Install this skill

npx skills add mukul975/Anthropic-Cybersecurity-Skills

Framework mappings

MITRE ATT&CK

NIST CSF 2.0

When to Use

Quarterly or annual access certification campaigns are required for compliance (SOX, HIPAA, PCI-DSS)
Organization needs automated manager-based access reviews for all direct reports
Targeted entitlement reviews are needed for sensitive applications or high-privilege roles
Separation of Duties (SOD) violations must be identified and remediated
Orphaned accounts and excessive entitlements need to be discovered and cleaned up
Audit findings require evidence of periodic access review and remediation tracking

Do not use for real-time access control decisions; IdentityIQ certifications are periodic review processes designed for governance and compliance validation.

Prerequisites

SailPoint IdentityIQ 8.2+ deployed with database backend (Oracle, MySQL, or SQL Server)
Application connectors configured for all in-scope systems (Active Directory, LDAP, databases, SaaS applications)
Identity cubes aggregated with current entitlement data from all connected sources
Email server configured for certification notifications
Manager hierarchy defined in the identity model
Business roles and entitlement glossary populated for reviewer context

Workflow

Step 1: Define Certification Campaign Strategy

Plan the certification scope and reviewer assignments:

// SailPoint IdentityIQ BeanShell - Campaign Configuration
import sailpoint.object.*;
import sailpoint.api.*;
import java.util.*;
 
// Define campaign schedule for quarterly manager certifications
CertificationSchedule schedule = new CertificationSchedule();
schedule.setName("Q1-2026-Manager-Access-Review");
schedule.setDescription("Quarterly manager certification for all active employees");
schedule.setType(Certification.Type.Manager);
 
// Configure campaign scope
CertificationDefinition certDef = new CertificationDefinition();
certDef.setName("Q1 Manager Certification");
certDef.setOwner(context.getObjectByName(Identity.class, "cert-admin"));
 
// Set certification options
certDef.setCertifierSelectionType(CertificationDefinition.CertifierSelectionType.Manager);
certDef.setIncludeEntitlements(true);
certDef.setIncludeRoles(true);
certDef.setIncludeAccounts(true);
certDef.setIncludeAdditionalEntitlements(true);
 
// Exclude service accounts from manager reviews
Filter exclusionFilter = Filter.ne("type", "service");
certDef.setExclusionFilter(exclusionFilter);
 
// Configure notification settings
certDef.setNotificationEnabled(true);
certDef.setReminderFrequency(7); // days
certDef.setEscalationEnabled(true);
certDef.setEscalationDays(14);
certDef.setEscalationRecipient("security-governance-team");
 
// Set active period
certDef.setActivePeriodDays(30);
certDef.setAutoCloseEnabled(true);
certDef.setDefaultRevoke(true); // Revoke if not reviewed
 
context.saveObject(certDef);
context.commitTransaction();

Step 2: Configure Targeted Entitlement Certification

Set up focused reviews for high-risk applications and privileged entitlements:

// Targeted certification for privileged access review
import sailpoint.object.*;
import sailpoint.api.*;
 
CertificationDefinition targetedCert = new CertificationDefinition();
targetedCert.setName("Privileged Access Targeted Review");
targetedCert.setType(Certification.Type.ApplicationOwner);
 
// Scope to specific high-risk applications
List applicationNames = new ArrayList();
applicationNames.add("Active Directory");
applicationNames.add("AWS IAM");
applicationNames.add("Oracle EBS");
applicationNames.add("SAP GRC");
applicationNames.add("CyberArk Vault");
targetedCert.setApplicationNames(applicationNames);
 
// Filter for privileged entitlements only
String entitlementFilter = "entitlement.classification == \"Privileged\" " +
    "|| entitlement.riskScore > 800 " +
    "|| entitlement.name.contains(\"Admin\") " +
    "|| entitlement.name.contains(\"Root\") " +
    "|| entitlement.name.contains(\"DBA\")";
targetedCert.setEntitlementFilter(entitlementFilter);
 
// Assign application owners as certifiers
targetedCert.setCertifierSelectionType(
    CertificationDefinition.CertifierSelectionType.ApplicationOwner
);
 
// Configure approval workflow
targetedCert.setApprovalRequired(true);
targetedCert.setSignOffRequired(true);
targetedCert.setReasonRequired(true);
 
