Azure-Sentinel/Sample Data/Custom/SailPointIDN_Events_CL.json

[
    {
        "org": "test",
        "pod": "test",
        "created": "2021-03-23T14:55:03.859Z",
        "id": "2c91808478366e5301785f9500b35dfb",
        "action": "RoleRemove",
        "type": "ACCESS_ITEM",
        "actor": {
            "name": "test.test"
        },
        "target": {
            "name": "TEST"
        },
        "trackingNumber": "de7b8a678ffd4874a9622306b8847679",
        "attributes": {
            "sourceName": "TEST",
            "info": "TEST"
        },
        "objects": [
            "ROLE"
        ],
        "operation": "REMOVE",
        "status": "PASSED",
        "technicalName": "ROLE_REMOVE_PASSED",
        "name": "Remove Role Passed",
        "synced": "2021-05-14T20:24:19.684Z",
        "_type": "event",
        "_version": "v7"
    },
    {
        "org": "test",
        "pod": "test",
        "created": "2021-03-23T14:55:41.171Z",
        "id": "2c91808474566e5001785f95927317e4",
        "action": "RemoveEntitlementFailure",
        "type": "ACCESS_ITEM",
        "actor": {
            "name": "test.test"
        },
        "target": {
            "name": "TEST"
        },
        "trackingNumber": "7ab1d21f18864639b54ebdaa1b6dfdec",
        "attributes": {
            "cloudAppName": "TEST",
            "appId": "2c9180876ff2de9601700b99e5fb51c6",
            "sourceId": "source-46477",
            "sourceName": "Test Schema"
        },
        "objects": [
            "ENTITLEMENT"
        ],
        "operation": "REMOVE",
        "status": "FAILED",
        "technicalName": "ENTITLEMENT_REMOVE_FAILED",
        "name": "Remove Entitlement Failed",
        "synced": "2021-05-14T20:24:19.731Z",
        "_type": "event",
        "_version": "v7"
    }
]