What Variables Exist in a Correlation Rule?
Hey folks,
Quick question for you. I have a correlation rule that I am working on. I am not sure if it is really functioning properly. I started to examine it under the debugger. I was a little surprised by what I saw in the variable section of the debugger. I am seeing two sets of variables. One set is prefaced with 'account' and is included in the larger set as a sub-set. The sets of variables are the same. None of the variables appear to be the names of variables as they exist on the resource. That is the main thing that surprised me. I expected to access the resource variables directly. I'm assuming it is loading the resource variable values into one of the sets. Which set? The one without the preface or the one prefaced by 'account'.
The values of the variables of both sets seem to be the same already. So it seems odd that one set is IDM's and the other is the resources. Also, I am only mapping 2 attributes in the resource schema, but 4 variables are present in both sets. The one that stands out the most is 'name'. It isn't mapped in the schema and it isn't referenced in the rule, so I'm unsure why it is there.
Any insight is appreciated, as I am still unable to have the reconcile event match up accounts. If I provision the account manually the queryable user extended attributes that I mapped in the resource schema do not seem to be getting populated, which still seems wrong and odd...
