> For the complete documentation index, see [llms.txt](https://docs.oort.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.oort.io/campaigns.md). # Campaigns {% hint style="info" %} ## Campaigns are currently in Beta. The feature is still evolving - Functionality is subject to change and bugs may be present at this time. {% endhint %} ## Overview Campaigns give your security team a structured way to track and drive the remediation of related issues that address certain business goals, across a specific segment of users, apps, etc. business goals are often associated with important compliance or security frameworks. With Identity Intelligence's templated Campaigns, it is quick to get started, so your team can begin resolving issues that are often associated with important compliance topics or security frameworks.\ \ Rather than continuously monitoring individual checks for your entire user base, a Campaign allows you focus on a related set of issues for a targeted audience, set a clear timeframe, and measure progress. At the end of the campaign, you have a before-and-after picture of your remediation effort, and a clear understanding of how the security posture of that group actually improved. Currently, Identity Intelligence only supports User-based Campaigns; however, we are in active development for **App Campaigns**, which would allow teams to run Campaigns associated with common compliance and audit related application issues such as app access reviews or improper app assignment. Contact your Duo Care representative or Support to sign up as an Alpha tester and the Identity Intelligence team will reach out to you when it's ready! This article: * [Defines key campaign terminology and concepts](#key-campaign-terminology-and-concepts) * [Describes how to create a Campaign using Identity Intelligence's pre-configured templates](#creating-a-campaign) * [Explains how to build a custom Campaign from scratch](#creating-a-campaign-from-scratch) * Describes how to [manage the different campaign states ](#managing-a-campaign)and how to [investigate the results and monitor the progress of active campaigns](#monitoring-a-campaign) *** ### Key Campaign Terminology & Concepts An entity is included in a Campaign if they meet both the Check Conditions **AND** the Audience criteria selected when you start your campaign. Depending on the Discovery Mode chosen for a campaign, entities that newly match both criteria could also be added after the campaign has started.\ \&#xNAN;***Note**: Only User-scoped Campaigns are currently supported, so only user based checks and audiences can be selected at this time.* This section explains the different terminology used throughout the Campaign's interface, as well as the logic used to determine what entities are included in your campaign. ***Populations*** Often times, a single check can have thousands of users failing and resolving each one can feel like an impossible hill to climb. The Populations criteria focuses a Campaign on a smaller, actionable segment based on priority, business case, clean up process, responsible team, etc. and helps motivate your team towards making real progress on the goal.\ \ The Population Criteria is part of the required criteria used to define the set of entities you would like to run your campaign on. This is defined by selecting a pre-defined population segment.\ \ Identity Intelligence currently provides the following pre-configured populations to choose from: * **Priority Accounts:** Accounts listed as an Admin of at least one connected Identity Source and/or those who have Executive level titles (eg: Chiefs, President, VPs, etc.) * **Non-Human Identities (NHIs)**: Accounts that have been classified as Non-Human Identities such as Service Accounts, Mailboxes, Conference Rooms, Agentic Accounts, Break Glass Accounts, etc. * **Privileged NHIs:** Accounts classified as NHIs that also have Admin privileges in at least 1 connected Identity Source * **External Accounts:** Accounts that have been classified as external to your organization (eg: Guest accounts, Contractors, Contingent Workers, etc.) * **Employees:** Accounts with an Employee ID populated in a connected Identity Source or HR Information system ***Check Conditions*** The checks selected for a given campaign are also part of the criteria used to determine which entities are included in the campaign. A campaign measures success by evaluating one or more security checks against your scoped target population. Campaigns are most effective when multiple, related checks are combined into one campaign project.\ \ An entity is added to the campaign and considered "failing" the campaign if they fail **any** of the checks included in your campaign. For the entity to be fully resolved from the campaign, they must pass all the selected checks that were configured.