Building Collections

Collections are inventory queries that are saved for future reuse. You can build a collection focused on what matters most to your role and your organization, and track status over time.

Collections are not just a way to avoid writing the same queries every day. They can also be used to build custom dashboards, detection rules, and scheduled reports.

All collections on the Delinea Platform are automatically updated daily, and can also be updated on demand.

ITP-PCCE Collections vs. Computer Collections

This section describes the differences between ITP-PCCE collections and Computer Collections.

Computer Collections

Computer Collections can track only computer assets, and they are described in Computer Collections.

ITP-PCCE Collections

ITP-PCCE Collections can track Access Policies, Activities, Assets, Groups, Identities, Memberships, Privileges, or any combination of these. They can be either System Collections or Custom Collections. Both of these types of collections are described below.

System Collections

ITP-PCCE inventory comes with built-in System Collections, which include account and group definitions that apply system-wide, in all inventories, dashboards, and detection rules.

To view System Collections: 

1. In the left navigation, select Inventory > Collections.

2. Choose the System Collections tab.

The System Collections tab displays a table showing the accounts and groups, and the numbers of each, that match the System Collection definition. For each account and group, the table displays its name, type, and status information. The table also indicates whether the System Collection definitions have been modified from the default settings.

The built-in, default System Collections are as follows:

• Admin Accounts: Accounts with administrator privileges.
  Use the inventory filter Account: Admin Access to find Admin Accounts. For example:

  
  

• Admin Groups: Groups that grant Admin Account privileges to their members. Use the inventory filter Group: Admin Access to find Admin Groups.

• Compliant Admin Accounts: An Admin Account that is deemed compliant according to possession of some extra factor; for example, having an email formatted in a given format such as:

  {full_name}_adm@company.com.

  To find Compliant Admin Accounts, define a query to find all Admin Accounts with the specified email format. The Privileged Accounts dashboard displays all Compliant Admin Accounts along with the number of non-compliant accounts.

• External Accounts: Use the inventory filter Account: Is External to find External Accounts.

• Privileged Accounts: Accounts with privileged access.
  Use the inventory filter Account: Privileged Access to find Privileged Accounts.

• Privileged Groups: Groups that grant privileged access to their members. Use the inventory filter Groups: Privileged Access to find Privileged Groups.

Filtering and Sorting the Collections Table

By default, the collections are sorted by date of creation, in descending order. To change the data displayed in the table, use the filter controls above the table. The selections you make are shown in the filter bar. For more information about the filter and display options, see Inventories User Interface.

To search for a custom collection by name, type text into the search field at the top-right of the table.

Insight into Collections Table Data

To get further understanding of the data in the Collections table:

• The Type column shows which inventory the custom collection was created from.

• The Status column shows the following values:

  • Calculating

  • Exceed results: Results are too large. Run the collection query again with narrower filters to reduce its size.

  • Empty: The search yielded no results.

  • Done

  • Error

• The Results column shows how many entities matched the filters in the custom collection. To see the actual results, click the number in this column.

To see details about a collection, click the collection row in the table. A window opens to show details about the collection, including the query that created the collection, a description (if one was entered when the collection was created), and the last sync date.

The trend line detects rapid changes and shows how your collection changes over time, such as privilege creep, new admins, or shadow admins.

Configuring System Collections

From the System Collections tab, you can:

• Edit a collection: Edit a system collection to customize the values according to your organization’s needs. See Editing a System Collection.

• Duplicate, then modify a collection: Duplicate a system collection and then modify it for other needs. For example, you might want to trigger an alert for more limited matches than are defined by the system collection. See Duplicating and Modifying a System Collection.

• Reset a collection to default values: Set an edited system collection back to the system default. See Resetting a System Collection to Default.

• Calculate collection results: Initiate an immediate calculation of the matched accounts and groups instead of waiting for the next scheduled recalculation. See Calculating Collection Results.

• Create a new detection rule based on a collection: Create a detection rule based on the system collection. See Creating a Detection Rule from a Custom Collection.

Editing a System Collection

You can edit a System Collection to customize the values according to your organization’s needs.

Although you can edit a System Collection definition, remember that a System Collection definition impacts the entire platform, so you must proceed with caution. Consider customizing a System Collection definition only for temporary purposes, and remember to reset the System Collection back to the default values when you are finished. See Resetting a System Collection to Default.

1. Hover over a system collection.

2. From its More menu, select Edit.

3. Edit the filter values.

4. Click Save.

In the Default column, the value changes to Edited. Results will be shown after the next result refresh. To see the results sooner, see Calculating Collection Results.

Duplicating and Modifying a System Collection

You can duplicate a collection and then rename and modify the duplicate for other needs. For example, you might want to trigger an alert for more limited matches than are defined by the original collection.

1. Hover over a system collection.

2. From its More menu, select Duplicate.

3. Edit the filter values and click Save.

The System Collections tab shows only the collections that are defined by the system. Duplicated system collections are displayed in the Custom Collections tab.

Resetting a System Collection to Default

You can set an edited system collection back to the system default values.

1. Hover over a system collection where the value in the Default column is Edited.

2. From its More menu, select Reset.

The collection value returns to the default definition. In the Default column, the value returns to Default.

Calculating Collection Results

When a collection is changed, the platform automatically begins to calculate the accounts and groups that match the definition. While this is taking place, the status value changes to Calculating. You can work elsewhere while the calculation is processed, or you can calculate collection results immediately by using the following steps.

To calculate collection results immediately:

1. Hover over a system collection.

2. From its More menu, select Calculate.

The calculation is initiated immediately. Results are shown as soon as they are ready.

Custom Collections

Custom Collections are not just a way to save you from writing the same queries every day. They can help you focus on what matters most to you in your role within your organization and track status over time.

Custom Collections can also be used to build custom dashboards, scheduled reports, and new detection rules. See Creating a Detection Rule from a Custom Collection.

All Custom Collections on the platform are updated automatically every day, and can also be updated on demand.

To view Custom Collections: 

1. From the left navigation menu, select Inventory > Collections.

2. Click the Custom Collections tab.

   

Saving a Custom Collection

A custom inventory query of cloud service users can be saved for later re-use as a Custom Collection.

To save a custom collection:

1. Filter an inventory table.

2. Click Save.

3. In the Collection Creation dialog, enter a name.

4. (Optional) Enter a description.

5. Click Save.

The saved custom collection is displayed in the Collections table (select Inventory > Collections).

Saving a custom collection may take some time.

Creating a Detection Rule from a Custom Collection

You can create a custom detection rule based on the filter criteria of a Custom Collection.

This feature is not available for custom collections created from the Computers inventory.

To create a detection rule from a custom collection:

1. From the Collection page, open the More menu at the far right of the desired collection, then select Create New Detection Rule.

2. Name the new detection rule, then click Create.

   The Detection Rules page is displayed with the side panel open.

3. From the side panel, configure the detection rule, as described in Setting Detection Rules.