ITP/PCCE Collections

ITP-PCCE collections can track Access Policies, Activities, Assets, Groups, Identities, Memberships, Privileges, or any combination of these. ITP/PCCE Collections include System Collections and Custom Collections, and both types of collections are described in the rest of this page.

Don't confuse ITP/PCCE Collections with general Platform Collections, which can track computer assets, remote applications, and web applications. For more information, see Grouping with Collections.

System Collections

ITP-PCCE inventory comes with built-in System Collections, which include account and group definitions that apply system-wide, in all inventories and dashboards.

To view System Collections: 

1. In the left navigation, select Inventory > Collections.

2. Choose the System tab.

The System tab displays a table showing the accounts and groups, and the numbers of each, that match the System Collection definition. For each account and group, the table displays its name, type, and status information. The table also indicates whether the System Collection definitions have been modified from the default settings.

The built-in, default System Collections are as follows:

• Admin Accounts: Accounts with administrator privileges.
  Use the inventory filter Account: Admin Access to find Admin Accounts. For example:

  
  

• Admin Groups: Groups that grant Admin Account privileges to their members. Use the inventory filter Group: Admin Access to find Admin Groups.

• Compliant Admin Accounts: An Admin Account that is deemed compliant according to possession of some extra factor; for example, having an email formatted in a given format such as:

  {full_name}_adm@company.com.

  To find Compliant Admin Accounts, define a query to find all Admin Accounts with the specified email format. The Privileged Accounts dashboard displays all Compliant Admin Accounts along with the number of non-compliant accounts.

• External Accounts: Use the inventory filter Account: Is External to find External Accounts.

• Privileged Accounts: Accounts with privileged access.
  Use the inventory filter Account: Privileged Access to find Privileged Accounts.

• Privileged Groups: Groups that grant privileged access to their members. Use the inventory filter Groups: Privileged Access to find Privileged Groups.

Filtering and Sorting the Collections Table

By default, the collections are sorted by date of creation, in descending order. To change the data displayed in the table, use the filter controls above the table. The selections you make are shown in the filter bar. For more information about the filter and display options, see Inventories User Interface.

To search for a custom collection by name, type text into the search field at the top-right of the table.

Insight into Collections Table Data

The data in the Collections table includes the following:

• The Type column shows which inventory the custom collection was created from.

• The Status column shows the following values:

  • Calculating

  • Exceed results: Results are too large. Run the collection query again with narrower filters to reduce its size.

  • Empty: The search yielded no results.

  • Done

  • Error

• The Results column shows how many entities matched the filters in the custom collection. To see the actual results, click the number in this column.

To see details about a collection, click the collection row in the table. A window opens to show details about the collection, including the query that created the collection, a description (if one was entered when the collection was created), and the last sync date.

The trend line detects rapid changes and shows how your collection changes over time, such as privilege creep, new admins, or shadow admins.

Configuring System Collections

From the System tab, you can:

• Edit a collection: Edit a system collection to customize the values according to your organization’s needs. See Editing a System Collection.

• Duplicate, then modify a collection: Duplicate a system collection and then modify it for other needs. For example, you might want to trigger an alert for more limited matches than are defined by the system collection. See Duplicating and Modifying a System Collection.

• Reset a collection to default values: Set an edited system collection back to the system default. See Resetting a System Collection to Default.

• Calculate collection results: Initiate an immediate calculation of the matched accounts and groups instead of waiting for the next scheduled recalculation. See Calculating Collection Results.

• Create a custom alert: Get notified when new items are added to the collection. See Creating a Custom Alert from a Collection.

Editing a System Collection

You can edit a System Collection to customize the values according to your organization’s needs.

Although you can edit a System Collection definition, remember that a System Collection definition impacts the entire platform, so you must proceed with caution. Consider customizing a System Collection definition only for temporary purposes, and remember to reset the System Collection back to the default values when you are finished. See Resetting a System Collection to Default.

1. Click an empty area of a system collection's row to open its side panel.

2. Select Actions > Edit.

3. Edit the filter values.

4. Click Save.

In the Default column, the value changes to Edited. Results will be shown after the next result refresh. To see the results sooner, see Calculating Collection Results.

Duplicating and Modifying a System Collection

You can duplicate a collection and then rename and modify the duplicate for other needs. For example, you might want to trigger an alert for more limited matches than are defined by the original collection.

1. Click an empty area of a system collection's row to open its side panel.

2. Select Actions > Duplicate.

3. Edit the filter values and click Save.

The System tab shows only the collections that are defined by the system. Duplicated system collections are displayed on the Custom tab.

Resetting a System Collection to Default

You can set an edited system collection back to the system default values.

1. Click an empty area of the row of a system collection where the value in the Default column is Edited. Its side panel opens.

2. Select Actions > Reset.

The collection value returns to the default definition. In the Default column, the value returns to Default.

Calculating Collection Results

When a collection is changed, the Platform automatically begins to calculate the accounts and groups that match the definition. While this is taking place, the status value changes to Calculating. You can work elsewhere while the calculation is processed, or you can calculate collection results immediately by using the following steps.

To calculate collection results immediately:

1. Click an empty area of a system collection's row to open its side panel.

2. Select Actions > Calculate.

The calculation is initiated immediately. Results are shown as soon as they are ready.

Custom Collections

Custom Collections are not just a way to save you from writing the same queries every day. They can help you focus on what matters most to you in your role within your organization and track status over time.

You can also use collections to target policies, schedule reports, build dashboards, and create custom alerts. See Creating a Custom Alert from a Collection.

All Custom Collections on the Platform are updated automatically every day, and can also be updated on demand.

To view Custom Collections: 

1. From the left navigation menu, select Inventory > Collections.

2. Click the Custom tab.

   

Saving a Custom Collection

A custom inventory query of cloud service users can be saved for later re-use as a Custom Collection.

To save a custom collection:

1. Filter an inventory table.

2. Click Save.

3. In the Collection Creation dialog, enter a name.

4. (Optional) Enter a description.

5. Click Save.

The saved custom collection is displayed in the Collections table (select Inventory > Collections).

Saving a custom collection may take some time.

Creating a Custom Alert from a Collection

A custom alert monitors a collection and notifies you when new items are added to it. You can create a custom alert from a system or custom collection.

This feature is not available for custom collections created from the Computers inventory.

To create a custom alert from a collection:

1. Select Inventory > Collections, then choose the Custom or System tab.

2. Click an empty area of the collection's row to open its side panel.

3. Select Actions > Create custom alert.

   The Create Custom Alert page opens, with the collection already selected.

4. In Name, enter a name for the alert.

5. (Optional) In Description and Recommendation, enter the text the alert displays. To insert a variable, click Add Variable.

6. Select a Severity and a Category.

7. (Optional) Select MITRE Tactics & Techniques.

8. Click Save.