How to generate report for deleted accounts

Identity Security Cloud (ISC) ISC Discussion and Questions
, , ,
1

Hi All,

Does anyone know how to generate a report and query the users who are deleted today in a specific application? Thank you!

2

Hi Jasmine,

Are you looking for identities that had an account deleted by a SailPoint provisioning plan? Or those that were dropped from an aggregation because they were deleted natively in the source?

Thanks,

Liam

3

Hi @jasmedina,

Usually there are two events that you can query in the search, one will account deletion and other will give you identity deletion events with user details, PFB:

“Delete User Passed” and “Delete Identity Passed” but this you cannot search with regards to some source (application).

"delete user passed" AND created:[now-1d TO now]

"delete user passed" AND created:<date>

I would recommend you to a excellent feature “Native Change Detection” by this you can monitor following:

  1. Account Creation
  2. Account Update
  3. Account Deletion

Please find the SailPoint document to enable this feature in your source and steps how you can search these events.

Enhancement: Audit Events for Native Change Detection - Announcements / Product News - SailPoint Developer Community

Native Change Account Deleted | SailPoint Developer Community

Hope this will help!

3 Likes
4

Hi @jasmedina
This might work

@accountRequests(op:delete) AND @accountRequests(source.name:"source name")

5

Hi @jasmedina, Using source account deleted trigger you can check. If the account is deleted for a particular application.

6

Hi Liam,

I am looking for accounts deleted by a SailPoint provisioning plan. I have a rule that will delete all inactive accounts and accounts with no last login date, and want to have some sort of report to list all those deleted accounts

7

As @gourab mentioned, this query will work for your case.

@accountRequests(op:Delete) AND @accountRequests(source.name:“<source_name>”)

8

I tried the query but it didn’t return the correct results I was expecting

9

Hi Gourab, I tried this but it looks like it can only output the deleted accounts from a lifecycle state change. I have a rule that will delete all inactive accounts and accounts with no last login date. The query wasn’t able to capture the deleted accounts from that rule.

10

hi @jasmedina,

Can you try with this search query.

name:"Remove Source Account Passed" AND operation:"REMOVE"

you can add the date you can add an AND condition and this “created:[now-1d TO now]”

Thanks,
Uday

11

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.