> ## Documentation Index > Fetch the complete documentation index at: https://docs.oleria.com/llms.txt > Use this file to discover all available pages before exploring further. # Lacework > Connect your Fortinet (Lacework FortiCNAPP) account to Oleria to continuously discover and map console users and administrator-level access across your Lacework tenant. Connect Lacework to Oleria to gain continuous visibility into who can sign in to your Lacework console and who holds administrator-level access. Oleria reads user and admin-role data from Lacework's API v2 - mapping every console user and their account tier in one place - so you can see where admin access is over-provisioned and take action directly from Oleria. > [!NOTE] > > This is a governance-only integration. Lacework has no SCIM 2.0 API, so Oleria connects through Lacework's native `TeamMembers` API instead - see [Known limitations](#known-limitations) for what that means for scope. Lacework turns the `TeamMembers` API off when an account enables RBAC, so this integration works only with accounts that haven't enabled RBAC. Oleria does not sync Lacework's security findings, cloud resources, or alerts through this integration. ## What Oleria discovers Once connected, Oleria continuously discovers and maps the following from your Lacework account: * **Users** - every console user ("team member," in Lacework's terminology) in the connected account or sub-account. * **Account tier** - each user's tier, either **Administrator** or **User**. Accounts that haven't enabled RBAC have only these two fixed tiers, so they're the only access distinction Oleria can map. * **Console activity** - sign-in events from Lacework's audit log, for example OAuth login activity. Only one audit event type is currently confirmed and mapped; other event types are still captured but not yet schematized (see [Known limitations](#known-limitations)). > [!NOTE] > > Accounts that haven't enabled RBAC have no group or team concept distinct from their user directory, so Oleria does not discover groups for this integration. ## Prerequisites * A Lacework account with API access enabled (standard on all current Lacework/FortiCNAPP plans) that hasn't enabled RBAC. Enabling RBAC turns off the `TeamMembers` API that Oleria reads, and the connection then fails to authenticate. * A Lacework user with **Administrator** access to generate an API key. Each Oleria connection covers one Lacework account or sub-account - see [Account vs. organization-scoped keys](#account-vs-organization-scoped-keys). > [!NOTE] > > A Lacework API key acts as the user it's assigned to, so a key created under a person's account stops working if that person leaves and their user is disabled. Create the key as a dedicated user that exists only for Oleria. Don't enable RBAC to get Lacework service users for this: service users exist only with RBAC, and RBAC turns off the `TeamMembers` API this integration reads. If you plan to use [remediation actions](#remediation-actions), the dedicated user needs **Administrator** access to the connected account. ## Create an API key in Lacework > [!NOTE] > > Lacework is currently being rebranded to Fortinet FortiCNAPP, so console menu names and locations may differ from what's described below. If a step doesn't match what you see, search the console for "API Keys" or consult Lacework's own documentation. **1. Open the API Keys page in the Lacework console** Sign in to the Lacework console as an Administrator and open the API Keys page, typically found under **Settings** (or your account menu). **2. Generate a new key** Create a new API key. Lacework issues a **Key ID** and a **Secret Key**. > [!WARNING] > > The Secret Key is only shown once, at creation time. Copy and store it securely - Lacework cannot show it to you again, and you'll need to generate a new key if you lose it. **3. Note your account name** Note your Lacework **account name** - the subdomain in your console URL (for example, `mycompany` in `mycompany.lacework.net`, or `acme.fra` for a regional tenant at `acme.fra.lacework.net`). ## Connect Lacework to Oleria **1. Open the integration** Sign in to your Oleria workspace, navigate to **Integrations**, and select **Lacework**. **2. Complete the connection form** Fill in the connection form with the credentials from the API key: | Field | Notes | | :- | :- | | Account Name | Required. Your Lacework account name - the subdomain in your console URL, for example `mycompany` (or `acme.fra` for a regional tenant). You can also paste the domain (`mycompany.lacework.net`) or the bare console URL (`https://mycompany.lacework.net`) - Oleria extracts the account name automatically. Don't paste a URL that includes a page path, such as one copied from the address bar while using the console. | | API Key ID | Required. The Key ID shown when the API key was created. | | API Secret | Required. The Secret Key shown once at creation time. | | Sub-Account | Optional. The sub-account this connection covers when you use an organization-scoped key. Leave blank for a standalone (non-organization) account or for the organization's primary account - see [Account vs. organization-scoped keys](#account-vs-organization-scoped-keys). | **3. Authenticate** Select **Authenticate** to validate and save the integration. Oleria checks the credentials against Lacework before saving. ## Verify the integration Confirm the Lacework instance appears on the **Connected** tab of your Oleria **Integrations** page with a status of **Healthy**. After the first sync completes, you can review the discovered users and their account tiers in your Oleria workspace. ## Account vs. organization-scoped keys Lacework API keys come in two shapes, and which one you generate changes what Oleria can see: * **Account-scoped key** - generated from a single account's **API Keys** page. Oleria sees that account's users and tiers only. * **Organization-scoped key** - generated from the organization-level **API Keys** page. Each Oleria connection still covers **one** sub-account: set **Sub-Account** to choose it, or leave it blank for the organization's primary account. To cover several sub-accounts, add one Lacework integration per sub-account (the same key can be reused). Organization admins appear in Oleria as **Administrator** on every sub-account; Oleria doesn't show organization-admin status as a separate field. If your Lacework tenant isn't part of an organization with multiple sub-accounts, this distinction doesn't apply - generate the key from your account's own **API Keys** page. ## Remediation actions Beyond discovery, Oleria can act on Lacework access to remediate risk. Remediation actions require the API key's owning user to be an **Administrator** of the target account (or an organization admin, for an organization-scoped key). | Action | Reversible? | | :- | :- | | Disable user | Yes - reversed by enabling the user. | | Enable user | Yes - reversed by disabling the user. | | Grant Administrator tier | Yes - reversed by removing the Administrator tier. | | Remove Administrator tier | No automatic revert - re-grant the Administrator tier to reverse. | Only the **Administrator** tier can be granted or removed. Every member holds the **User** tier, so Oleria rejects role actions on it - use **Disable user** to remove a member's access instead. > [!NOTE] > > After **Grant Administrator tier** or **Remove Administrator tier**, Oleria reads the user back from Lacework. If the tier didn't change, the action fails right away. Make the change in the Lacework console instead. > [!WARNING] > > An organization admin's admin-level access can't be removed through this integration's account-level role action. Lacework requires that change to be made directly in the console. Because Oleria shows organization admins as **Administrator**, you can't tell them apart in Oleria before running the action - if it fails with an organization-admin error, make the change in the console. > [!WARNING] > > Oleria refuses **Disable user** on the Lacework user that owns this integration's API key. **Remove Administrator tier** isn't refused, so don't run it against that user: Oleria acts as that user, so doing this can stop remediation, and possibly the sync, until the tier is restored in the Lacework console. ## Known limitations * **No SCIM API.** Lacework doesn't publish a SCIM 2.0 provisioning API. Oleria connects through Lacework's native API instead, which has a narrower surface - see the limitations below for what that means in practice. * **Accounts with RBAC enabled aren't supported.** Enabling RBAC replaces the `TeamMembers` API with `TeamUsers`, along with user groups and custom roles. Oleria reads only `TeamMembers`, so it can't connect to an account that has enabled RBAC. * **No groups.** Accounts that haven't enabled RBAC have no group or team concept separate from their user directory - "team member" means user, not group membership. Oleria can't map group-based access for this integration. * **Only two fixed account tiers.** Accounts that haven't enabled RBAC have no custom role or permission-set system. Oleria reports exactly two tiers, Administrator and User, with no finer-grained permission detail. * **No per-user API key visibility.** Lacework has no API to list a user's own API keys, so Oleria can't confirm which users hold API access. Oleria reports this as not having API access by default, which may understate actual access for some users. * **No MFA or SSO policy visibility.** Lacework's API doesn't expose per-user MFA enrollment or SSO configuration, so these fields show as unavailable rather than a true or false status. * **Activity coverage is limited to sign-in events for now.** Oleria syncs Lacework's console audit log over a rolling window, but only recognizes one event type (OAuth login) today - other audit log events are captured but shown as generic activity rather than a specific, named event type. Oleria reads every page of the audit log for each sync window. Lacework's audit log retention period isn't documented. * **Resources and security findings aren't synced.** This integration covers console users and admin access only - it doesn't sync Lacework's cloud resource inventory, security findings, or alerts. ## Contact us For questions about this integration, contact us at [support@oleria.com](mailto:support@oleria.com). This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.