\ \ \&#xNAN;***Discovery Mode*** The results of your campaign can be configured to be **static** or **dynamic. Both static and dynamic c**ampaigns will have their results updated when a failing entity is resolved; however, the discovery mode determines how entities that match the campaign criteria after a campaign has started will be handled. In a **static** campaign, the entities that are included are determined once the campaign is started and will not change. In a **dynamic** campaign**,** the entities that are included will be re-evaluated continuously and may change. If there are entities that meet *both* the audience and check criteria *after* the campaign has started, they **would** be added to a dynamic campaign. ***Duration*** The number of days the campaign runs. Once this period expires, the campaign automatically changes to a **Completed** state and moves to the Archived tab. ***Campaign States*** More detailed info on each state is provided below in the [Managing a Campaign](#managing-a-campaign) section * **Draft**: Created but not yet started. Can be edited, started or deleted * **Running**: Campaign is in progress and actively tracking selected audience against the configured checks * **Paused**: Temporarily halted. Will automatically resume after 7 days * **Completed**: Configured duration has reached its end date. Campaign is now read-only * **Cancelled**: Manually stopped Campaign before reaching the configured end date * **Archived**: Completed or cancelled campaigns older than 30 days There is a maximum of 10 campaigns **running** at the same time. You will not be able to start a new campaign until 1 of the 10 active campaigns is completed, either automatically or manually cancelled. *** ## Creating a Campaign Identity Intelligence provides two methods for creating a Campaign - **Templates** and **Custom** **Campaigns**. **Templates** The **Templates** tab on the Campaigns listing page provides over 10 pre-configured campaigns aligned to common compliance frameworks and security initiatives. Each template comes with a curated set of checks, giving your team a quick and simple starting point that focuses on resolving common security issues or audit requirements, with significantly less manual configuration required. Templates can be filtered by common frameworks & regulations or searched by keyword.
**Custom Campaigns** Identity Intelligence also provides the option to create custom campaigns, that allow you to select your desired checks and population scoping.\ \ We recommend running a few campaigns using the provided Templates to familiarize yourself with the process and outputs, before creating custom campaigns. ### **How to create a campaign** The steps below describe how to create a campaign, using either a [templates](#starting-from-a-template) or [custom campaign](#creating-a-campaign-from-scratch) method. **Note**: The configured Populations and check conditions within your campaign cannot be changed after a campaign has started. #### Starting from a Template To create a campaign using a template: 1. Using the left-hand menu, navigate to **Campaigns** 2. Then navigate to **Templates** using the available tabs 3. Browse the available templates or search for a template focused on a particular issue by either using the Search bar and entering key words or the regulation filter to narrow the options down by compliance framework 4. Once you have found a template of interest, select the **Use Template** button on the given template card 5. A **New Campaign** form will opens. The form will be pre-populated with the template's name, description and duration. Modify any of these fields as needed 6. Select your desired [**Discovery mode** ](#key-campaign-terminology-and-concepts)**- Static** or **Dynamic** 7. The Campaign form will be pre-populated with the relevant Checks and Population. It is recommended that you leave these fields "as is" and do not modify them. Entities who are failing any of the selected checks AND match the population criteria will be included in the campaign * Under the list of configured populations, you will see the count of entities included in that population. If you would like to review which entities are included in a given population, select the **Open in New Tab** icon to pivot to the relevant entity view, pre-filtered on the selected population 8. Towards the top of the Campaign form, select the **Start Campaign** button to start the campaign immediately, or the **Save as Draft** button to create a draft campaign that can be edited or started at a later date * Starting a Campaign will only generate the results of your campaign so you can begin working through the impacted entities. It will not take any automated actions or contact any end users #### Starting from a custom campaign To build a campaign from scratch: 1. Using the left-hand menu, navigate to **Campaigns** 2. Select the **New Campaign** button found towards the top of the page on either the Active, Template or Archived tabs 3. Enter the desired **name** and **description** for the campaign 4. Set the **duration** in days 5. Select the desired[ **Discovery Mode** ](#key-campaign-terminology-and-concepts)**- Static** or **Dynamic** 6. Select the desired **checks** to scope the campaign on. The selected checks will define what it means for an entity to be compliant within the campaign 1. *Recommendation*: Select 3-5 checks related to similar topics or business issues 2. It is not recommended to run a campaign on only 1 check, or many checks, as both approaches will not produce a valuable campaign. If there are too many checks in a campaign, it will be difficult for your team to make progress, while a campaign