":8000" -h "C:\\Program Files\\SailPoint" --system-guid "" --valid-cert-hashes "" **Uninstallation** CollectorBulkInstaller.exe -u 2 --log "C:\\Program Files\\SailPoint\\Logs" --agent-conf-url ":8000" -h "C:\\Program Files\\SailPoint" --system-guid "" --valid-cert-hashes "" ### Permissions Collector **Installation** CollectorBulkInstaller.exe -i 3 --log "C:\\Program Files\\SailPoint\\Logs" --agent-conf-url ":8000" -h "C:\\Program Files\\SailPoint" --system-guid "" --valid-cert-hashes "" -e “” **Uninstallation** CollectorBulkInstaller.exe -u 3 --log "C:\\Program Files\\SailPoint\\Logs" --agent-conf-url ":8000" -h "C:\\Program Files\\SailPoint" --system-guid "" --valid-cert-hashes "" -n “” ### Data Classification **Installation** CollectorBulkInstaller.exe -i 4 --log "C:\\Program Files\\SailPoint\\Logs" --agent-conf-url ":8000" -h "C:\\Program Files\\SailPoint" --system-guid "" --valid-cert-hashes "" -e “” **Uninstallation** CollectorBulkInstaller.exe -u 4 --log "C:\\Program Files\\SailPoint\\Logs" --agent-conf-url ":8000" -h "C:\\Program Files\\SailPoint" --system-guid "" --valid-cert-hashes "" -n “” ### Uninstall All CollectorBulkInstaller.exe -u 1 --log "C:\\Program Files\\SailPoint\\Logs" --agent-conf-url ":8000" -h "C:\\Program Files\\SailPoint" --system-guid "" --valid-cert-hashes "" # Exit Codes The `CollectorBulkInstaller.exe` will return a specific exit code for success or failure. The following is a list of exit codes available: - Success = 0 - Failure = 1 - Canceled = 2 - RestartPending = 3 - Fatal = 4 - DotnetCoreNotInstalled = 5 - EngineNotFound = 6 - CollectorNotFound = 7 - InvalidCollectorTypeSpecified = 8 # Usage Perform the following steps to complete the installation process: 1. Copy the distribution file, `CollectorBulkInstaller.exe`, to an installation folder on each server. 1. Create the command line that will be used to run `CollectorBulkInstaller`.exe. See Create Command Line for further instruction. 1. Run the command line from the directory which contains `CollectorBulkInstaller.exe`. # Planning Your Upgrade Caution File Access Manager version 8.5 can only be upgraded from version 8.4 SP5 and above. Before the upgrade, **back up the database**. **Upgrade Path** - File Access Manager version 8.5 can be upgraded from version 8.4 SP5 and above only. - For earlier versions of File Access Manager, or SecurityIQ, first upgrade to File Access Manager 8.4 SP5 before starting the 8.5 upgrade process. Note Please read this upgrade guide in its entirety before starting the upgrade process. **Version Numbers** - The version number is displayed on the bottom right corner of the File Access Manager Administrative Client screen. - If the version number is not displayed in the Administrative Client, refer to the SecurityIQ 5.1 Upgrade guide to upgrade from an older version. ## Installation Prerequisites The following provides server support information: | **System** | **Supported Versions** | | --------------------------- | -------------------------------- | | File Access Manager Servers | Windows 2016 / 2019 / 2022 | | Workstation | Windows 7 and above | | Browser | Edge, Safari, Chrome, Firefox | | Database | MS SQL Server 2017 / 2019 / 2022 | # Post Upgrade Actions Following the upgrade, follow the configuration steps below. ## Upgrading the File Access Manager Server Installer The Server Installer must be upgraded on each of the File Access Manager central servers. To upgrade the Server Installer on each central server, perform the following steps: 1. Copy `ServerInstaller.msi` from the “v8.5 Full Installers” folder to the server. 1. Run `ServerInstaller.msi`. 1. Follow the instructions on the screen to complete the upgrade process. Note The server installer can be run in **“unattended mode”** by using the following command: ```bash start /wait msiexec /i "[INSTALLER_PATH]\ServerInstaller.msi" /l*v "C:\FAMInstaller.log" /quiet /norestart ``` ## Upgrading File Access Manager Client On the first run of the File Access Manager Administrative Client after an upgrade, a popup message displays, requesting that you upgrade the client. During the upgrade, you will be required to: - Re-enter the server on which the User Interface Service is installed. - Choose the installation folder. ## File Access Manager UI Upgrade (IISReset Needed) Due to recent UI changes and to avoid any cache conflicts, run an iisreset command as an Administrator using either PowerShell or Command Prompt window (this can also be made using the IIS administration window): - `iisreset /restart` ## Validate the Service Pack Update To validate the installation and verify that the correct version was installed, check in the Windows Add/Remove programs in the control panel. The versions of the IdentityIQ File Access Manager components should be set to 8.5.0.5000 The IdentityIQ File Access Manager Database version should be set to 8.5.0.5000 ## Uninstall .Net Core 3.1 Note This is optional. After you have completed the installation, you optionally can uninstall .NET Core 3.1. 1. Navigate to the **Control Panel > Programs > Uninstall a program**. 