Saviynt API | Execute Runtime Analytics via API

[Manu269]

Hi Team,

I am trying to explore the https://saviynt.freshdesk.com/support/solutions/articles/43000532293-saviynt-siem-integration documentation.

Query Added in Analytics :

SELECT ua.typeofaccess AS 'Object Type',
ua.actiontype AS 'Action Taken',
u.username AS 'Accessed By',
ua.ipaddress AS 'IP Address',
ua.accesstime AS 'Event Time',
ua.detail AS 'Message'
FROM users u ,
userlogin_access ua,
userlogins l
WHERE l.loginkey = ua.loginkey
AND l.userkey = u.userkey
AND ua.accesstime >= (Now() - interval ${timeFrame} minute)
AND ua.detail IS NOT NULL;

We are on Saviynt v5.5SP3.11

We have created the Runtime Analytics Name : SIEM-TEST

Upon hitting the following payload URL via postman (The API user has SAV Admin Role ) :

https://<URL>/ECM/api/v5/fetchControlDetailsES 

We are able to get details as below :

Now I am looking forward to run this control via postman and view the result but getting below error :

Payload URL : https://<URL>/ECM/api/v5/fetchRuntimeControlsData

Can someone guide how to validate the same via postman or am I invoking wrong payload?

Thanks

Manish

[avinashchhetri · Accepted solution]

Hello @Manu269,

Is your runtime analytics in V1 or V2 ?
/fetchRuntimeControlsData is for V1 and /fetchRuntimeControlsDataV2 is for V2

[Manu269]

Hi Avinash,

Is your runtime analytics in V1 or V2 ? --> v2

We are on Saviynt v5.5SP3.11

I tried passing following details but getting 404 Not Found 

[rushikeshvartak · Accepted solution]

1521 --> Analytics v2 Report ID take from URL

{

    "analyticsid":"1521", 

    "max":"4",

    "offset":"0",

    "loggedinuser":"admin"

}

[Manu269]

Hi Rushikesh,

I tried above payload URL also, but my point here is how this runtime analytics can be invoked via postman?

As per query below :

Query Added in Analytics :

SELECT ua.typeofaccess AS 'Object Type',
ua.actiontype AS 'Action Taken',
u.username AS 'Accessed By',
ua.ipaddress AS 'IP Address',
ua.accesstime AS 'Event Time',
ua.detail AS 'Message'
FROM users u ,
userlogin_access ua,
userlogins l
WHERE l.loginkey = ua.loginkey
AND l.userkey = u.userkey
AND ua.accesstime >= (Now() - interval ${timeFrame} minute)
AND ua.detail IS NOT NULL;

${timeFrame} : This is the variable that I need to pass dynamically in the URL to fetch the extract

 Now upon hitting below payload :

https://<URL>/ECM/api/v5/fetchControlDetailsES

I see below results :

I am unable to run the analytics via postman and fetch the result.

Whereas when I am executing directly in SSM then i can see the results.

[rushikeshvartak]

Time frame is dynamic attribute on report? If yes please confirm format or sample value

[Manu269]

Hi Team,

I was able to run the analytics via postman.

The problem was the creation of runtime analytics in SSM.

[rushikeshvartak]

In previous post you mentioned you were unable to run & fetch now you are able to. 

Is issue is you are not able to run runtime analytics from SSm or issue resolved ? 

[Manu269 · Accepted solution]

I was able to run via SSM but not via postman.

For my SSM version, i recreated the Runtime analytics and added following parameters in Postman again and revalidated

{

    "analyticsname" : "SIEM VALIDATION",

    "max": "50",

    "offset": "0",

    "loggedinuser": "admin",

    "attributes": {

        "timeFrame": "360"

    }

}

and it worked.