Workflows & Event Handling

12 min

This document details how workflows and event handling operate in Activate Security Group Compliance Manager (SGCM). These define how the product interprets Active Directory changes, determines policy relevance, and executes appropriate actions.

Overview

Workflows and event handlers form the operational core of SGCM. When a change is detected in Active Directory (AD), SGCM determines if it violates compliance policy and then executes a defined workflow to remediate, notify, or log the event.

Workflow Types

SGCM includes several standard workflow templates designed to handle AD synchronisation, change processing, and group membership monitoring.

Workflow	Description
ImportWorkflow	Imports detected changes from AD into the connector space.
ChangeWorkflow	Processes updates and triggers corresponding compliance events.
GroupMemberWorkflow	Handles group membership additions and removals.
FullWorkflow	Runs the import and change workflows in sequence.
FullWorkflowWithGroups	Combines import, change, and group member workflows for continuous monitoring.

Polling Configuration

SGCM runs periodic background polling through the Activate Job Service. This process checks for new changes and executes the configured workflow.

Parameters controlling polling:

Parameter	Description	Default
Connector_PollTime	Interval between Active Directory checks (seconds).	600
PollWorkflow	Name of the workflow executed on each poll.	None

Example: To enable continuous monitoring, copy the FullWorkflowWithGroups parameter and rename it to PollWorkflow under Resources > Active Directory.

Change Handlers

Change handlers define how SGCM processes specific types of changes. Two main change handlers are used:

Change Handler	Description
ADChangeHandler	Processes standard AD object changes such as user or computer updates.
ADGroupMemberChangeHandler	Manages changes to group membership and triggers compliance responses.

ADChangeHandler

The ADChangeHandler is used for directory object changes and provides integration points to other Activate roles or linked data. It supports linking to objects such as managers or departments through defined XML configuration.

Example:

<links> <manager> <scope>=//Roles/System Roles/Users</scope> <match when="managerDomainName"> (samAccountName=%=//Current/managerDomainName%) </match> </manager> </links>

These links can then be accessed within workflows using global variables (for example, =//Links/manager).

ADGroupMemberChangeHandler

This handler monitors group membership changes and determines what type of group event has occurred. It classifies groups by purpose and executes the corresponding event definition.

Group Type	Description
Service Group	Linked to a service using the MasterGroup parameter. Primary control point for service access.
Distribution List	Detected if the group synchronises under Resources/Distribution Lists.
Security Group	Detected if the group synchronises under Resources/Security Groups.

Event Handling

SGCM event handlers define the response when a monitored event occurs. Each event type corresponds to a specific state change within AD.

Event	Description
create	Triggered when a new object or group is created.
add	Triggered when a user is added to a group.
deny	Triggered when an unauthorised membership addition is detected.
remove	Triggered when a user is removed from a group.

Example: Service Group Event Definition

This workflow automatically removes unauthorised additions, creates service instances for valid ones, and deletes services when users are removed.

Notifications and Logging

Event handlers can send notifications or log details for audit.

Example: Notification Event

<notify> <users>=//GroupResource/SecurityGroupManagers</users> <message> <subject>Group Membership Added Alert</subject> <body><![CDATA[ Notification: A user %=//Member% has been added to %=//GroupResource/Group% outside Activate. The user has been removed from the group. Please advise them to request access via Activate. ]]></body> </message> </notify>

Notifications can be directed to roles, teams, or security groups specified in the SecurityGroupManagers parameter.

Global Variables

Global variables are accessible within event handlers and workflows for dynamic data mapping.

Variable	Description
User	Represents a user object if applicable.
Group	Represents a group object if applicable.
Computer	Represents a computer object.
Contact	Represents a contact entry.
Links	Collection of linked directory objects (for example, manager).
RoleLinks	Collection of Activate roles related to the current object.

Audit and Troubleshooting

All SGCM events are recorded within Activate’s audit log, allowing administrators to trace every detected change, workflow execution, and resulting action. For troubleshooting:

Confirm polling frequency under the domain resource.

Check Activate Job Service logs for workflow execution errors.

Review event configuration within Connector_Events parameters.

Summary

SGCM workflows and event handling deliver automated, policy-driven enforcement of security group compliance. By linking change detection with configurable workflows, SGCM ensures all Active Directory modifications are validated, logged, and remediated according to organisational policy.