1. Locate the corresponding .NET Core 3.1.x program. 1. Right-click > **Uninstall**. # Pre-upgrade Steps Before the upgrade, back up the database. All of the following should be installed prior to the upgrade. ## RabbitMQ RabbitMQ is now a mandatory service, therefore RabbitMQ must be installed using the 8.4.x installer prior to the 8.5 upgrade. Without installing RabbitMQ, the upgrade process will not be completed. Note In case File Access Manager is installed on both Production and Disaster Recovery servers, RabbitMQ must be installed on both servers prior to the upgrade process. ## .NET 8.0 File Access Manager requires the latest \*ASP.NET Core 8.0.x Hosting Bundle. This bundle consists of .NET Runtime and ASP .NET Core Runtime. .NET 8.0 must be installed before the upgrade. You can download the latest 8.0.x Hosting Bundle version from [here](https://dotnet.microsoft.com/en-us/download/dotnet/8.0). Caution Without completing this step, the upgrade will fail. All servers hosting File Access Manager services, including all Activity Monitors, must have .NET Core 8.0.x installed as a prerequisite for the upgrade. The Administrative Client computer must contain .NET Framework 4.7.2. The User Interface service server must contain .NET Framework 4.7.2. .NET 8 and .NET Framework 4.7.2 can be installed on the same server. ### Verifying .NET Settings Complete the following steps to verify the version of .NET: 1. Open a CMD window. 1. Execute the following command: ```bash dotnet --list-runtimes ``` 1. The output should consist of at least the following: ```text Microsoft.AspNetCore.App 8.0.x Microsoft.NETCore.App 8.0.x ``` If the command did not execute or the two runtimes mentioned above are not in the output list, reinstall or repair the hosting bundle. ## Install File Access Manager 8.5 Prerequisites File Access Manager 8.5 requires the Prerequisites Tool to be executed prior to the actual installation (regardless of whether they were applied previously on any 8.4 Service Pack at all). Those prerequisites are required to renew Code Signing certificate that FAM uses and to update DB settings specific to this version/year. The tool is included along with the Installation files and only needs to be executed: Note Make sure to provide DBA credentials for the prerequisites to work properly. Note Make sure to *only* use the included Prerequisites Tool for version 8.5. Do not mix prerequisites from other File Access Manager versions. ## Elasticsearch 8.2.2 File Access Manager 8.5 requires Elasticsearch version 8.2.2 to be installed prior to the upgrade procedure. Without installing Elasticsearch, the upgrade operation will not be completed. If File Access Manager is deployed in Production and Disaster Recovery mode, install the new Elasticsearch in both the Production environment and Disaster Recovery environment. Caution New Elasticsearch cannot be installed on a server which contains an already existing Elasticsearch installation. It must be on a server without an Elasticsearch installation. Note If a user is upgrading to File Access Manager 8.5 from an older version, the user must keep the legacy Elasticsearch running in order to avoid loading failures. To Install New Elasticsearch 8.2.2, perform the following steps: 1. Copy `ServerInstaller.msi` from the File Access Manager 8.5 installation package into the new File Access Manager server and perform the installation. 1. Open the server installer as an administrator and choose the **Use Existing File Access Manager Database** option. 1. Insert valid database information and select **Next**. 1. Select **Create/Edit Installation Configuration** and select **Next**. 1. In the General Configuration screen, insert the new File Access Manager server(s) that will be used to install the new Elasticsearch and select **Next** to continue. Note If File Access Manager is installed in Production and Disaster Recovery, make sure to insert both Production and Disaster Recovery server addresses. Without inserting them both, you will not be able to proceed into the next step and you will get the following error message. 1. Choose the server that the new Elasticsearch will be installed on and insert the database path. Note The database path is generated during the installation. Make sure that the path is valid. 1. Choose the **Save Configuration and Perform current Server's Installation Tasks** button and select **Next**. The installation process will begin. 