Functionality

Admins are able to add Applications to match identities across the established System of Record. Applications in SecurEnds reflect the applications within the organization, usually being a mirror image. You can connect your Application to SecurEnds via a CSV file, Flex Connector, or Pre-built Connector.

Applications within SecurEnds can show credentials and/or entitlements in list view, with ability to export. Application data plugs in with Identity Mindmap allowing tracking of identities across multiple applications. Upon setting up an application within SecurEnds, you are prompted to choose your desired ticketing method. The desired ticketing output is application specific or can be universally configured.

Interpreting Application Data within SecurEnds

This is a view of the landing page under the Applications tab. When creating a new application, all users will fall into one of six buckets designating status of user information. All numbers present under the headers can be clicked into for list view. Report is exportable. Notice the outlined column headers below:

• Skipped: Two reasons why a user is “skipped”
  • User is missing required information
  • Duplicate user/entitlement/credential
• Matched: The ideal bucket
  • Shows a user’s unique identifier (email, user ID, etc.) in the application has matched with the same identifier in the SOR.
• UnMatched: Means the application user data is in SecurEnds, but no match found within SOR
  • Reasons for UnMatched:
    • User has different unique identifier in SOR
    • User is not in SOR
    • Service Accounts
• Service Accounts: Service Accounts are housed within an application and rarely present in an HRIS system or chosen SOR.
  • Initially housed in the UnMatched user bucket, these accounts can be moved via the UI or Bulk Assign features to the Service Accounts bucket.
  • This allows the service accounts to be included in campaigns without having to be matched to a user within the SOR.

• Excluded: Destination for users which will be left out of access reviews and associated campaigns
  • Exclude users by clicking into “Matched” users pool and clicking “Action” > “Exclude”
  • Can restore “Excluded” users to normal status
• Deleted: Similar function to Excluded
  • Deleted users are left out of access reviews and associated campaigns
  • Can be restored to normal status
• Purged: Acts as a historical record of access changes within your application
  • Users who have had accesses revoked during a review will fall into this bucket
  • System detects access changes when resyncing post review and “purges” users within SecurEnds who have had their access revoked. This allows admins to determine best course of action for purged users

When you export the application data (Gear icon->More->Export), SecurEnds will export the data to a CSV format and will have mapped the data to SecurEnds attributes. Below is the mapping detail

• Employee First Name – First Name
• Employee Middle Name – Middle Name
• Employee Last Name – Last Name
• Employee Email ID – Email
• Credential – Distinguished Name (Common Name will be a copy of Distinguished Name data)
• Manager Email ID – SOR Manager Email
• Employee Access Status – Access Status
• Employee ID – User Id
• Last Authentication Date – Last Authentication
• Role/Group/Permission – Entitlement DN (Entitlement CN will be a copy of Entitlement DN data)
• Role/Group/Permission Description – Entitlement Description
• Role Created Date – Entitlement Created Date
• Login Created Date – Credential Created Date

Note: If there are Purged Credentials or Purged entitlements as a result of the most recent sync of teh application. Those are still present in the exported CSV data and will be denoted by a P within the Status and Entitlement Status attributes. You will want to exclude these from the CSV if you are just looking at data synced by from the applications. Status codes of E (Excluded) and D (Deleted) are valid records from your application, the SecurEnds Admin has simply chosen to classify these records respectively through an earlier action.

For more information regarding adding Applications via CSV file upload, click here

For more information regarding adding Application via Connector, click here.

The post Application Basics appeared first on SecurEnds.

• Navigate to Applications on the left navigation panel.
• Select Add

1. Select the Data Ingestion as File Upload and provide the following Setup Information
2. Enter the Name of the Application
3. Select Match By logic as Default(Email or FirstName and LastName) or Employee ID
   • If selecting Default(Email or FirstName and LastName), SecurEnds will match users from the application with the provided Email to the System of Record. If the email does not make a match, then SecurEnds can make recommendations via Fuzzy Logic
   • If selecting Employee ID, SecurEnds will match users from the application with the provided Employee ID to the System of Record
4. Select Yes or No for Include Inactive Users
   • If selecting Yes, all the Active status users along with Disabled status users will be added in the Matched users
   • If selecting No, then only Active user will be added to the Matched users
5. Select Yes or No for Include Entitlements
   • Select Yes to load the entitlements on application while syncing
   • Select No not to load the entitlements on application while syncing

1. Select Yes or No for Create Ticket
   • If you do want a ticket generated select Yes
   • If you do not want a ticket generated select No
2. If Yes is selected for ticket generation then include the following information:
   • If you would like to default to the Global Configuration of ticket setup then check the box next to Global Configuration
   • Select the Action as Jira, ServiceNow, TrackIT, Zendesk, Ivanti, or Email
   • Enter information on the user that should be assigned the ticket when generated
   • If you would like to exclude approved actions from the ticket, then check the “Do not display approved elections within generated Ticket/Email”
3. Select Save