with just one check can hide opportunities to address similar issues impacting the same user with 1 one-time fix 7. Choose a predefined **population** to scope the campaign on. Entities that are failing **any** of the selected checks **AND** match the population criteria will be included in the campaign 1. Under the list of configured populations, you will see the count of entities included in that population. *Recommendation*: Select a population size that is manageable and that your team can make real progress during the given Campaign duration time 2. If you would like to review which entities are included in a given population, select the **Open in New Tab** icon to pivot to the relevant entity view, pre-filtered on the selected population 8. Towards the top of the Campaign form, select the **Start Campaign** button to start the campaign immediately, or the **Save as Draft** button to create a draft campaign that can be edited or started at a later date 1. Starting a Campaign will only generate the results of your campaign so you can begin working through the impacted entities. It will not take any automated actions or contact any end users Refer to the subsequent sections on [Managing a Campaign](#managing-a-campaign) and [Monitoring a Campaign](#monitoring-a-campaign) to learn more about interacting with a campaign and reviewing the results of a campaign. *** ## Managing a Campaign As mentioned in the [Key Campaign Terminology & Concepts](#key-campaign-terminology-and-concepts) section of this article, there are multiple campaign states that exist - [Draft](#draft-campaigns), [Running](#running-active-campaigns), [Archived](#archived-campaigns). Below you will find more detailed in on the different states and what actions are available from each state. #### **Draft Campaigns** If you selected **Save as Draft** at the end of the campaign creation process (either using a template or custom campaign), the campaign is not yet running and can be modified, deleted or started at a later point. All **Draft** Campaigns can be found on via the **Drafts** tab on the Campaigns page.To start, edit or delete a draft campaign: 1. Navigate to the **Drafts** tab on the Campaigns page 2. Select the **3-dot** button in the top right corner of the card for the desired draft campaign 3. Select the desired action you want to take from the available menu * **Start** Campaign: Moves the selected campaign to [**Running**](#running-active-campaigns) state and generates results * **Edit** Campaign: Launches the campaign configuration form for the selected campaign. From this page, the campaign settings/criteria can be modified, or the campaign can be started or saved as a draft again * **Delete** Campaign: Erases the selected campaign and moves it to the Archived tab. A modal will pop-up asking you to confirm that you'd like to delete the draft campaign. Select the appropriate response to proceed with the action, or select *Cancel* to prevent the action from happening
#### **Running/Active Campaigns** **Running** After you have started a campaign, it will move to an active, or **Running** state, and will be accessible via the **Active** Tab on the Campaigns page alongside all other running campaigns. You cannot have more than 10 campaigns running at once; therefore, you will not be able to create new campaigns if there are already 10 active campaigns. To learn more about reviewing the results of an active campaign, refer to the [Monitoring a Campaign](#monitoring-a-campaign) section of this article. Once a campaign is running, it can be manually paused or canceled if needed. **Pause**\ A campaign can be temporarily paused if, for example, there is a holiday, further discussion is needed regarding the campaign results, etc. Paused campaigns remain visible on the **Active** tab.\ \ A campaign will stay paused for 7 days, after which it will be automatically resumed and put back into a running state. Paused campaigns can also be manually resumed anytime before the 7-day window. Pausing a campaign **does not** add back the paused days to the campaign's end date. The end date will remain the same as what was determined based on the campaign start date + the configured duration (in days) **Cancel** A running or paused campaign can be cancelled if, for example, there was a mistake in the configuration, it is no longer needed, etc. After a campaign has been cancelled, it will be moved to the [**Archived**](#archived-campaigns) tab. Cancelling a campaign will stop it from running completely and end the campaign. The results of the campaign will reflect whatever progress was made, until the moment it was cancelled.