1. Once the installation process is completed, close the Server Installer Wizard. # Troubleshooting Check the issues below for common problems and suggested ways of handling them. ## Signature is Not Valid Error **Problem:** During the package upgrade step, you receive a warning with the message: Loading the package failed due to the following error: Signature is not valid. The problem is likely that the machine hosting the User Interface service does not have the necessary Root Certificate (or is missing part of the Certification Chains leading up to the root) to validate the signature of the upgrade package. **Suggested solution:** To resolve the issue you should check that the machine hosting the User Interface service contains the root certificate named "DigiCert Assured ID Root CA," which has a serial # 0C:E7:E0:E5:17:D8:46:FE:8F:E5:60:FC:1B:F0:30:39. If this root certificate is missing, it can be downloaded from and installed as a trusted root certificate manually. Another reason for this error would be that the machine hosting the User Interface service has been configured so that updating root certificates is disabled. To fix this, set the registry value HKEY_LOCAL MACHINE\\SOFTWARE\\Policies\\Microsoft\\SystemCertificates\\AuthRoot\\DisableRootAutoUpdate to 0, and retry uploading the upgrade package. This will allow Microsoft to restore the missing root certificate during validation. ## Watchdog Failed During the Upgrade **Problem:** During the File Access Manager V8.5 upgrade, the watchdog upgrade failed, and the upgrade operation has been suspended. To check the error: 1. Right-click the failed row and select **Save Log File**. 1. Open the saved log file. The error may indicate that .NET 8.0 is not installed on the File Access Manager server. **Suggested Solution:** Perform the .NET 8.0 installation as described in the [Pre-upgrade](https://documentation.sailpoint.com/fam/help/upgrade/preupgrade.html) steps section, then rerun the failed upgrade step. ## Elasticsearch Prerequisite Script Failed **Problem:** The pre-requisite script (Elasticsearch Upgrade) failed and the upgrade operation has been suspended. To check the error, perform the following steps: 1. Right-click the failed row and select Save Log File. 1. Open the saved log file. The error indicates that Elasticsearch was not installed prior to the upgrade operation. **Suggested solution:** Perform the Elasticsearch 8.2.2 install in the [Pre-upgrade](https://documentation.sailpoint.com/fam/help/upgrade/preupgrade.html) steps and rerun the failed script. ## Verify RabbitMQ Service Install Prerequisite Script Failed **Problem:** The script failed and the upgrade operation has been suspended. To check the error, perform the following steps: 1. Right-click the failed row and select Save Log File. 1. Open the saved log file. The error indicates File Access Manager RabbitMQ service is not installed. **Suggested solution:** Perform the RabbitMQ install in the [Pre-upgrade](https://documentation.sailpoint.com/fam/help/upgrade/preupgrade.html) steps and rerun the failed script. ## Installing Elasticsearch Prior to RabbitMQ Install **Problem:** Installing Elasticsearch prior to installing RabbitMQ will show the following error inside the Server Installer: **Suggested solution:** Perform the RabbitMQ install in the [Pre-upgrade](https://documentation.sailpoint.com/fam/help/upgrade/preupgrade.html) steps After the install of RabbitMQ, install the new Elasticsearch DB. # Upgrading to Version 8.5 Caution File Access Manager version 8.5 can only be upgraded from version 8.4 and above. Before the upgrade, backup the database. 1. Extract the “File Access Manager v8.5.zip” installation package. 1. Navigate to the folder **v8.5 Upgrade**. 1. Open the File Access Manager Administrative Client. 1. Navigate to **Upgrades & Patches > Load New Package**. 1. Load "File Access Manager v8.5.wbxpkg" from the upgrade folder. 1. Select **Browse** and load the file from the upgrade folder. 1. Select **Upload Package**. 1. Select **Save**. 1. Right-select the upgrade package and select **See More > Start Installation**. 1. Select **Confirm** to start the installation. Note In case of failure, right-select the failed script and select **"save log file."** Note If the package has already been uploaded into File Access Manager, the system will give a warning message and block uploading the package again. ## Verification During the Upgrade Process During the upgrade process, services are upgraded. Some servers may require a restart to complete the upgrade. 1. When the upgrade starts, you will see a window with the total number of services that need to be upgraded on the top left side of the upgrade window. 1. When you select **Refresh**, you can see the number of upgraded services and the remaining services to be upgraded. 1. Select **Refresh** until you see that there are no services left to upgrade. Note Some services, such as WebSite and FamAPI, might require a restart of the server they are running on, in order to complete the upgrade process. To check which services require a server restart, complete the following: 1. Select the **Status** pane in the Services grid. 1. If a service has the status “Pending Restart”, perform a server restart in order to complete the upgrade process for this specific service. The installed server is listed in the table. Once the server is restarted, the upgrade operation will be able to proceed. 1. Once all the services have been upgraded successfully, with a status of “Finished”, you can proceed to the next step. Note The Summary number may vary across installations, depending on the specific configuration, such as the number of Permission Collector services, or other configuration changes.