Skip to main content
Connect Lacework to Oleria to gain continuous visibility into who can sign in to your Lacework console and who holds administrator-level access. Oleria reads user and admin-role data from Lacework’s API v2 - mapping every console user and their account tier in one place - so you can see where admin access is over-provisioned and take action directly from Oleria.
This is a governance-only integration. Lacework has no SCIM 2.0 API, so Oleria connects through Lacework’s native TeamMembers API instead - see Known limitations for what that means for scope. Lacework turns the TeamMembers API off when an account enables RBAC, so this integration works only with accounts that haven’t enabled RBAC. Oleria does not sync Lacework’s security findings, cloud resources, or alerts through this integration.

​
What Oleria discovers

Once connected, Oleria continuously discovers and maps the following from your Lacework account:
  • Users - every console user (“team member,” in Lacework’s terminology) in the connected account or sub-account.
  • Account tier - each user’s tier, either Administrator or User. Accounts that haven’t enabled RBAC have only these two fixed tiers, so they’re the only access distinction Oleria can map.
  • Console activity - sign-in events from Lacework’s audit log, for example OAuth login activity. Only one audit event type is currently confirmed and mapped; other event types are still captured but not yet schematized (see Known limitations).
Accounts that haven’t enabled RBAC have no group or team concept distinct from their user directory, so Oleria does not discover groups for this integration.

​
Prerequisites

  • A Lacework account with API access enabled (standard on all current Lacework/FortiCNAPP plans) that hasn’t enabled RBAC. Enabling RBAC turns off the TeamMembers API that Oleria reads, and the connection then fails to authenticate.
  • A Lacework user with Administrator access to generate an API key. Each Oleria connection covers one Lacework account or sub-account - see Account vs. organization-scoped keys.
A Lacework API key acts as the user it’s assigned to, so a key created under a person’s account stops working if that person leaves and their user is disabled. Create the key as a dedicated user that exists only for Oleria. Don’t enable RBAC to get Lacework service users for this: service users exist only with RBAC, and RBAC turns off the TeamMembers API this integration reads. If you plan to use remediation actions, the dedicated user needs Administrator access to the connected account.

​
Create an API key in Lacework

Lacework is currently being rebranded to Fortinet FortiCNAPP, so console menu names and locations may differ from what’s described below. If a step doesn’t match what you see, search the console for “API Keys” or consult Lacework’s own documentation.
1

Open the API Keys page in the Lacework console

Sign in to the Lacework console as an Administrator and open the API Keys page, typically found under Settings (or your account menu).
2

Generate a new key

Create a new API key. Lacework issues a Key ID and a Secret Key.
The Secret Key is only shown once, at creation time. Copy and store it securely - Lacework cannot show it to you again, and you’ll need to generate a new key if you lose it.
3

Note your account name

Note your Lacework account name - the subdomain in your console URL (for example, mycompany in mycompany.lacework.net, or acme.fra for a regional tenant at acme.fra.lacework.net).

​
Connect Lacework to Oleria

1

Open the integration

Sign in to your Oleria workspace, navigate to Integrations, and select Lacework.
2

Complete the connection form

Fill in the connection form with the credentials from the API key:
3

Authenticate

Select Authenticate to validate and save the integration. Oleria checks the credentials against Lacework before saving.

​
Verify the integration

Confirm the Lacework instance appears on the Connected tab of your Oleria Integrations page with a status of Healthy. After the first sync completes, you can review the discovered users and their account tiers in your Oleria workspace.

​
Account vs. organization-scoped keys

Lacework API keys come in two shapes, and which one you generate changes what Oleria can see:
  • Account-scoped key - generated from a single account’s API Keys page. Oleria sees that account’s users and tiers only.
  • Organization-scoped key - generated from the organization-level API Keys page. Each Oleria connection still covers one sub-account: set Sub-Account to choose it, or leave it blank for the organization’s primary account. To cover several sub-accounts, add one Lacework integration per sub-account (the same key can be reused). Organization admins appear in Oleria as Administrator on every sub-account; Oleria doesn’t show organization-admin status as a separate field.
If your Lacework tenant isn’t part of an organization with multiple sub-accounts, this distinction doesn’t apply - generate the key from your account’s own API Keys page.

​
Remediation actions

Beyond discovery, Oleria can act on Lacework access to remediate risk. Remediation actions require the API key’s owning user to be an Administrator of the target account (or an organization admin, for an organization-scoped key). Only the Administrator tier can be granted or removed. Every member holds the User tier, so Oleria rejects role actions on it - use Disable user to remove a member’s access instead.
After Grant Administrator tier or Remove Administrator tier, Oleria reads the user back from Lacework. If the tier didn’t change, the action fails right away. Make the change in the Lacework console instead.
An organization admin’s admin-level access can’t be removed through this integration’s account-level role action. Lacework requires that change to be made directly in the console. Because Oleria shows organization admins as Administrator, you can’t tell them apart in Oleria before running the action - if it fails with an organization-admin error, make the change in the console.
Oleria refuses Disable user on the Lacework user that owns this integration’s API key. Remove Administrator tier isn’t refused, so don’t run it against that user: Oleria acts as that user, so doing this can stop remediation, and possibly the sync, until the tier is restored in the Lacework console.

​
Known limitations

  • No SCIM API. Lacework doesn’t publish a SCIM 2.0 provisioning API. Oleria connects through Lacework’s native API instead, which has a narrower surface - see the limitations below for what that means in practice.
  • Accounts with RBAC enabled aren’t supported. Enabling RBAC replaces the TeamMembers API with TeamUsers, along with user groups and custom roles. Oleria reads only TeamMembers, so it can’t connect to an account that has enabled RBAC.
  • No groups. Accounts that haven’t enabled RBAC have no group or team concept separate from their user directory - “team member” means user, not group membership. Oleria can’t map group-based access for this integration.
  • Only two fixed account tiers. Accounts that haven’t enabled RBAC have no custom role or permission-set system. Oleria reports exactly two tiers, Administrator and User, with no finer-grained permission detail.
  • No per-user API key visibility. Lacework has no API to list a user’s own API keys, so Oleria can’t confirm which users hold API access. Oleria reports this as not having API access by default, which may understate actual access for some users.
  • No MFA or SSO policy visibility. Lacework’s API doesn’t expose per-user MFA enrollment or SSO configuration, so these fields show as unavailable rather than a true or false status.
  • Activity coverage is limited to sign-in events for now. Oleria syncs Lacework’s console audit log over a rolling window, but only recognizes one event type (OAuth login) today - other audit log events are captured but shown as generic activity rather than a specific, named event type. Oleria reads every page of the audit log for each sync window. Lacework’s audit log retention period isn’t documented.
  • Resources and security findings aren’t synced. This integration covers console users and admin access only - it doesn’t sync Lacework’s cloud resource inventory, security findings, or alerts.

​
Contact us

For questions about this integration, contact us at support@oleria.com.