\ \ Once a campaign is cancelled, this action cannot be undone. A cancelled campaign cannot be manually restarted from the point where it left off; however, the same campaign can be re-triggered from the beginning using the **Run Again** action mentioned below To cancel, pause or resume a campaign: 1. Navigate to the **Active** tab on the Campaigns page 2. Select the **3-dot** button in the top right corner of the card for the desired campaign 3. Select the desired action you want to take from the available menu 4. After you have selected an action, a modal will pop-up asking you to confirm that you'd like to the chosen action. Select the appropriate response to proceed with the action, or select *Cancel* to prevent the action from happening
#### Archived Campaigns A campaign is considered "done" either once it has reached it's configured duration date, or if it has been manually cancelled before reaching its end date. The results of a completed campaign are always stored and can be referenced after the campaign has finished. Once a campaign is "done", the campaign will automatically move to the **Archived** tab. In the Archived tab, you will see a list of all the completed campaigns, including the configured Campaign name and description, a status column that indicates how the campaign finished, how many entities were included at the start of the campaign compared to how many remained at the end of the campaign, the percent improvement (if applicable), and the campaign end date.\ Select the arrow next to a given header name to sort the campaigns in the table by that value.\ \ Every campaign in the Archived table will have a status that indicates how the campaign finished. Below are the different statuses and definitions used for finished campaigns: * **Completed**: Indicates a campaign ran until its end date, or all failing entities in a *static* campaign were resolved, and was automatically ended. Campaigns maintain a Completed status if it has been 30 days or less since the campaign finished * **Archived**: On day 31 and beyond, campaigns that previously had a **Completed** status have their status automatically updated to **Archived** to help distinguish between recent and older campaigns * **Cancelled**: Indicates that a campaign was manually terminated before reaching its end date. Cancelled campaigns will ***always*** stay labelled as Cancelled and ***never*** move to an Archived status, regardless of its cancellation date There are several actions that can be taken from the Archived tab for any finished campaign, regardless of its completion status, using the **3-dot button** found on the righthand side of a row for each campaign * **View Details:** Navigate to the [**Campaign Details page**](#campaign-details-page) to review the results of a finished campaign. You can also select the name of a given campaign to navigate to the same place * **Delete Campaign:** Removes all history and results of a given campaign from the Archived tab so it will no longer be visible. **A deleted campaign cannot be recovered**. You will be prompted to confirm this action before it takes effect * **Run Again:** Launches a **New Campaign Form** with the exact same metadata and settings as the finished campaign so that you can quickly start a new campaign to resolve the same issue at a later date (for example: running a quarterly account clean up campaign)
*** ## Monitoring a Campaign After you have started a campaign, it will aggregate the results based on the configured checks and audience criteria, and populate this information into a unified view that makes it easy to track progress and quickly identify what entities need to be investigated and resolved. ### **Campaign Details page** To see the results of a given campaign, navigate to the **Active** tab of the Campaigns page. On this page, you will see card-like widgets. Each card represents a campaign that is currently [running](#running-active-campaigns), and includes some basic info about that campaign (i.e. description, audience criteria, due date, etc) to help you distinguish amongst the different active campaigns.\ \ Locate the card associated with the campaign you want to review. Then, select the **View details** button within that card to open the **Campaign Details** page for the desired campaign. The campaign details is divided into two tabs that provide valuable information to track, monitor and take action on the results of a campaign: * [**Overview**](#overview-tab) * [**Users**](#users-tab) (Not visible while a campaign is paused) #### Overview Tab The Overview tab provides high-level information and critical data regarding a given campaign across several widgets. This tab remains visible even when a campaign is done, so that you can refer back to the results and see what progress was made. ***Campaign Status & Risks***
The **Campaign status** widget shows the overall progress and state of a campaign at a glance, including: * A progress bar showing resolved entities compared to the total failing population * Days remaining in the campaign before it completes, as well as the campaign's specific start and end date The **Risks** widget displays the current number of failing entities. Select the number to navigate to the [Users](#users-tab) tab which contains detailed info about the entities that need to be resolved for the campaign to pass. In a dynamic campaign, entities that are added to the campaign after the campaign has started will be added to the relevant failing entity counts. ***Population & Checks Criteria*** Within the **Population** widget, you can reference the campaign's configured [discovery mode and audience criteria](#key-campaign-terminology-and-concepts), while the **Checks Criteria** widget displays the check conditions. The information displayed in both of these widgets determines what entities are included in a given campaign.
