Complex event trigger

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

Hi,

We have an event trigger which is fired when source account is created. We already had filter based on source ID. Upon observing the behavior we find a need to further filter the trigger based on the presence of employeeId attribute. I have tried checking the

  • $[?(@.attributes.employeeID != ‘’) ]

  • $[?(@.attributes.employeeID.length() >= 5 ‘’) ]

but that didnt help. A work around for that I tried using size operator as
$[?(@.attributes.employeeID size 5) ] which seems to be working.

I am not able to find the way to combine earlier filter with source name,

Combined filter : “$[?($.sourceId ==‘bc3f1e8080e44daeb2bb2664e2c5ac2f’) && ($.identityName size 5)]”

which seems to be not evaluating as expected. Can someone please correct me.?

The event input is as given below.

 "input": {
      "sourceId": "bc3f1e8080e44daeb2bb2664e2c5ac2f",
      "identityName": "17071",
      "nativeIdentifier": "CN=Nico Hukenberg (nichuk)",
      "identityId": "cb22c6e3d02440ee8dea0b582ffa07f5",
      "attributes": {
        "telephoneNumber": "+46478997870946",
        "mail": "[email protected]",
         "accountExpires": "never",
        "description": "Created by IdentityNow",
        "distinguishedName": "CN=Nico Hukenberg (nichuk),OU=IDM-Managed,OU=Users",
        "employeeID": "17071",
        "title": "Accounting manager",
        "employeeNumber": "7167",
        "objectType": "user",
        "objectguid": "{3d5544c3-90bd-420a-8969-0bf48b5d0e29}",
        "company": "GlobalConnect A/S",
        "sn": "Hukenberg",
        "memberOf": [
          "CN=birthrightADIdnSandbox,OU=Groups-Role,OU=Groups-IGA,DC=intg,DC=ip-only,DC=net"
        ],
        "userPrincipalName": "[email protected]",
        "lastLogon": "0",
        "physicalDeliveryOfficeName": "Havneholmen",
        "manager": "CN=Peter Knudsen (petknu),OU=IDM-Managed,OU=Users",
        "sAMAccountName": "nichuk",
        "initials": "NICHUK",
        "msNPAllowDialin": "Not Set",
        "givenName": "Nico",
        "objectClass": [
          "top",
          "person",
          "organizationalPerson",
          "user"
        ],
        "cn": "Nico Hukenberg (nichuk)",
        "co": "Denmark",
        "accountFlags": [
          "Normal User Account"
        ],
        "primaryGroupID": "513",
        "objectSid": "S-1-5-21-572431640-3193520090-1947410930-12454",
        "msDS-PrincipalName": "INTG\\nichuk",
        "pwdLastSet": "0"
      },
      "id": "2ba384635bfb4156b970698c4f8b8911",
      "sourceName": "Intg.ip-only.net AD Connection [source]",
      "uuid": null
}

Thank you in advance.

2

Hi Krunal. It looks like you have a syntax error. You should only have one set of parenthesis, not two. Try this and it should work.

$[?($.sourceId == "bc3f1e8080e44daeb2bb2664e2c5ac2f" && $.identityName size 5)]

3

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.