---
title: "iam.sailpoint"
canonical: "https://docs.devo.com/space/latest/281182295/iam.sailpoint"
format: markdown
---
> Macro (toc)

## Introduction

The tags beginning with `iam.sailpoint` identify events generated by [SailPoint IdentityNow](https://www.sailpoint.com/products/identitynow/?campaignid=11964916297&utm_source=google&utm_medium=cpc&utm_content=emea-bofu-all-lp-br-ex&utm_id=7012J000001FacP&gclid=Cj0KCQiA6fafBhC1ARIsAIJjL8nh9HhA_L0Mr_DKTPSyHCIrLXvfqeFWLqZHBo0hPii_DdTwrsJsCYUaAnJPEALw_wcB).

## Valid tags and data tables

The full tag must have four levels. The first two are fixed as `iam.sailpoint`**.** The third level identifies the type of events sent, and the fourth level indicated the event subtype.

These are the valid tags and corresponding data tables that will receive the parsers' data:

| **Product / Service** | **Tags** | **Data tables** |
| --- | --- | --- |
| SailPoint IdentityNow | `iam.sailpoint.events.ERROR` | `iam.sailpoint.events` |
| `iam.sailpoint.events.DEBUG` |
| `iam.sailpoint.identitynow.account_activities` | `iam.sailpoint.identitynow.account_activities` |
| `iam.sailpoint.identitynow.account_activity` | `iam.sailpoint.identitynow.account_activity` |
| `iam.sailpoint.identitynow.event` | `iam.sailpoint.identitynow.event` |
| `iam.sailpoint.identitynow.events` | `iam.sailpoint.identitynow.events` |

For more information, read more [about Devo tags](https://devodocs.atlassian.net/wiki/spaces/latest/pages/95126204).

## Table structure

These are the fields displayed in these tables:

### iam.sailpoint.events

| **Field** | **Type** | **Field transformation** | **Source field name** | ***Extra***** field** |
| --- | --- | --- | --- | --- |
| *eventdate* | `timestamp` |  |  |  |
| *host* | `str` | ```
split(hostchain, "=", 0)
``` | *hostchain* |  |
| *level* | `str` |  | * * |  |
| *type* | `str` |  | * * |  |
| *source* | `str` |  | * * |  |
| *message* | `str` |  | * * |  |
| *hostchain* | `str` |  | * * | **✓** |
| *tag* | `str` |  | * * | **✓** |
| *rawMessage* | `str` |  | *rawSource* | **✓** |

### iam.sailpoint.identitynow.account_activities

| **Field** | **Type** | ***Extra***** field** |
| --- | --- | --- |
| *eventdate* | `timestamp` |  |
| *hostname* | `str` |  |
| *organization* | `str` |  |
| *pod* | `str` |  |
| *created* | `timestamp` |  |
| *id* | `str` |  |
| *action* | `str` |  |
| *type* | `str` |  |
| *_type* | `str` |  |
| *actor__name* | `str` |  |
| *destination_ip__name* | `str` |  |
| *stack* | `str` |  |
| *tracking_number* | `str` |  |
| *attributes__source_name* | `str` |  |
| *attributes__account_uuid* | `str` |  |
| *attributes__cloud_app_name* | `str` |  |
| *attributes__errors* | `str` |  |
| *attributes__app_id* | `str` |  |
| *attributes__source_id* | `str` |  |
| *attributes__interface* | `str` |  |
| *objects* | `str` |  |
| *operation* | `str` |  |
| *status* | `str` |  |
| *technical_name* | `str` |  |
| *name* | `str` |  |
| *synced* | `timestamp` |  |
| *version* | `str` |  |
| *at_devo_pulling_id* | `str` |  |
| *hostchain* | `str` | **✓** |
| *tag* | `str` | **✓** |
| *rawMessage* | `str` | **✓** |

### iam.sailpoint.identitynow.account_activity

| **Field** | **Type** | ***Extra***** field** |
| --- | --- | --- |
| *eventdate* | `timestamp` |  |
| *hostname* | `str` |  |
| *organization* | `str` |  |
| *pod* | `str` |  |
| *created* | `timestamp` |  |
| *id* | `str` |  |
| *action* | `str` |  |
| *type* | `str` |  |
| *activity_type* | `str` |  |
| *actor__name* | `str` |  |
| *destination_ip__name* | `str` |  |
| *stack* | `str` |  |
| *tracking_number* | `str` |  |
| *attributes__source_name* | `str` |  |
| *attributes__account_uuid* | `str` |  |
| *attributes__cloud_app_name* | `str` |  |
| *attributes__errors* | `str` |  |
| *attributes__app_id* | `str` |  |
| *attributes__source_id* | `str` |  |
| *attributes__interface* | `str` |  |
| *objects* | `str` |  |
| *operation* | `str` |  |
| *status* | `str` |  |
| *technical_name* | `str` |  |
| *name* | `str` |  |
| *synced* | `timestamp` |  |
| *version* | `str` |  |
| *completed* | `timestamp` |  |
| *completion_status* | `str` |  |
| *requester_identity_summary* | `str` |  |
| *target_identity_summary__id* | `str` |  |
| *target_identity_summary__name* | `str` |  |
| *errors* | `str` |  |
| *warnings* | `str` |  |
| *execution_status* | `str` |  |
| *client_metadata* | `str` |  |
| *modified* | `timestamp` |  |
| *items__id* | `str` |  |
| *items__name* | `str` |  |
| *items__requested* | `timestamp` |  |
| *items__approval_status* | `str` |  |
| *items__provisioning_status* | `str` |  |
| *items__requester_comment* | `str` |  |
| *items__reviewer_identity_summary* | `str` |  |
| *items__reviewer_comment* | `str` |  |
| *items__operation* | `str` |  |
| *items__attribute* | `str` |  |
| *items__value* | `str` |  |
| *items__native_identity* | `str` |  |
| *items__source_id* | `str` |  |
| *items__account_request_info* | `str` |  |
| *items__client_metadata* | `str` |  |
| *items__remove_date* | `str` |  |
| *items_found* | `int4` |  |
| *items_id* | `int4` |  |
| *at_devo_pulling_id* | `str` |  |
| *hostchain* | `str` | **✓** |
| *tag* | `str` | **✓** |
| *rawMessage* | `str` | **✓** |

### iam.sailpoint.identitynow.event

| **Field** | **Type** | **Field transformation** | **Source field name** | ***Extra***** fields** |
| --- | --- | --- | --- | --- |
| *eventdate* | `timestamp` |  | * * |  |
| *hostname* | `str` |  | * * |  |
| *completed* | `str` |  | * * |  |
| *completion_status* | `str` |  | * * |  |
| *type* | `str` |  | * * |  |
| *requester_identity_summary* | `str` |  | * * |  |
