Starling Identity Analytics & Risk Intelligence allows administrators and verifiers the ability to review entitlement verification requests for the high risk users within their data sources. Verification does not automatically alter your data source to correspond with the decisions recorded for a user within Starling Identity Analytics & Risk Intelligence. Instead, the verification feature is a way for you to easily understand, make, and track decisions regarding user access.
For example, Starling Identity Analytics & Risk Intelligence alerts you to there being a new high risk user due to an account being granted the ability to create groups within Active Roles. This capability is outside the normal responsibilities for this account, so you request that a verifier (other than yourself) take a second look at the appropriateness of this access (see Requesting verification). That verifier can then either approve it as being acceptable or they can mark it as being unacceptable (see Verifying high risk entitlement requests). Once a response has been received, you will have a record of the request within Starling Identity Analytics & Risk Intelligence in case this access level is ever questioned. And in cases where the decision was that the access was inappropriate, you have a record of that user needing to be removed from the rule within Active Roles.
This verification process is available to users designated as administrator or verifier for the Starling Identity Analytics & Risk Intelligence service using the Collaborators page.
|
NOTE: Collaborators that are only assigned the verifier role will only be allowed to access this page within Starling Identity Analytics & Risk Intelligence. All other configuration pages will be hidden from verifiers unless they are assigned the administrator role. In addition, verifiers will only see the items assigned to them on this page whereas administrators will see all verifications. |
The Verification page is displayed when the Verification link is clicked in the navigation bar. The Verification page is used for reviewing entitlement verification requests for high risk users.
|
IMPORTANT: Administrators will see information on all verifications while verifiers will only see the items assigned to them. |
|
IMPORTANT: Should a data source instance be purged, account data related to the instance will be permanently removed from the verification history. This includes verification details for the requests related to the purged data source instance and requests with no remaining associated data source instances. |
The following information and options appear on this page:
This is the number of requests that have already been approved.
This is the number of requests that have yet to be responded to by the assigned verifier.
This is the number of requests that have been rejected. The rejected requests should be reviewed and any necessary changes made within the data source to ensure a user has not been granted access beyond that which is required for their position.
|
NOTE: Customers that use ServiceNow can create incident tickets for rejected requests. For more information, see Connecting with ServiceNow. |
This drop-down menu is for selecting the types of requests to display on this page. The following options are available: All requests, Approved requests only, Pending requests only (default), Rejected requests only, or Canceled requests only.
Hovering over this button displays a search box used to locate specific requests within the listed verifications. To search, click in the empty field and start typing the name of the request in the field and the table will automatically update to display requests that match. If you have configured ServiceNow (Connecting with ServiceNow) then you can also search based on the ticket number.
The following information and button appears in the list of verifications on this page:
This displays the name of the account to which the rule applies and shows the rule that needs to be verified.
This displays the name of the person requesting the verification.
This displays the name of the person who is responsible for verifying the request.
This column displays the current verification status for the associated rule and the time at which the status was last updated. The following statuses may appear and when selected will direct you to the Verification Details page for more information:
|
NOTE: The following options appear for each request depending on the role of the current account. |
This displays additional options for administrators regarding the request. The following options appear:
Clicking this link opens the Verification Details page where the verifier can select whether they agree or disagree with this level of access for the user. Once they have made their selection, the status of the request will be updated.
The Verification Details page is displayed when you click on the verification status for a rule on the Account Evaluation Details page or you click on a verification request listed on the Verification page. The Verification Details page is used for reviewing information on a specific entitlement verification request and is also used by verifiers to respond to their requests.
The following information appears on this page:
This pane displays the name and information regarding the account.
This pane displays why the access is considered high risk.
This pane displays the current status of the request, who initiated the request, the name of the verifier, and when the request occurred.
|
IMPORTANT: This pane is replaced with response options when the verifier opens the page. Verifiers use this pane to select whether they agree or disagree with this level of access for the user. For information on how to respond to requests, see Verifying high risk entitlement requests. |
Clicking this button will add a new pane that shows specific information regarding the rule. It includes the following information:
The following procedure explains how verifiers respond to requests.
|
IMPORTANT: Once a request has been responded to there is no way to undo the decision within Starling Identity Analytics & Risk Intelligence; however, there is no impact on your data source. So a rule marked as requiring mitigation will not remove the user from the rule, and an approved verification will not stop a user from being removed from the rule within the data source. |
To verify a high risk entitlement request
No, I do not believe <account name> should have such a high level of access and request it to be reviewed: Selecting this option will flag the access level as being inappropriate for the user. Any rules marked as requiring mitigation should be removed for the user within the data source.
|
NOTE: Customers that use ServiceNow can create incident tickets for rejected requests. For more information, see Connecting with ServiceNow. |
© 2024 One Identity LLC. ALL RIGHTS RESERVED. Feedback 이용 약관 개인정보 보호정책 Cookie Preference Center