Difference in Data Structures Between Search and Event Trigger for Create Account Native Change Detected

Feedback General Feedback
,
1

I noticed this when messing around with the create account native change feature, but there is a stark difference in the data structure of the audit event vs the event trigger.

Why is the value of the singleValueAttributeChanges property a JSON array in the event trigger but a string in the audit log?

Event trigger invocation

{
    "singleValueAttributeChanges": [
        {
            "name": "employeeType",
            "newValue": "EMP",
            "oldValue": null
        },
        {
            "name": "sAMAccountName",
            "newValue": "mc",
            "oldValue": null
        },
        {
            "name": "userPrincipalName",
            "newValue": "[email protected]",
            "oldValue": null
        }
    ]
}

Audit log

{
    "singleValueAttributeChanges": "[{\"name\":\"employeeType\",\"newValue\":\"EMP\"},{\"name\":\"sAMAccountName\",\"newValue\":\"mc\"},{\"name\":\"userPrincipalName\",\"newValue\":\"[email protected]\"}]"
}
2

To help me reproduce this issue, how do you get the audit info? What search query did you use?

3

I’ll DM you the full response payloads of both so I don’t have to redact everything, but here’s the search I use

{
    "indices": [
        "events"
    ],
    "query": {
        "query": "name:\"Create Native Change Detected\""
    },
    "sort":[
        "-created"
    ]
}