Activity Data Source Configuration

Use the Activity Data Source Configuration page to add or edit activity data sources. Activity collectors access activity data sources such as event or audit logs, collect the activity information that is to be monitored, and transform that data into a format that can be read by IdentityIQ. These Activity Data Sources are use for all activity aggregation and reporting.

Changes made on this page are not committed until a save is performed on the application with which they are associated. For example, if you add or delete a data source on this page and click Save, you do not see that change reflected on the application until you click Save on the application page and commit the change.

For each activity data source enter or edit the following:

• The general data source information in Activity Data Source Configuration.

• Activity target information found on the Activity Target tab for each source type, see Activity Targets.

• The unique connection and query setting for each activity data source type.

  • JDBC Collector Settings

  • Windows Event Log Collector Settings

  • Log File Collector Settings

  • RACF Audit Log Collector

  • CEF Log File

Activity Data Source Fields

Name

A short, descriptive name for the activity data source.

Description

A brief description of the activity data source.

Transformation Rule

The transformation rule required to convert the data collected from the data source into a format that can be used by IdentityIQ.

Note: Click the [...] icon to launch the Rule Editor to make changes to your rules if needed.

Correlation Rule

The correlation rule that should be used to correlate the activity data collected with identities.

Note: Click the [...] icon to launch the Rule Editor to make changes to your rules if needed.

Activity Data Source Type

The type of data source from which the activity is being collected.
The Activity Data Source Type dropdown list contains the types of data source from which activity information can be collected. This list will grow and change to meet the needs of IdentityIQ users.

Note: When CEF Log File is selected from the dropdown list, the Transformation Rule and Correlation Rule fields are displayed with the following respective values:
- Transformation Rule: CEFTransformRule
- Correlation Rule: CEFActivityCorrelation

Activity Targets

The Activity Targets tab is used to specify targets within this data source for use in activity searches. A target is a specific object within a data source that is acted upon. For example, a target might be a machine name for a login action, or a file name for a create action.

The targets specified here are used to populate lists on the Activity Search page. These targets can be grouped with targets specified on other applications to create categories of targets. For example, if you have inventory applications at three different locations and a procurement database on each, you can set each procurement database as a target, create a Procurement category, and then collect activity for all three procurement databases using a single activity search.

On the Activity Targets tab you can add activity targets for the data source with which you are working. Type the name of the activity target in the field at the bottom of the list and click Add Activity Target. To remove activity targets, use the selection boxes on the left of the table and click Delete.