Get Users With More Than One Account in the Same Source

Identity Security Cloud (ISC) ISC Discussion and Questions
12

Hello @colin_mckibben

I have a similar question as the thread owner.
I went through the earlier responses in this thread and using the provided modified query for a single source, I’m getting the following no valid response as shown below:

{
    "aggregations": {
        "accounts": {
            "doc_count": 0,
            "source_id": {
                "doc_count_error_upper_bound": 0,
                "sum_other_doc_count": 0,
                "buckets": []
            }
        }
    }
}

I’m wondering if the value for “indices” of “identities” is possible for “source.id”. Reason being is even if I perform a “source.id” search on IDN tenant, there is no option to show for Identities. Only Access Profile and Entitlements.

Also, it is important to be able to search for a specific source only, as doing a wildcard search for all sources may return additional results not wanted.

More infomation as follows:

Endpoint: Active Directory

Request body:

{
    "query": {
        "query": "source.id:2c91808781a6c9e30181ad25d2124704"
    },
    "indices": [
        "identities"
    ],
    "aggregationsDsl": {
        "accounts": {
            "nested": {
                "path": "accounts"
            },
            "aggs": {
                "source_id": {
                    "terms": {
                        "field": "accounts.source.id",
                        "min_doc_count": 2,
                        "size": 1000
                    },
                    "aggs": {
                        "identities": {
                            "terms": {
                                "field": "_id",
                                "min_doc_count": 2
                            },
                            "aggs": {
                                "accounts": {
                                    "top_hits": {}
                                }
                            }
                        }
                    }
                }
            }
        }
    }
}

Appreciate your reply. TIA. :slight_smile:

Regards,
Ming Zheng