// Enable SOD policy check during certification
targetedCert.setCheckSodPolicies(true);
targetedCert.setSodPolicyAction(CertificationDefinition.SodPolicyAction.Flag);
 
context.saveObject(targetedCert);
context.commitTransaction();

Step 3: Implement SOD Policy Checks Within Certifications

Define Separation of Duties policies that flag violations during reviews:

// Create SOD policy for financial system access conflicts
import sailpoint.object.*;
import sailpoint.object.Policy;
 
Policy sodPolicy = new Policy();
sodPolicy.setName("Financial SOD - AP/AR Conflict");
sodPolicy.setType(Policy.TYPE_SOD);
sodPolicy.setDescription("Prevents users from having both Accounts Payable " +
    "and Accounts Receivable access simultaneously");
sodPolicy.setViolationOwner(
    context.getObjectByName(Identity.class, "compliance-team")
);
 
// Define conflicting entitlements
SODConstraint constraint = new SODConstraint();
constraint.setName("AP-AR Separation");
 
// Left side: Accounts Payable entitlements
PolicyConstraint leftSide = new PolicyConstraint();
leftSide.setApplication("SAP ERP");
leftSide.addEntitlement("SAP_AP_PROCESSOR");
leftSide.addEntitlement("SAP_AP_APPROVER");
leftSide.addEntitlement("SAP_AP_ADMIN");
constraint.setLeftConstraint(leftSide);
 
// Right side: Accounts Receivable entitlements
PolicyConstraint rightSide = new PolicyConstraint();
rightSide.setApplication("SAP ERP");
rightSide.addEntitlement("SAP_AR_PROCESSOR");
rightSide.addEntitlement("SAP_AR_APPROVER");
rightSide.addEntitlement("SAP_AR_ADMIN");
constraint.setRightConstraint(rightSide);
 
// Set violation severity and remediation
constraint.setViolationSeverity("High");
constraint.setCompensatingControl("Dual approval required for transactions > $10,000");
 
sodPolicy.addConstraint(constraint);
context.saveObject(sodPolicy);
context.commitTransaction();

Step 4: Configure Revocation and Remediation Workflows

Automate access removal when certifiers revoke entitlements:

// Configure automatic provisioning for revoked entitlements
import sailpoint.object.*;
import sailpoint.api.*;
 
// Create remediation workflow
Workflow remediationWorkflow = new Workflow();
remediationWorkflow.setName("Certification Revocation Workflow");
remediationWorkflow.setType(Workflow.Type.CertificationRemediation);
 
// Step 1: Create provisioning plan for revocation
Step createPlan = new Step();
createPlan.setName("Create Revocation Plan");
createPlan.setScript(
    "import sailpoint.object.ProvisioningPlan;\n" +
    "import sailpoint.object.ProvisioningPlan.AccountRequest;\n" +
    "import sailpoint.object.ProvisioningPlan.AttributeRequest;\n\n" +
    "ProvisioningPlan plan = new ProvisioningPlan();\n" +
    "plan.setIdentity(identity);\n" +
    "AccountRequest acctReq = new AccountRequest();\n" +
    "acctReq.setApplication(applicationName);\n" +
    "acctReq.setOperation(AccountRequest.Operation.Modify);\n" +
    "AttributeRequest attrReq = new AttributeRequest();\n" +
    "attrReq.setName(entitlementAttribute);\n" +
    "attrReq.setValue(entitlementValue);\n" +
    "attrReq.setOperation(ProvisioningPlan.Operation.Remove);\n" +
    "acctReq.add(attrReq);\n" +
    "plan.add(acctReq);\n" +
    "return plan;"
);
 
// Step 2: Execute provisioning with retry logic
Step executeProvisioning = new Step();
executeProvisioning.setName("Execute Revocation");
executeProvisioning.setScript(
    "import sailpoint.api.Provisioner;\n" +
    "Provisioner provisioner = new Provisioner(context);\n" +
    "provisioner.setNoTriggers(false);\n" +
    "ProvisioningResult result = provisioner.execute(plan);\n" +
    "if (result.isCommitted()) {\n" +
    "    auditEvent(\"Entitlement revoked successfully\", identity, plan);\n" +
    "} else {\n" +
    "    openWorkItem(\"Manual revocation required\", identity, plan);\n" +
    "}"
);
 