• Begin importing your file by selecting Import while hovering over the actions box next to the name of the application

• Drop or upload your file within the window
• Confirm the file was successfully imported
• Select Next

• Under Matching Identifier select the unique identifier you are utilizing to match with the System of Record
• Next, review the column headers under the SecurEnds Properties and begin matching the column headers from the drop downs to match with the columns in the imported file.
  • Make note of the required columns marked with a red star
• Review the validation criteria to confirm that the file passed all requirements
  • File Validations can be seen with Status and Comments
  • For any “Fails”, please revisit your file to make corrections before uploading the file again
• Select Import

• Upon selecting Import you should receive a Success screen
• Please review the record counts
• If any records were skipped, then you can select the number shown and export a CSV file containing information on the reason for the skipped record

The post Set up Application appeared first on SecurEnds.

When you sync an application, SecurEnds attempts to match the credentials from the application data to an identity in the People data (coming from your SOR). Matching happens either by first and last name, email address or employee ID. Once the application sync completes, you will have matched credentials and you may have some unmatched credentials.

Go to an application, select the Unmatched number for the application. Then for each unmatched user, you can go to the action gear icon and select Match or Assign.

• Use the Match option when you need SecurEnds to help find possible matches for you to choose from. You will need the credential to also have a name or email address for the Fuzzy Match logic to return options.
• Use Assign option when you know the name or email address of what the unmatched user should be assign to.

In some cases, you could have many unmatched credentials, so assigning to an identity in the People data for each credential, one at a time, can be time consuming. A Bulk Assign option, is available for each application, allows you to assign any number of Unmatched credentials to an email address of your choice. This email address must exist in the People data.

Bulk Assign action

1. From the Users->Application view, select the Action Gear icon next to the application you want to bulk assign service accounts
2. Use the option More->Bulk Assign

3. Select the Unmatched radio button and Download a CSV file of the list of unmatched accounts for the application.
   
4. In the downloaded file, there is only one column you will need to focus on for assigning, column H which is labeled IAM
   • Add the email address of the identity you want the unmatched credential to be assigned to.
   • Save the file
   • Note: You do not have to do all records in the CSV. Simply leave the records as they are or remove if you are unsure.

3. Navigate back to the Bulk Assign window from step 1 above and either drag your newly saved file to the blue container in step 2 above or click on the blue container and select your newly created file from the file explorer window.
4. Select Bulk Upload to move the unmatched credentials to the Matched category.

The post Unmatched Credentials in Applications appeared first on SecurEnds.

Below are two ways to move an unmatched record to the Service Account category. Note: Only unmatched records can be assigned as Service Accounts. If you have Service Accounts “matched” to another credential, you will need to “unmatch” them first.

Option 1: UI Process

1. Click on the Unmatched number from the application view
2. Utilize the Check box to the far left of the credential to select it as a Service Account. Once they have been selected or checked, select the blue Service Account button on the top. A popup will appear as a confirmation. Select Yes to confirm.
3. Once moved to the Service Account category, a reviewer will need to be assigned for the Service Account.
   • Navigate to the Service Account Category by either going back to the Application page and selecting the count of Service Accounts for the particular application or from the image shown above in 2., change the Status drop-down to Service Account.
   • Once viewing a list of the Service Accounts, select the Action Gear icon next to one of the accounts and select Assign a Reviewer
   • Enter the name or email of the reviewer in the window and select Update. The reviewer must be an Active user within the People data of SecurEnds.

Option 2: Bulk Assign Process

In some cases, you could have many service accounts, so assigning a reviewer to each service account, one at a time, can be time consuming. The Bulk Assign option that, is available for each application, allows you to assign any number of Unmatched credentials as a Service Account AND assign a reviewer to the Service Account. As noted before, if you have already “matched” a Service account to another credential, you will need to unmatched that service account first in order for it to be a part of the unmatched list of credentials.

1. From the Users->Application view, select the Action Gear icon next to the application you want to bulk assign service accounts
2. Select the Unmatched radio button and download a CSV file of the list of unmatched accounts for the application.
   
3. In the downloaded file, there are two columns associated with Service Accounts – Service Account and Service Account’s Reviewer
   • Service Account column needs Yes
   • Service Account’s Reviewer column will be the email address of the person who will be reviewing the Service Account credential. As noted before, the email address will need to be an Active user in the SecurEnds People data.
   • Save the file
   • Note: For the other non-service account records, you can leave alone and leave in the file
4. Navigate back to the Bulk Assign window from step 1 above and either drag your newly saved file to the blue container in step 2 above or click on the blue container and select your newly created file from the file explorer window.
5. Select Bulk Upload to move the unmatched credentials to the Service Account category.
   

Service Accounts within Campaigns

Service Accounts are visible in all campaign types and are denoted with the words ‘Service Account()’ within the campaign user view to differentiate these accounts from other user accounts.

The post Service Accounts appeared first on SecurEnds.