This guide walks you through connecting your Saviynt Identity Governance and Administration (IGA) platform to TruU TOTAL for persona generation and threat detection.

Overview

TOTAL ingests identity governance events from your Saviynt instance via the Saviynt REST API. We poll the audit log and access request endpoints on a configurable interval to collect, normalize, and correlate access governance events — including access requests, approval workflows, entitlement changes, role assignments, certification campaigns, and policy violations. Connector Type: Polling

Prerequisites

Saviynt Administrator access with permission to create service accounts and manage API access
Saviynt Enterprise Identity Cloud (EIC) instance with active users and governance workflows
API access enabled on your Saviynt tenant
Approximately 15 minutes to complete setup

Step 1: Identify Your Saviynt Instance URL

Sign in to your Saviynt Admin Console
Your instance URL follows the format https://your-company.saviyntcloud.com
Paste the Base URL into the TruU Portal

Step 2: Create a Service Account

In the Saviynt Admin Console, navigate to Admin → Identity Repository → Users
Click Create User
Enter:
- Username: truu-total-integration
- Email: Your TOTAL admin contact email
- User Type: Service Account
Click Save
Set a strong password for this account

Step 3: Grant API Permissions

Navigate to Admin → SAV Roles
Create or assign a role with the following API permissions:
- Read Audit Logs (/ECM/api/v5/getAuditLogs)
- Read Access Request History (/ECM/api/v5/getRequestHistory)
- Read User Data (/ECM/api/v5/getUser)
- Read Entitlements (/ECM/api/v5/getEntitlements)
- Read Roles (/ECM/api/v5/getRoles)
- Read Certification Data (/ECM/api/v5/getCertificationData)
Assign this role to the truu-total-integration user
Click Save

All permissions are read-only. TOTAL cannot create, approve, or modify access requests or governance workflows.

Step 4: Enter Credentials in the TruU Portal

In the TruU Portal, navigate to Settings → Connectors → Add Connector → Saviynt and enter:

Saviynt Base URL: https://your-company.saviyntcloud.com
Username: truu-total-integration
Password: The service account password

Click Test Connection to verify. TOTAL will authenticate and confirm access to the audit log endpoints.

Security & Privacy

What We Access

Read-only access to Saviynt audit logs and access request history via REST API
Queries use timestamp filtering — we only fetch new events since the last poll
All API calls use HTTPS (TLS 1.2+)

What We Don’t Have Access To

Write access to your Saviynt instance
Ability to create, approve, or reject access requests
Access to user passwords or Saviynt configuration
Administrative functions or policy management

Updating or Rotating Credentials

Rotate Password (Recommended: Every 90 days)

In Saviynt Admin Console, navigate to Identity Repository → Users
Find the truu-total-integration user
Reset the password
Paste the new password in the TruU Portal under the Saviynt connector settings
Click Test Connection to verify

Revoke Access

To immediately remove TOTAL’s access:

Option A — Disable in the TruU Portal:
- Go to the TruU Portal → Settings → Connectors
- Find the Saviynt connector and click Disable
Option B — Disable the service account:
- In Saviynt, navigate to Identity Repository → Users
- Find truu-total-integration and click Disable
Option C — Delete the service account:
- Find truu-total-integration and click Delete

Rate Limiting & Scalability

Saviynt API Rate Limits

Parameter	Limit
API requests	Tenant-level throttling (no published fixed limit)
Audit log page size	Configurable per request
Throttle response	HTTP 429 with retry guidance

Ingestion Capacity

IGA events are inherently low-volume. A large enterprise with 100K+ users typically generates 1K–15K Saviynt events/day (with spikes up to 50K during certification campaigns). At ~5–10 req/s practical throughput, TOTAL has orders of magnitude of headroom above expected volume. Rate limiting is rarely a factor for this signal class.

Event Freshness

Events appear in the Saviynt audit log within seconds to low minutes. TOTAL polls on a configurable interval (default: 5 minutes). End-to-end latency is typically under 10 minutes.