// Step 3: Send notification to user and manager
Step notification = new Step();
notification.setName("Send Revocation Notification");
notification.setScript(
    "import sailpoint.tools.EmailTemplate;\n" +
    "EmailTemplate template = context.getObjectByName(\n" +
    "    EmailTemplate.class, \"Access Revocation Notification\");\n" +
    "Map args = new HashMap();\n" +
    "args.put(\"identityName\", identity.getDisplayName());\n" +
    "args.put(\"applicationName\", applicationName);\n" +
    "args.put(\"entitlementName\", entitlementValue);\n" +
    "args.put(\"certifierName\", certifier.getDisplayName());\n" +
    "args.put(\"revocationReason\", decisionReason);\n" +
    "context.sendEmailNotification(template, args);"
);
 
context.saveObject(remediationWorkflow);
context.commitTransaction();

Step 5: Monitor Campaign Progress and Compliance Metrics

Track certification completion and generate compliance evidence:

// Campaign monitoring and reporting script
import sailpoint.object.*;
import sailpoint.api.*;
import java.util.*;
 
// Get all active certification campaigns
QueryOptions qo = new QueryOptions();
qo.addFilter(Filter.eq("phase", Certification.Phase.Active));
Iterator certIterator = context.search(Certification.class, qo);
 
while (certIterator.hasNext()) {
    Certification cert = certIterator.next();
 
    System.out.println("Campaign: " + cert.getName());
    System.out.println("  Type: " + cert.getType());
    System.out.println("  Phase: " + cert.getPhase());
    System.out.println("  Due Date: " + cert.getExpiration());
 
    // Get completion statistics
    CertificationStats stats = cert.getStatistics();
    int totalItems = stats.getTotalEntities();
    int completedItems = stats.getCompletedEntities();
    int pendingItems = totalItems - completedItems;
    double completionPct = (completedItems * 100.0) / totalItems;
 
    System.out.println("  Total Items: " + totalItems);
    System.out.println("  Completed: " + completedItems + " (" +
        String.format("%.1f", completionPct) + "%)");
    System.out.println("  Pending: " + pendingItems);
 
    // Decision breakdown
    int approved = stats.getApprovedCount();
    int revoked = stats.getRevokedCount();
    int mitigated = stats.getMitigatedCount();
    int delegated = stats.getDelegatedCount();
 
    System.out.println("  Decisions:");
    System.out.println("    Approved: " + approved);
    System.out.println("    Revoked: " + revoked);
    System.out.println("    Mitigated: " + mitigated);
    System.out.println("    Delegated: " + delegated);
 
    // Identify overdue certifiers
    List certifiers = cert.getCertifiers();
    for (Object certObj : certifiers) {
        CertificationEntity entity = (CertificationEntity) certObj;
        if (!entity.isCompleted() && cert.isOverdue()) {
            System.out.println("  [OVERDUE] Certifier: " +
                entity.getCertifier().getDisplayName());
        }
    }
    System.out.println();
}

Step 6: Generate Audit Evidence and Reports

Export certification results for auditor review:

// Generate audit report for completed certifications
import sailpoint.object.*;
import sailpoint.api.*;
import sailpoint.tools.Util;
 
// Query completed certifications for the audit period
QueryOptions qo = new QueryOptions();
qo.addFilter(Filter.eq("phase", Certification.Phase.End));
qo.addFilter(Filter.ge("signed", Util.stringToDate("2026-01-01")));
qo.addFilter(Filter.le("signed", Util.stringToDate("2026-03-31")));
 
List results = context.getObjects(Certification.class, qo);
 
