cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Shawn_Sabbini
Deckhand III

Automating FAM Permissions Forensics Report Generation

The usual way to run a FAM permissions forensics report is to open the web UI, specify the filters, click Apply, and wait for the results to be displayed in the web UI. This might take seconds to minutes. Then, to send this data to an Excel file, click Global Options and Generate Report. Sometime later, the report will be available for download in the reports tab.

We are considering a new workflow that will involve generating hundreds of these Excel reports. This manual process requires too much hands-on interaction. Some reports individually take several minutes to generate in the Web UI.

Is there a way we could script report generation? Can we script something that would send requests to the API to generate the reports we want? It would be acceptable if we have to manually download them from the reports tab.

We have thousands of variations for these reports, so creating report templates would be difficult to manage given the current web UI. However, we might figure out a creative solution if it is possible to script a "run now" command to a report template.

0 Kudos
Reply
2 Replies
ranjith_koppu
SailPoint Employee
SailPoint Employee

Hello @Shawn_Sabbini 

To automate the process of generating reports, you can utilize "data sources" in FAM.

While running the report through the forensics would require you to setup necessary filters and generate a report out of it, to setup a data source you would need to,

1. Create a data source based on a SQL query

2. Test the data source to make sure the query is generating the required data.

3. Save the data source.

4. Schedule the data source to generate a report.

Note: You can create as many data sources as you need.

Shawn_Sabbini
Deckhand III

After we scan a file server with FAM, we want to run reports on various folders using values from a CSV. For that given server, we would run a series of reports where only the value of one filter is changing: the Business Resource Full Path for one style of reporting, and the value of the Resource filter for another.

The problem we have is that doing this manually takes some amount of time, from a few seconds to a handful of minutes per report generation. We have hundreds of reports to run per server, and hundreds of servers. We will repeat this reporting every quarter. The hands-on time requirement is substantial. This doesn't make for any sort of exciting job anyone wants to do. This is a perfect situation calling for automation.

It is easy to imagine using a script to issue POST commands to the FAM SIQAPI, similar to what the web page uses when you click on Generate Report.

It would be much easier and, it seems to me, more logical to script interaction with the API than it would be to write as many data sources as we might need.

Is there any documentation on making the necessary calls to SIQAPI? Even less formal notes discussing only generating our two variations of permissions reports would satisfy our need. The benefit is that this is easy to maintain and will conform to all FAM business logic for report generation, even as the product is updated. SQL scripts would require deeper testing and maintenance with every patch or version increment.

Thank you.

0 Kudos
Reply