| *target_identity_summary__id* | `str` |  | * * |  |
| *target_identity_summary__name* | `str` |  | * * |  |
| *errors* | `str` |  | * * |  |
| *warnings* | `str` |  | * * |  |
| *execution_status* | `str` |  | * * |  |
| *client_metadata* | `str` |  | * * |  |
| *id* | `str` |  | * * |  |
| *name* | `str` |  | * * |  |
| *created* | `timestamp` |  | * * |  |
| *modified* | `timestamp` |  | * * |  |
| *items__id* | `str` |  | * * |  |
| *items__name* | `str` |  | * * |  |
| *items__requested* | `timestamp` |  | * * |  |
| *items__approval_status* | `str` |  | * * |  |
| *items__provisioning_status* | `str` |  | * * |  |
| *items__requester_comment* | `str` |  | * * |  |
| *items__reviewer_identity_summary* | `str` |  | * * |  |
| *items__reviewer_comment* | `str` |  | * * |  |
| *items__operation* | `str` |  | * * |  |
| *items__attribute* | `str` |  | * * |  |
| *items__value* | `str` |  | * * |  |
| *items__native_identity* | `str` |  | * * |  |
| *items__source_id* | `str` |  | * * |  |
| *items__account_request_info* | `str` |  | * * |  |
| *items__client_metadata* | `str` |  | * * |  |
| *items__remove_date* | `str` |  | * * |  |
| *items_found* | `int4` |  | * * |  |
| *items_id* | `int4` |  | * * |  |
| *organization* | `str` |  | * * |  |
| *pod* | `str` |  | * * |  |
| *action* | `str` |  | * * |  |
| *actor__name* | `str` |  | * * |  |
| *destination_ip__name* | `str` |  | * * |  |
| *stack* | `str` |  | * * |  |
| *tracking_number* | `str` |  | * * |  |
| *ip4* | `ip4` | ```
ip4(ip)
``` | *ip* |  |
| *ip6* | `ip6` | ```
ip6(ip)
``` | *ip* |  |
| *details* | `str` |  | * * |  |
| *attributes__pod* | `str` |  | * * |  |
| *attributes__org* | `str` |  | * * |  |
| *attributes__source_name* | `str` |  | * * |  |
| *attributes__info* | `str` |  | * * |  |
| *attributes__host_name_ip4* | `ip4` | ```
ip4(attributes__host_name)
``` | *attributes__host_name* |  |
| *attributes__host_name_ip6* | `ip6` | ```
ip6(attributes__host_name)
``` | *attributes__host_name* |  |
| *attributes__cloud_app_name* | `str` |  | * * |  |
| *attributes__app_id* | `str` |  | * * |  |
| *attributes__errors* | `str` |  | * * |  |
| *attributes__account_name* | `str` |  | * * |  |
| *attributes__attribute_name* | `str` |  | * * |  |
| *attributes__attribute_value* | `str` |  | * * |  |
| *objects* | `str` |  | * * |  |
| *operation* | `str` |  | * * |  |
| *status* | `str` |  | * * |  |
| *technical_name* | `str` |  | * * |  |
| *synced* | `timestamp` |  | * * |  |
| *version* | `str` |  | * * |  |
| *message_type* | `str` |  | * * |  |
| *at_devo_pulling_id* | `str` |  | * * |  |
| *hostchain* | `str` |  | * * | **✓** |
| *tag* | `str` |  | * * | **✓** |
| *rawMessage* | `str` |  | * * | **✓** |

### iam.sailpoint.identitynow.events

| **Field** | **Type** | ***Extra***** field** |
| --- | --- | --- |
| *eventdate* | `timestamp` |  |
| *hostname* | `str` |  |
| *completed* | `str` |  |
| *completion_status* | `str` |  |
| *type* | `str` |  |
| *requester_identity_summary* | `str` |  |
| *target_identity_summary__id* | `str` |  |
| *target_identity_summary__name* | `str` |  |
| *errors* | `str` |  |
| *warnings* | `str` |  |
| *execution_status* | `str` |  |
| *client_metadata* | `str` |  |
| *id* | `str` |  |
| *name* | `str` |  |
| *created* | `timestamp` |  |
| *modified* | `timestamp` |  |
| *items__id* | `str` |  |
| *items__name* | `str` |  |
| *items__requested* | `timestamp` |  |
| *items__approval_status* | `str` |  |
| *items__provisioning_status* | `str` |  |
| *items__requester_comment* | `str` |  |
| *items__reviewer_identity_summary* | `str` |  |
| *items__reviewer_comment* | `str` |  |
| *items__operation* | `str` |  |
| *items__attribute* | `str` |  |
| *items__value* | `str` |  |
| *items__native_identity* | `str` |  |
| *items__source_id* | `str` |  |
| *items__account_request_info* | `str` |  |
| *items__client_metadata* | `str` |  |
| *items__remove_date* | `str` |  |
| *items_found* | `int4` |  |
| *items_id* | `int4` |  |
| *at_devo_pulling_id* | `str` |  |
| *hostchain* | `str` | **✓** |
| *tag* | `str` | **✓** |
| *rawMessage* | `str` | **✓** |