StringBuilder auditReport = new StringBuilder();
auditReport.append("ACCESS CERTIFICATION AUDIT REPORT\n");
auditReport.append("Period: Q1 2026\n");
auditReport.append("Generated: " + new Date() + "\n");
auditReport.append("=".repeat(50) + "\n\n");
 
int totalCampaigns = 0;
int totalDecisions = 0;
int totalRevocations = 0;
 
for (Certification cert : results) {
    totalCampaigns++;
    CertificationStats stats = cert.getStatistics();
 
    auditReport.append("Campaign: " + cert.getName() + "\n");
    auditReport.append("  Certifier: " + cert.getCertifiers().size() + " reviewers\n");
    auditReport.append("  Items Reviewed: " + stats.getTotalEntities() + "\n");
    auditReport.append("  Approved: " + stats.getApprovedCount() + "\n");
    auditReport.append("  Revoked: " + stats.getRevokedCount() + "\n");
    auditReport.append("  Completed: " + cert.getSigned() + "\n");
    auditReport.append("  Sign-off: " + (cert.isSignedOff() ? "YES" : "NO") + "\n\n");
 
    totalDecisions += stats.getTotalEntities();
    totalRevocations += stats.getRevokedCount();
}
 
auditReport.append("SUMMARY\n");
auditReport.append("Total Campaigns: " + totalCampaigns + "\n");
auditReport.append("Total Decisions: " + totalDecisions + "\n");
auditReport.append("Total Revocations: " + totalRevocations + "\n");
auditReport.append("Revocation Rate: " +
    String.format("%.1f%%", (totalRevocations * 100.0) / totalDecisions));
 
System.out.println(auditReport.toString());

Key Concepts

Term	Definition
Certification Campaign	An organized review process where designated certifiers validate whether users should retain their current access entitlements across one or more applications
Access Review	Individual review unit within a campaign where a certifier examines and makes approve/revoke decisions on specific user entitlements
Entitlement	A specific permission, group membership, role, or access right granted to an identity on a target application
Certifier	The reviewer responsible for making access decisions, typically a manager, application owner, or data owner
Revocation	Decision to remove an entitlement from a user, triggering a provisioning request to the target application for access removal
SOD Violation	Separation of Duties conflict where a user holds entitlements from two or more conflicting access groups that create a segregation risk
Remediation	Automated or manual process of removing revoked access from target systems following certification decisions

Tools & Systems

SailPoint IdentityIQ: Enterprise identity governance platform providing access certifications, lifecycle management, and compliance reporting
IdentityIQ Compliance Manager: Module for running certification campaigns, tracking reviewer progress, and generating compliance evidence
SailPoint REST API: Programmatic interface for automating certification campaigns, querying status, and extracting audit data
IdentityIQ Report Builder: Built-in reporting engine for generating access review statistics, SOD violation summaries, and trend analysis

Common Scenarios

Scenario: SOX Compliance Quarterly Access Review

Context: A publicly traded company must demonstrate quarterly access reviews for all financial applications per SOX Section 404. The previous manual review process took 6 weeks and produced inconsistent results.

Approach:

Define application scope: SAP ERP, Oracle Financials, banking platforms, and treasury systems
Configure manager certifications with 30-day active period for general access review
Create targeted entitlement certifications for privileged financial roles with application owner as certifier
Enable SOD policy checks to flag AP/AR, GL posting/approval, and user admin/transaction conflicts
Configure automatic reminders at 7, 14, and 21 days with escalation to compliance team at day 25
Set default-revoke for items not reviewed by campaign end to enforce completion accountability
Generate signed certification reports with decision audit trail for external auditors
Track revocation completion to ensure all denied access is actually removed from target systems

Pitfalls:

Not pre-populating entitlement descriptions causes certifiers to approve everything they do not understand
Setting campaigns too short (under 21 days) results in rubber-stamping and low-quality reviews
Not validating that revocations are actually provisioned to target systems (approve on paper, still active in system)
Missing service accounts from review scope when they have access to financial systems

Output Format

ACCESS CERTIFICATION CAMPAIGN REPORT
=======================================
Campaign:          Q1-2026 Manager Access Review
Type:              Manager Certification
Period:            2026-01-15 to 2026-02-14
Status:            COMPLETED
 
COVERAGE
Identities Reviewed:    2,847
Applications In Scope:  34
Total Entitlements:     18,392
 
DECISION SUMMARY
Approved:              16,841 (91.6%)
Revoked:                1,203 (6.5%)
Mitigated:                 198 (1.1%)
Delegated:                 150 (0.8%)
 
REVOCATION STATUS
Provisioned:            1,089 / 1,203 (90.5%)
Pending:                   87
Failed:                    27 (manual work items created)
 
SOD VIOLATIONS
Flagged:                   43
Remediated:                31
Compensating Controls:     12
 
CERTIFIER COMPLIANCE
On-Time Completion:     89.3%
Required Escalation:    14 certifiers
Average Review Time:    3.2 minutes per item
 
SIGN-OFF
Campaign Signed:        2026-02-14 by compliance-admin
Audit Evidence:         Exported to /reports/Q1-2026-cert-evidence.pdf

Source materials

References and resources

Everything below is rendered for inspection. Script files are read-only and never run.

