Audit search query

Identity Security Cloud (ISC) ISC Discussion and Questions
1

Hi Team,

Can we generate a report in SailPoint ISC that lists users who were removed from a specific number of groups within a defined time period?

2

Hello Badebaji sayyad,

(@accountRequests(attributeRequests.op:Remove AND attributeRequests.value:“AccessName”) OR @accountRequests(attributeRequests.op:Remove AND attributeRequests.value:“AccessName”)) AND created:[now-30d TO now]

Try using this query by substituting the name of specific access where AccessName is mentioned and also modify the time period accordingly.

3

this query is not providing accurate results. Do you have accurate query?

4

Could you please share what exactly seems inaccurate.

5

I ran this query, and I got 10k set of results which are not even pointing to group name
Please correct me if I am wrong with this query
(@accountRequests(attributeRequests.op:Remove AND attributeRequests.value:“XYZ-APP-ABC-Region-LATAM”) OR @accountRequests(attributeRequests.op:Remove AND attributeRequests.value:“XYZ-APP-ABC-Region-EMEA”))

6

@Badebaji If you’re trying to find users removed from groups within a specific period, make sure your audit search also constrains the time window. Add a created range to the query.

(@accountRequests(attributeRequests.op:Remove AND attributeRequests.value:“XYZ-APP-ABC-Region-LATAM”) OR @accountRequests(attributeRequests.op:Remove AND attributeRequests.value:“XYZ-APP-ABC-Region-EMEA”)) AND created:[now-30d TO now]

7

I ran the query with range as well

This query is giving my 10k+ results and the report is containing the results which are not mentioned in query as well