Compound query( Targeting Active Accounts)

Identity Security Cloud (ISC) ISC Discussion and Questions
1

query1: Filtering Active Users Across Multiple Sources

There are two sources, Source A and Source B, and a user named ‘X’. X is active in Source A but inactive in Source B. When fetching results, I want to exclude inactive accounts, meaning I only want X’s name to appear for the source where he is active (Source A) and not for the inactive source (Source B).

Additionally, there might be a scenario where another user, ‘Y’, is only present in one source and is inactive in that source. In such cases, I do not want Y’s name to appear at all.

In summary, I only want to retrieve active users and exclude inactive users from both sources.

second query: Is it possible to combine more than five platforms and retrieve only the identities with active accounts?

Below is the query I am using for Five platforms.

@accounts (source.name:‘A’ OR source.name:‘B’ OR source.name:‘C’ OR source.name:‘D’ OR source.name:‘E’) AND (attributes.cloudLifecycleState:active OR attributes.cloudLifecycleState:loa) AND (attributes.C:Y OR attributes.AActive:Y OR attributes.DActive:Y OR attributes.B:2 OR attributes.B:0)

Please help me out for the above queries

2

Hi @bshilpa2,

To get the active account details alone, you will need to make use of the search API with an innerhit.

Here is a sample API body :

{
    "indices": [
        "identities"
    ],
    "query": {
        "query": "YOUR QUERY",
        "innerHit": {
            "type": "accounts",
            "query": "disabled:false"
        }
    }
}

For your second query - are you facing any issue when you add more than 5 sources.? I believe it should work as long as you have the right query.

3

Can you try .
@accounts(disabled:false) && @accounts (source.name:‘A’ OR source.name:‘B’ OR source.name:‘C’ OR source.name:‘D’ OR source.name:‘E’)

Thanks.

4

I have remodified the query. However, the query the pulling any data if I add @accounts(disabled: false)

5

Can you try -
@accounts(disabled:false AND (source.name:“A” OR source.name:“B” OR source.name:“C” OR source.name:“D” OR source.name:“E”))

Thanks