Resilience

TOTAL uses cursor-based ingestion with at-least-once delivery. The polling cursor only advances after events are successfully collected, normalized, and published. If any step fails, the cursor stays put and the next poll replays from the last known-good position. No events are lost. Transient failures (429s, 5xx, timeouts) are retried automatically with exponential backoff. After 5 consecutive failures, the connector self-pauses and can be re-enabled from the TruU Portal. On recovery from an extended outage, TOTAL resumes from its last cursor — Saviynt retains audit logs for the configured retention period.

Connector Design

Each connector polls on an independent, configurable interval. Events are batched and published in per-user order to preserve sequence integrity for persona building. Connector workers are stateless and scale horizontally. All polling intervals, page sizes, and batching parameters are tunable from the TruU Portal.

Part 2: Event Types & Data Schema

Signal Classification

Signal Class	TOTAL Category
Identity Governance (IGA)	Admin, Access

Event Types We Ingest

TOTAL extracts the following categories of events from Saviynt. Every event ingested is tied to a specific human identity — either the user performing the action or the user being acted upon. System-level events (campaign launches, configuration changes, report generation) that cannot be attributed to a specific person are excluded.

Access Request Events

Saviynt Event Type	Description	TOTAL Classification
`Request Submitted`	User submits a new access request	Access
`Request Approved`	Access request approved by approver	Access
`Request Rejected`	Access request rejected by approver	Access
`Request Auto-Approved`	Access request auto-approved by policy	Access
`Request Escalated`	Access request escalated to next approver	Access
`Request Expired`	Access request expired without action	Access
`Request Cancelled`	Access request cancelled by requester	Access

Entitlement & Role Events

Saviynt Event Type	Description	TOTAL Classification
`Entitlement Granted`	Entitlement provisioned to user	Admin
`Entitlement Revoked`	Entitlement removed from user	Admin
`Role Assigned`	Role assigned to user	Admin
`Role Removed`	Role removed from user	Admin
`Entitlement Auto-Provisioned`	Entitlement provisioned by birthright rule	Admin
`Entitlement Auto-Revoked`	Entitlement revoked by lifecycle rule	Admin

User Lifecycle Events

Saviynt Event Type	Description	TOTAL Classification
`User Created`	New user provisioned in Saviynt	Admin
`User Updated`	User attributes modified	Admin
`User Disabled`	User account disabled	Admin
`User Enabled`	User account re-enabled	Admin
`User Terminated`	User terminated and deprovisioned	Admin
`Account Created`	Application account created for user	Admin
`Account Disabled`	Application account disabled	Admin
`Account Deleted`	Application account deleted	Admin

Certification & Compliance Events

Saviynt Event Type	Description	TOTAL Classification
`Access Certified`	Reviewer certified a user’s access as appropriate	Admin
`Access Revoked (Certification)`	Reviewer revoked a user’s access during certification	Admin
`Certification Escalated`	Certification item for a user escalated to next reviewer	Admin

SoD & Policy Violation Events

Saviynt Event Type	Description	TOTAL Classification
`SoD Violation Detected`	Segregation of Duties violation detected	Alert
`SoD Violation Approved`	SoD violation approved with exception	Alert
`SoD Violation Mitigated`	SoD violation mitigated with compensating control	Alert
`Policy Violation`	Governance policy violation detected	Alert
`Risk Score Changed`	User risk score changed	Alert

Audit Trail Events

Saviynt Event Type	Description	TOTAL Classification
`Admin Login`	Administrator logged into Saviynt	Authentication
`Bulk Action Executed`	Admin executed bulk provisioning or deprovisioning affecting users	Admin

Sample Source Event (Saviynt Audit Log)

{
  "id": 1048576,
  "action": "Request Approved",
  "objectType": "AccessRequest",
  "objectName": "REQ-2026-00451",
  "performedBy": "john.manager@acme.com",
  "performedFor": "jane.doe@acme.com",
  "performedOn": "2026-03-15T10:22:45.000Z",
  "details": {
    "requestId": "REQ-2026-00451",
    "requestType": "Add Access",
    "entitlementName": "AWS-Admin-ReadOnly",
    "entitlementType": "Role",
    "applicationName": "AWS Production",
    "justification": "Quarterly audit review requires read access to production logs",
    "riskLevel": "Medium",
    "approvalLevel": 2,
    "approverComments": "Approved for 90-day window per policy",
    "expirationDate": "2026-06-15T00:00:00.000Z"
  },
  "sourceIP": "10.0.1.45",
  "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)",
  "status": "SUCCESS",
  "timestamp": "2026-03-15T10:22:45.000Z"
}

