Hi,
I’m trying to identify role removal (Birthright roles) events that occur within a period of time (i.e., 1 day) and that are performed by a specific user (i.e., Service.user). To do this, I’m using search and look for the events as follows:
created:[now-1d TO now] AND name.exact:"Remove Role Passed" AND actor.name:service.user
Viewing the results of this search, I find that there are removal events for Access Profiles, but not for the roles that contain those Access Profiles:
Is there a way to specifically find removal events only for roles?
Thanks in advance!