Aggregation Report

Generate a health report on SailPoint ISC source aggregations by querying the Search API for source_management events.

How it works

The report queries aggregation events from the ISC Search API and breaks them down into actionable sections. This gives a quick picture of which sources are healthy and which need attention.

Running the report

Execute the bundled script at scripts/report.sh (located in the same directory as this SKILL.md). It accepts an optional time period argument — the default is 1w (one week).

bash <skill-dir>/scripts/report.sh         # last 7 days
bash <skill-dir>/scripts/report.sh 1d      # last 24 hours
bash <skill-dir>/scripts/report.sh 30d     # last 30 days

Important: `sail api` output quirk

The sail CLI sends JSON response bodies to stderr, not stdout. It also mixes in log lines (timestamped) and a Status: line. The bundled script handles this, but if you need to run sail api commands directly, always filter like this:

sail api get "/v2025/sources" 2>&1 | grep -v '^[0-9]\{4\}/' | grep -v '^Status:' | grep -v '^Error:'

For POST requests, sail api post requires the --body flag (even if the body is empty):

sail api post /v2025/search --body '{"indices": ["events"], "query": {"query": "..."}}' 2>&1 | grep -v ...

Report sections

The report output contains four sections:

Event Summary — Total counts by action type (started, passed, failed) to get a high-level view
Account Aggregation per Source — Success rate for each source's account aggregation, sorted by failures first so problem sources are immediately visible
Entitlement Aggregation per Source — Same breakdown for entitlement aggregation
Failing Sources — Details on every source that had failures: source ID, failure count, last failure timestamp, and which aggregation types failed. This is the section to focus on for troubleshooting

Interpreting the results

A source showing 0/N passed, N failed is completely broken and needs immediate attention (likely a connector config issue — missing credentials, unreachable endpoint, etc.)
Occasional failures mixed with passes may indicate intermittent connectivity or timeouts
Sources with [gov-async-ent] prefix are governance-triggered entitlement aggregations
The search API returns events up to 90 days old

Follow-up actions

After identifying failing sources, common next steps:

Test connector health: sail api post /v2025/sources/<sourceId>/connector/check-connection --body '{}'
Check source config: sail api get /v2025/sources/<sourceId>
Check source health: sail api get /v2025/sources/<sourceId>/source-health

aggregation-report