TOTAL Normalized Event

{
  "event_id": "b2c3d4e5-f6a7-8901-bcde-f23456789012",
  "event_type": "ACCESS",
  "source": "SAVIYNT",
  "signal_type": "IGA",
  "domain_id": "customer-domain-001",
  "tuid": "tuid-jane-doe-001",
  "timestamp": "2026-03-15T10:22:45.000Z",
  "payload": {
    "event_id": 1048576,
    "user": "jane.doe@acme.com",
    "action": "Request Approved",
    "request_id": "REQ-2026-00451",
    "request_type": "Add Access",
    "entitlement": "AWS-Admin-ReadOnly",
    "application": "AWS Production",
    "approver": "john.manager@acme.com",
    "risk_level": "Medium",
    "status": "SUCCESS"
  },
  "raw_metadata": {
    "platform_event_id": "1048576",
    "action": "Request Approved",
    "object_type": "AccessRequest",
    "object_name": "REQ-2026-00451",
    "performed_by": "john.manager@acme.com",
    "performed_for": "jane.doe@acme.com",
    "request_type": "Add Access",
    "entitlement_name": "AWS-Admin-ReadOnly",
    "entitlement_type": "Role",
    "application_name": "AWS Production",
    "justification": "Quarterly audit review requires read access to production logs",
    "risk_level": "Medium",
    "approval_level": 2,
    "approver_comments": "Approved for 90-day window per policy",
    "expiration_date": "2026-06-15T00:00:00.000Z",
    "source_ip": "10.0.1.45",
    "status": "SUCCESS",
    "created_at": "2026-03-15T10:22:45.000Z",
    "source_platform": "saviynt"
  },
  "platform_event_id": "1048576",
  "platform_event_source": "SAVIYNT_API"
}

How This Feeds TOTAL

Persona Building

Saviynt events define the access boundary of each user’s persona. By tracking which entitlements, roles, and applications a user has been granted access to — and the governance workflows that authorized that access — TOTAL builds a precise model of what each identity should be doing. This separates baseline user behavior from expected privileged actions, particularly for administrators and operators.

Anomaly Detection

TOTAL’s behavioral engine uses Saviynt events to detect:

Abnormal privilege activation — access requests for entitlements outside a user’s historical pattern or job function
Privilege accumulation — gradual buildup of entitlements that collectively represent excessive access
Governance bypass indicators — auto-approved requests that circumvent normal approval chains, or bulk provisioning actions
SoD violations — segregation of duties conflicts that indicate a single identity holds incompatible privileges
Certification anomalies — rubber-stamping patterns where reviewers certify all access without meaningful review
Orphaned access — entitlements that persist after role changes or termination events

Breach Lifecycle Coverage

Saviynt events provide primary coverage across Scope / Lateral Movement and Privilege Escalation stages. By monitoring the governance layer, TOTAL detects when an attacker (or compromised insider) begins expanding their access footprint — often the clearest signal of intent before data exfiltration occurs.

​Overview

​Prerequisites

​Step 1: Identify Your Saviynt Instance URL

​Step 2: Create a Service Account

​Step 3: Grant API Permissions

​Step 4: Enter Credentials in the TruU Portal

​Security & Privacy

​What We Access

​What We Don’t Have Access To

​Updating or Rotating Credentials

​Rotate Password (Recommended: Every 90 days)

​Revoke Access

​Rate Limiting & Scalability

​Saviynt API Rate Limits

​Ingestion Capacity

​Event Freshness

​Resilience

​Connector Design

​Part 2: Event Types & Data Schema

​Signal Classification

​Event Types We Ingest

​Access Request Events

​Entitlement & Role Events

​User Lifecycle Events

​Certification & Compliance Events

​SoD & Policy Violation Events

​Audit Trail Events

​Sample Source Event (Saviynt Audit Log)

​TOTAL Normalized Event

​How This Feeds TOTAL

​Persona Building

​Anomaly Detection

​Breach Lifecycle Coverage