***"Failing Users per Check" Trend Over Time chart*** This widget displays a stacked area chart that shows how many entities are failing each day, broken down by check, making it easy to measure and track your team's progress resolving campaign issues over time. ***Note***: If the campaign has fewer than two days of data, the chart displays a "Not enough data" message. This is a common and expected message to see when a campaign has just started If you hover over any point in the chart, a tooltip will be displayed with the date of that point and the count of failing entities, per check.\ \ You can also select the name of a check from the chart's key to remove that data associated with that check from the chart. To add the data back to the chart, simply select the check name again.
***Tickets*** Identity Intelligence natively integrates with ticketing platforms, [ServiceNow](/integrations/servicenow-integration.md) and [Jira](/integrations/jira-integration.md), allowing you to open tickets regarding the entities included in an active campaign so that follow up tasks and investigations can be assigned to the relevant parties and tracked in your preferred tool. Scroll through the table to see all the tickets that have been manually created throughout the campaign, including the ticket name, state, created date, last updated date (UTC), assignee, and priority/urgency where available. Hover over a date to display a tooltip containing your local time.\ \ Select a name of a given ticket to open that ticket directly in your external ticketing system via a new tab. If a ticketing system is already integrated to Identity Intelligence, you can open new tickets via the [**Users**](#users-tab) tab or by selecting the **Open Tickets** button in the table. If there is no ticketing service currently integrated to Identity Intelligence, the table will be blank and display a **Configure Ticketing Services** button that links to the [**Integrations**](/integrations.md) setup page. Refer to our [ticketing system documentation](/integrations.md#ticketing-and-response-workflows) to find the integration instructions for your desired ticketing system. ***Notification Target settings*** {% hint style="warning" %} If a notification channel is configured, notifications about new entity failures will ***ONLY*** be sent for **Dynamic** campaigns. Currently, notifications will ***NOT*** be sent for **Static** campaigns, even if a channel is configured on a static campaign {% endhint %} Lists the notification targets that are currently enabled to receive alerts regarding the given campaign, as well as other integrated channels that can be enabled if desired. If no notification targets exist, an **Add Integrations** button will be displayed, which links to the [Integrations ](/integrations.md)setup page. Review the [Notification Target documentation](/integrations.md#notifications-and-outbound-integrations) to see what notification methods Identity Intelligence supports and to find the detailed set up instructions for each option. After you have connected a notification target, it will become visible in this widget.\ \ If notification targets already exist, but are not enabled on a campaign - Toggle the checkbox to enable (or disable) a specific notification channel to receive alerts regarding new entity failure within this campaign. Multiple notification targets can be configured on the same campaign, and the same notification target can be configured across campaigns as well. If a notification target has been disabled globally, a warning icon appears with a tooltip explaining why it cannot be enabled. #### Users Tab The **Users** tab within the Campaign Details view shows every entity that met the campaign check ***and*** population criteria, as a matrix where rows rows represent the checks configured in the campaign, and columns represent individual users.\ \ Each cell shows that user's current status for a given check, making it incredibly easy to identify when a given user requires multiple actions to be taken at once, streamlining the remediation process. The data in this table will not be available after a campaign has completed.
