How to generate report for deleted accounts

Identity Security Cloud (ISC) ISC Discussion and Questions
, , ,
3

Hi @jasmedina,

Usually there are two events that you can query in the search, one will account deletion and other will give you identity deletion events with user details, PFB:

“Delete User Passed” and “Delete Identity Passed” but this you cannot search with regards to some source (application).

"delete user passed" AND created:[now-1d TO now]

"delete user passed" AND created:<date>

I would recommend you to a excellent feature “Native Change Detection” by this you can monitor following:

  1. Account Creation
  2. Account Update
  3. Account Deletion

Please find the SailPoint document to enable this feature in your source and steps how you can search these events.

Enhancement: Audit Events for Native Change Detection - Announcements / Product News - SailPoint Developer Community

Native Change Account Deleted | SailPoint Developer Community

Hope this will help!

3 Likes