Acting on Audit Policy Violations

The following procedures describe how to take action on audit policy violations.

To Assign an Audit Policy Violation to Another User

Log in to Oracle Identity Analytics.
Choose Identity Audit > Policy Violations.

A list of open violations is displayed.
Click a violation in the Exception column.

The Policy Violation Details page opens.
To reassign the violation to another user, click Reassign To in the Violation Details section.

A page asking you to select another remediator opens.
Use search to choose another user.

For help using search, see the Searching For a User section in the Identity Warehouse chapter.
Click OK.

To View and Take Action on Audit Policy Violations

Log in to Oracle Identity Analytics.
Choose Identity Audit > Policy Violations.

A list of open violations is displayed.

Audit policy violations can be sorted by four different states:
- Open - The remediator has not yet taken any action on the violation.
- Closed - The remediator has closed the violation.
- Closed and Fixed - The remediator has fixed the violation and therefore it should not appear in the next policy scan.
- Closed as Risk Accepted - The remediator has acknowledged the violation and opted to allow the access for a certain time period.
Click a violation in the Exception column.

The Policy Violations Details page opens.
To take action on the violation, review the user's access.

To understand the Audit Violations page, see Audit Violation Details Help.
- If you click Close Violation or Close as Fixed, a comment box opens.
  
  Enter a comment for future reference and click OK.
- If you click Close as Risk Accepted, enter a comment and an end date, after which time the exemption will expire, then click OK.

Audit Violation Details Help

When taking action on an open violation (see To Assign an Audit Policy Violation to Another User), the Policy Violation Details page displays the following information.

Violation Details Section

Field	Description
Policy	Displays the name of the policy.
Assigned To	Displays the remediator's name.
Reassign To	Allows you to reassign the violation to another user.
Assigned Date	The date when the policy was assigned to the remediator.
State	Displays the state of the violation.
Detection Count	The number of scans in which the violation was detected.
Last Detected	Last time the violation was found in an identity audit scan.
Expiration Date	Displays the expiration date of a "Close as Risk Accepted" violation.
Close Date	The date a remediation action was taken and the violation was moved to one of the "Closed" states.
Comments	Displays any comments added by the remediator.

User Details Section

Field	Description
Name	Displays the name of the user.
Department	Displays the user's department.
E-mail	Displays the user's e-mail ID.
User Name	Displays the user name.
Manager	Displays the name of the manager.
Job Title	Displays the user's job title.

Accounts Section

The accounts section displays the user account that resulted in an identity audit violation.

Field	Description
Name	Displays the name of the account under violation.
Resource Type	Displays the resource type under violation.
Resource	Displays the resource under violation.
Rule	Displays the identity audit rule.
Condition	Displays the identity audit rule condition.
Status	Displays the state of the rule.

Roles Section

The Roles section displays the name of the user role that resulted in the identity audit violation.

Field	Description
Name	Displays the role under violation.
Rule	Displays the identity audit rule.
Condition	Displays the identity audit rule condition.
Status	Displays the state of the rule.

HR Attributes Section

The HR Attributes section displays the user attributes and values that resulted in the violation. If the violation occurred due to a business structure membership, the name of the business structure is displayed.

Field	Description
Attributes	Displays the HR attribute under violation.
Rule	Displays the identity audit rule.
Condition	Displays the identity audit rule condition.
Status	Displays the state of the rule.

To View Audit Trails

An audit trail is a permanent history of every audit violation identified by Oracle Identity Analytics as well as all subsequent actions taken to resolve the violation.

The audit trail is updated whenever a violation is updated or modified. The audit trail tracks date information (when actions were taken), as well as any changes that affect the user, state, remediator, and comments fields.

Log in to Oracle Identity Analytics.
Choose Identity Audit > Policy Violations.
- To view the audit trail of an open violation, click Open Violations in the submenu bar.
  1. Select the violation.
    
    The Violations Details page opens.
  2. Click the Audit Trail page option.
    
    The audit trail for the violation is displayed.
- To view the audit trail of a closed violation, click Closed Violations in the submenu bar.
  1. Select the violation.
    
    The violations details page opens.
  2. Click the Audit Trail page option.
    
    The audit trail for the violation is displayed.

To Export A Violation

Log in to Oracle Identity Analytics.
Choose Identity Audit > Policies.

All the identity audit polices are listed.
Select the desired policy whose violations you want to export.
Click Export Violations.
Select the options to generate your report:
- Report Format: Select the report format. Formats include PDF, CSV, XML, HTML, or XLS.
- Violations to be exported: Select from the options listed.
Click OK.

Skip Navigation Links
Exit Print View
	Oracle Identity Analytics User's Guide 11g Release 1