***Understanding a Check's Status*** Each cell in the matrix shows one of three states: * **Failing -** The red badge displayed indicates the given entity is currently failing the given check. Select the **Failing** text in the cell to open the **Check Explainability** panel (more details below) * **Resolved -** Indicates the entity was previously failing a given check, but has since passed. The date in the cell represents when the issue was no longer failing * Note: If an entity is failing more than one check included in a campaign, they must be resolved in **ALL** checks to get marked as "passing" in the **overall** campaign results * **Passing** - Indicates that this entity was not failing the given check when the campaign was started and is also not currently failing the check ***Check Explainability Panel*** Clicking a **Failing** label within the table opens a side panel with full explainability for why that entity is failing that specific check. The explainability side panel available within the table for Campaigns is identical to the explainability side panel for that same check throughout the UI. The content in the explainability panel varies check to check based on what information is relevant for a particular check. Generally it includes suggested remediation steps specific to this check failure, metadata or attributes about the failing entity, contextual data that explains what caused the failure, such as event details, locations, or access patterns, etc. Many of these elements can also be interacted with to further dive into even more detailed info.\ \ Refer to our documentation on [check explainability](/understanding-check-failures/reviewing-check-results.md#diving-deeper-into-a-check-failure) to learn more about the side panel and the data within it.
***Available Actions*** * **Search -** Use the search bar, found above the failing entities table Users table to quickly locate a specific entity using their name or login info using free-text queries * **Toggle for Failing Users only** - By default, the table is set to "Failing Users Only" and loads only entities with at least one failing check, based on the configured population and check criteria. Use the toggle found directly above the table headers to toggle the results in the table back and forth between "Failing Users only" and "All Users" * "All Users" will display any entities in the Campaign that have been resolved thus far, as well as users who matched the audience criteria, but not the check criteria and were therefore not included in the campaign * **Download as CSV -** If you need to share campaign data with other colleagues offline or do additional data analysis on the findings, Identity Intelligence supports downloading the results as a CSV. To do so: * Select the **Download** icon, on the right-hand side of the table, above the column headers, to generate a download link that includes data for all the failing entities per each check and the respective explainability * Once the CSV is ready, an email reminder will be sent to the email associated with your Identity Intelligence role so you can come back to the interface and download the CSV * **Share -** Select the **Share** icon towards the top of the page to generate a link with the specific URL for a given campaign. Use the link as a bookmark or provide it to team members for quick access to the exact page and campaign you are looking at * **Creating Tickets -** As mentioned above, Identity Intelligence supports opening tickets regarding the failing entities in a campaign within [Jira](/integrations/jira-integration.md) or [ServiceNow](/integrations/servicenow-integration.md). Identity Intelligence stays in sync with the ticketing system and will update tickets accordingly ***Creating Support Tickets for campaign results*** Once you have connected your org's ticketing system to Identity Intelligence, follow the steps below to open a ticket: 1. Select the checkbox next to the name for one or more entities. You can select up to 50 users at a time 1. The blue bar at the top of the table displays how many entities are currently selected and provides an **Uncheck All** button if needed 2. Once you have chosen the desired entities, select the **Open Ticket** button in the blue bar above the table to open the Ticket Creation Form 3. Fill in the fields from the Ticket Creation Form accordingly 1. **Ticket Mode -** Allows you to choose between creating a single unified ticket covering all selected entities, or one individual ticket per selected entity (ie: 1 ticket covering 50 users or 50 tickets covering 50 users) 2. **Ticketing Service -** If only one ticketing service is configured, this field will be automatically populated with the relevant info. Otherwise, select the desired ticketing integration 3. **Description -** Allows you to add a free-text description for the ticket content that will be displayed in your ticketing system 4. Select **Confirm** to create the tickets. A success notification confirms how many tickets were created. The check box selection will be cleared, and the table refreshes to show the new ticket counts against each entity. If no ticketing services have been configured, the form shows a **Configure Integrations** button that links to the Integrations setup page.
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://docs.oort.io/campaigns.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.