# Complex event trigger

**URL:** <https://developer.sailpoint.com/discuss/t/complex-event-trigger/21469>\
**Category:** SHF Discussion and Questions\
**Tags:** event-triggers, sailpoint-identity-security\
**Created:** [November 22, 2023, 6:59pm UTC](https://developer.sailpoint.com/discuss/t/complex-event-trigger/21469 "2023-11-22T18:59:31Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![krunal\_sshah](https://avatars.discourse-cdn.com/v4/letter/k/90db22/32.png) [@krunal\_sshah](https://developer.sailpoint.com/discuss/u/krunal_sshah)\
**Post date:** [November 22, 2023, 6:59pm UTC](https://developer.sailpoint.com/discuss/t/complex-event-trigger/21469/1 "2023-11-22T18:59:31Z")

</div>

Hi,

We have an event trigger which is fired when source account is created. We already had filter based on source ID. Upon observing the behavior we find a need to further filter the trigger based on the presence of employeeId attribute. I have tried checking the

- $[?(@.attributes.employeeID != ‘’)]

- $[?(@.attributes.employeeID.length() \>= 5 ‘’)]

but that didnt help. A work around for that I tried using size operator as  
$[?(@.attributes.employeeID size 5)] which seems to be working.

I am not able to find the way to combine earlier filter with source name,

Combined filter : “$[?($.sourceId ==‘bc3f1e8080e44daeb2bb2664e2c5ac2f’) && ($.identityName size 5)]”

which seems to be not evaluating as expected. Can someone please correct me.?

The event input is as given below.

```auto
 "input": {
      "sourceId": "bc3f1e8080e44daeb2bb2664e2c5ac2f",
      "identityName": "17071",
      "nativeIdentifier": "CN=Nico Hukenberg (nichuk)",
      "identityId": "cb22c6e3d02440ee8dea0b582ffa07f5",
      "attributes": {
        "telephoneNumber": "+46478997870946",
        "mail": "nichuk@globalconnect.dk",
         "accountExpires": "never",
        "description": "Created by IdentityNow",
        "distinguishedName": "CN=Nico Hukenberg (nichuk),OU=IDM-Managed,OU=Users",
        "employeeID": "17071",
        "title": "Accounting manager",
        "employeeNumber": "7167",
        "objectType": "user",
        "objectguid": "{3d5544c3-90bd-420a-8969-0bf48b5d0e29}",
        "company": "GlobalConnect A/S",
        "sn": "Hukenberg",
        "memberOf": [
          "CN=birthrightADIdnSandbox,OU=Groups-Role,OU=Groups-IGA,DC=intg,DC=ip-only,DC=net"
        ],
        "userPrincipalName": "nichuk@globalconnect.dk",
        "lastLogon": "0",
        "physicalDeliveryOfficeName": "Havneholmen",
        "manager": "CN=Peter Knudsen (petknu),OU=IDM-Managed,OU=Users",
        "sAMAccountName": "nichuk",
        "initials": "NICHUK",
        "msNPAllowDialin": "Not Set",
        "givenName": "Nico",
        "objectClass": [
          "top",
          "person",
          "organizationalPerson",
          "user"
        ],
        "cn": "Nico Hukenberg (nichuk)",
        "co": "Denmark",
        "accountFlags": [
          "Normal User Account"
        ],
        "primaryGroupID": "513",
        "objectSid": "S-1-5-21-572431640-3193520090-1947410930-12454",
        "msDS-PrincipalName": "INTG\\nichuk",
        "pwdLastSet": "0"
      },
      "id": "2ba384635bfb4156b970698c4f8b8911",
      "sourceName": "Intg.ip-only.net AD Connection [source]",
      "uuid": null
}

```

Thank you in advance.

---

<div class="post-metadata">

**Author:** ![colin\_mckibben](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/colin_mckibben/32/37182_2.png) [@colin\_mckibben](https://developer.sailpoint.com/discuss/u/colin_mckibben)\
**Post date:** [December 14, 2023, 6:59pm UTC](https://developer.sailpoint.com/discuss/t/complex-event-trigger/21469/2 "2023-12-14T18:59:01Z")

</div>

> [@krunal\_sshah](#):
>
> Combined filter : “$[?($.sourceId ==‘bc3f1e8080e44daeb2bb2664e2c5ac2f’) && ($.identityName size 5)]”

Hi Krunal. It looks like you have a syntax error. You should only have one set of parenthesis, not two. Try this and it should work.

`$[?($.sourceId == "bc3f1e8080e44daeb2bb2664e2c5ac2f" && $.identityName size 5)]`

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/sailpoint/original/2X/f/f2136700ed5e3703e0b85e02f6be799dacca7735.png) [@system](https://developer.sailpoint.com/discuss/u/system)\
**Post date:** [February 12, 2024, 7:00pm UTC](https://developer.sailpoint.com/discuss/t/complex-event-trigger/21469/3 "2024-02-12T19:00:01Z")

</div>

Closed on February 12, 2024, 7:00pm UTC

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.