References 1

api-reference.md2.0 KB

API Reference: Entitlement Review with SailPoint IdentityIQ

SailPoint IdentityIQ REST API

Endpoint	Method	Description
`/identityiq/scim/v2/Users`	GET	List identities with entitlements and roles
`/identityiq/scim/v2/Users/{id}`	GET	Get identity details including accounts and entitlements
`/identityiq/scim/v2/Certifications`	GET	List certification campaigns with filter support
`/identityiq/scim/v2/Certifications/{id}/items`	GET	Get certification items for a campaign
`/identityiq/rest/certifications/{id}/statistics`	GET	Retrieve campaign completion statistics
`/identityiq/rest/identities/{id}/policyViolations`	GET	Check SOD policy violations for an identity
`/identityiq/rest/certifications/{id}/items/{itemId}`	POST	Submit approve/revoke decision on a cert item

Authentication

SailPoint IIQ REST API uses HTTP Basic Authentication. All requests require Content-Type: application/json.

Authorization: Basic base64(username:password)

Key Parameters

Parameter	Type	Used In	Description
`filter`	string	GET /Certifications	SCIM filter expression (e.g., `phase eq "Active"`)
`attributes`	string	GET /Users/{id}	Comma-separated attributes to include
`decision`	string	POST /items/{id}	Certification decision: `Approve`, `Revoke`, `Mitigate`
`comments`	string	POST /items/{id}	Reviewer comments for audit trail

Python Libraries

Library	Version	Purpose
`requests`	>=2.28	HTTP client for SailPoint REST API calls

References

SailPoint IdentityIQ REST API Guide: https://documentation.sailpoint.com/identityiq/
SailPoint SCIM 2.0 API: https://documentation.sailpoint.com/identityiq/help/scimrest/
SailPoint Certification API: https://community.sailpoint.com/
SOD Policy Configuration: https://documentation.sailpoint.com/identityiq/help/policies/

Scripts 1

agent.py6.7 KB

Display-only source. This catalog never executes bundled scripts.

#!/usr/bin/env python3
"""Agent for performing entitlement review with SailPoint IdentityIQ.

Automates access certification campaigns, SOD violation detection,
and entitlement review reporting via the SailPoint IdentityIQ REST API.
"""

import requests
import json
import sys
from datetime import datetime


class SailPointIIQAgent:
    """Interacts with SailPoint IdentityIQ REST API for entitlement reviews."""

    def __init__(self, base_url, username, password):
        self.base_url = base_url.rstrip("/")
        self.session = requests.Session()
        self.session.auth = (username, password)
        self.session.headers.update({
            "Content-Type": "application/json",
            "Accept": "application/json",
        })

    def get_certifications(self, phase="Active"):
        """Retrieve certification campaigns filtered by phase."""
        url = f"{self.base_url}/identityiq/scim/v2/Certifications"
        params = {"filter": f'phase eq "{phase}"'}
        resp = self.session.get(url, params=params, timeout=30)
        resp.raise_for_status()
        return resp.json().get("Resources", [])

    def get_certification_items(self, cert_id):
        """Get individual certification items for a campaign."""
        url = f"{self.base_url}/identityiq/scim/v2/Certifications/{cert_id}/items"
        resp = self.session.get(url, timeout=30)
        resp.raise_for_status()
        return resp.json().get("Resources", [])

    def get_identities(self, query=None):
        """Search identities in IdentityIQ."""
        url = f"{self.base_url}/identityiq/scim/v2/Users"
        params = {}
        if query:
            params["filter"] = query
        resp = self.session.get(url, params=params, timeout=30)
        resp.raise_for_status()
        return resp.json().get("Resources", [])

    def get_entitlements(self, identity_id):
        """Get entitlements for a specific identity."""
        url = f"{self.base_url}/identityiq/scim/v2/Users/{identity_id}"
        params = {"attributes": "entitlements,roles,accounts"}
        resp = self.session.get(url, params=params, timeout=30)
        resp.raise_for_status()
        return resp.json()

