What Changed

SailPoint IdentityNow v3.0.1 introduces a new Codeless Connector Framework (CCF) data connector alongside the existing Function App connector. This enables ingestion via the modern DCR-based approach while maintaining backward compatibility for existing deployments.

Data Connector Enhancement

New CCF Implementation:

  • Ingests to SailPointIDN_EventsV2_CL table using clean column schema
  • Supports OAuth2 client credentials authentication
  • Enables multi-tenant monitoring (production/demo/partner environments)
  • Provides API endpoint configuration: https://{tenantId}.api.{domain}/v2025/search/events

Dual Parser Strategy:

  • SailPointIDN_EventsV2: Uses new clean column names for CCF data
  • SailPointIDN_Events: Alias parser providing backward compatibility with legacy suffixed columns

Detection Logic Updates

All 5 Analytic Rules updated to support both connectors:

  • Data Sources: Now reference both SailPointIdentityNow (legacy) and SailPointIdentityNowConnector (CCF) via parser alias SailPointIDN_Events
  • Field Mapping: Migrated from suffixed columns (type_s, status_s, technicalName_s) to clean names (EventType, Status, TechnicalName)
  • Version Bump: Rules updated from v1.0.0 to v1.1.0

MITRE Mapping

  • T1133 (External Remote Services): Monitors failed authentication and access provisioning events

Security Impact

This upgrade provides dual ingestion paths for identity governance events. Organizations can deploy the CCF connector for new installations while existing Function App deployments continue operating without disruption. The parser alias ensures detection continuity across both deployment models.

Affected Files

.script/tests/KqlvalidationsTests/SkipValidationsTemplates.json
.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json
Solutions/SailPointIdentityNow/Analytic Rules/SailPointIdentityNowEventType.yaml
Solutions/SailPointIdentityNow/Analytic Rules/SailPointIdentityNowEventTypeTechnicalName.yaml
Solutions/SailPointIdentityNow/Analytic Rules/SailPointIdentityNowFailedEvents.yaml
Solutions/SailPointIdentityNow/Analytic Rules/SailPointIdentityNowFailedEventsBasedOnTime.yaml
Solutions/SailPointIdentityNow/Analytic Rules/SailPointIdentityNowUserWithFailedEvents.yaml
Solutions/SailPointIdentityNow/Data Connectors/SearchEvent_CCF/SailPointIdentityNow_ConnectorDefinition.json
Solutions/SailPointIdentityNow/Data Connectors/SearchEvent_CCF/SailPointIdentityNow_DCR.json
Solutions/SailPointIdentityNow/Data Connectors/SearchEvent_CCF/SailPointIdentityNow_PollerConfig.json
Solutions/SailPointIdentityNow/Data Connectors/SearchEvent_CCF/table_SailPointIDN_EventsV2.json
Solutions/SailPointIdentityNow/Package/testParameters.json
Solutions/SailPointIdentityNow/Parsers/parser_SailPointIDN_EventsAliasFunction.json
(packaging artefacts: 3.0.1.zip, ReleaseNotes.md, Solution_SailpointIdentityNow.json, createUiDefinition.json, mainTemplate.json)