Event Details - what does the GUID represent and can I query that?

Identity Security Cloud (ISC) ISC Discussion and Questions
, ,
15

Going further down the rabbit hole…

Thinking the information behind Slpt-Request-Id wouldn’t be public, I thought that I could possibly just use the Source Update Trigger to then Run an export-sp-config Job to store that config somewhere, essentially doing a DIY version history.

However, even though there are SOURCE_UPDATE audit events fired when I make config changes to a source, that trigger is not firing. That includes what I consider “non-material” updates like name, description, owner but also more important attributes like the domain distinguished name or the user search scope. Those all trigger events in the audit table, but not the “Source Updated” trigger.

I could only get the trigger to fire when I did things like update the account schema, and I saw the corresponding audit event was far more helpful in this case. It makes me wonder why there is inconsistency in why the trigger isn’t firing on all audit events, when it seems to clearly be positioned to do that

image
image1415×253 24.1 KB

{
        "org": "chk-sb",
        "pod": "stg02-useast1",
        "created": "2023-09-07T14:07:21.085Z",
        "id": "916885fd338093796f78de585632cf785fdc6a77f1764ecbe59b5da30553e050",
        "action": "SchemaUpdated",
        "type": "SOURCE_MANAGEMENT",
        "actor": {
            "name": "366088"
        },
        "target": {
            "name": "account"
        },
        "stack": "diana",
        "trackingNumber": "bd5f9647dbcb470aa57ff5a10605891e",
        "attributes": {
            "addedAttributes": "[\"CHKbuilding\"]",
            "changeset": "[\"attributes added was added with value [CHKbuilding]\"]",
            "sourceId": "source",
            "sourceName": "AD Cloud Admin Users"
        },
        "objects": [
            "SOURCE",
            "SCHEMA"
        ],
        "operation": "UPDATE",
        "status": "PASSED",
        "technicalName": "SOURCE_SCHEMA_UPDATE_PASSED",
        "name": "Update Source Schema Passed",
        "synced": "2023-09-07T14:07:21.382Z",
        "_type": "event",
        "_version": "v7"
    }

@colin_mckibben to your knowledge, should the Source Updated trigger be firing anytime there’s a SOURCE_MANAGEMENT audit event?

1 Like