How to get list of triggered identity lifecycle events for certain identity

IdentityIQ (IIQ) IIQ Community Knowledge Base
,
1

To verify if a specific identity lifecycle event was triggered for an identity, you can usually find this information in the Events tab of the identity in the GUI. However, if you need to retrieve this information using Beanshell, you’ll need to check the corresponding AuditEvent in the AuditLog.

Generally, the Events tab in the Identity section fetches information about lifecycle events from the AuditLog. Therefore, to determine if a particular lifecycle event was triggered, you should search for the corresponding AuditEvent in Beanshell.

Below are the steps to accomplish this:

  1. Viewing Identity Events in GUI:

    image
    image2965×492 49.2 KB

  2. Example Retrieving LifecycleEvent in Beanshell:

<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE Rule PUBLIC "sailpoint.dtd" "sailpoint.dtd">
<Rule language="beanshell" name="Check Identity Lifecycle Events">
  <Source>
  
  import sailpoint.object.AuditEvent;
  import sailpoint.object.QueryOptions;
  import sailpoint.object.Filter;
  
  String identityName = "103";
  Filter f1 = Filter.eq("target","Identity:"+identityName);
  Filter f2 = Filter.eq("action","identityLifecycleEvent");
  
  QueryOptions qo = new QueryOptions();
  qo.add(Filter.and(f1,f2));
  
  List auditEvents = context.getObjects(AuditEvent.class,qo);
  List processedEvents = new ArrayList();
  for(AuditEvent event : auditEvents) {
  		  processedEvents.add(event.getString1());
  }
  return processedEvents;
  

  </Source>
</Rule>
2

@kjakubiak
This is useful.
I wanted to know about any other objects which can be used instead of Audit to get the lifeCycleEvents of an user.
As these values are shown in the identity UI, I am assuming there will be some other objects which can be used for achieving this.

Any pointers?

1 Like
3

Hi Soumyakanta,
Actualy what we see in GUI IS and audit event, I did a test and if you remove audit event than the entry on Events page on Identity will also disapear.

I used to check if event was triggered also by checking if TaskResult of the workflow execution exists. This approach however has some limitation like eg. tasks results rotation which can remove tasks results after certain time.

1 Like
4

@soswain, I don’t think so apart from audit events.

2 Likes
5

Thanks @kjakubiak for explaining.