    def check_sod_violations(self, identity_id):
        """Check for separation of duties violations on an identity."""
        url = f"{self.base_url}/identityiq/rest/identities/{identity_id}/policyViolations"
        resp = self.session.get(url, timeout=30)
        resp.raise_for_status()
        return resp.json()

    def get_campaign_statistics(self, cert_id):
        """Retrieve completion statistics for a certification campaign."""
        url = f"{self.base_url}/identityiq/rest/certifications/{cert_id}/statistics"
        resp = self.session.get(url, timeout=30)
        resp.raise_for_status()
        return resp.json()

    def make_certification_decision(self, cert_id, item_id, decision, comments=""):
        """Submit a certification decision (approve/revoke) for an item."""
        url = f"{self.base_url}/identityiq/rest/certifications/{cert_id}/items/{item_id}"
        payload = {
            "decision": decision,
            "comments": comments,
            "decisionDate": datetime.utcnow().isoformat() + "Z",
        }
        resp = self.session.post(url, json=payload, timeout=30)
        resp.raise_for_status()
        return resp.json()

    def generate_review_report(self):
        """Generate a comprehensive entitlement review report."""
        active_certs = self.get_certifications("Active")
        completed_certs = self.get_certifications("End")
        report = {
            "report_date": datetime.utcnow().isoformat(),
            "active_campaigns": [],
            "completed_campaigns": [],
            "summary": {},
        }
        total_items = 0
        total_revoked = 0
        total_approved = 0

        for cert in active_certs:
            stats = self.get_campaign_statistics(cert.get("id", ""))
            campaign_info = {
                "name": cert.get("name", "Unknown"),
                "type": cert.get("type", "Unknown"),
                "phase": cert.get("phase", "Unknown"),
                "due_date": cert.get("expiration", "N/A"),
                "total_items": stats.get("totalEntities", 0),
                "completed_items": stats.get("completedEntities", 0),
                "completion_pct": 0,
            }
            if campaign_info["total_items"] > 0:
                campaign_info["completion_pct"] = round(
                    campaign_info["completed_items"] / campaign_info["total_items"] * 100, 1
                )
            report["active_campaigns"].append(campaign_info)

        for cert in completed_certs:
            stats = self.get_campaign_statistics(cert.get("id", ""))
            approved = stats.get("approvedCount", 0)
            revoked = stats.get("revokedCount", 0)
            items = stats.get("totalEntities", 0)
            total_items += items
            total_revoked += revoked
            total_approved += approved
            report["completed_campaigns"].append({
                "name": cert.get("name", "Unknown"),
                "items_reviewed": items,
                "approved": approved,
                "revoked": revoked,
                "signed_off": cert.get("signedOff", False),
            })

        report["summary"] = {
            "total_campaigns": len(active_certs) + len(completed_certs),
            "active_campaigns": len(active_certs),
            "completed_campaigns": len(completed_certs),
            "total_items_reviewed": total_items,
            "total_approved": total_approved,
            "total_revoked": total_revoked,
            "revocation_rate": round(total_revoked / max(total_items, 1) * 100, 1),
        }
        return report


def main():
    if len(sys.argv) < 4:
        print("Usage: agent.py <iiq_url> <username> <password> [action]")
        print("Actions: report, active, sod-check <identity>")
        sys.exit(1)

    base_url, username, password = sys.argv[1], sys.argv[2], sys.argv[3]
    action = sys.argv[4] if len(sys.argv) > 4 else "report"

    agent = SailPointIIQAgent(base_url, username, password)

    if action == "report":
        report = agent.generate_review_report()
        print(json.dumps(report, indent=2))
    elif action == "active":
        certs = agent.get_certifications("Active")
        for cert in certs:
            print(f"Campaign: {cert.get('name')}")
            print(f"  Phase: {cert.get('phase')}")
            print(f"  Due: {cert.get('expiration', 'N/A')}")
    elif action == "sod-check" and len(sys.argv) > 5:
        violations = agent.check_sod_violations(sys.argv[5])
        print(json.dumps(violations, indent=2))
    else:
        print(f"Unknown action: {action}")
        sys.exit(1)


if __name__ == "__main__":
    main()

Keep exploring