How to retrieve user termination timestamp from Identity Lifecycle State change event in ISC

SailPoint Human Fabric (SHF) SHF Discussion and Questions
, ,
1

Hi Team,

I’m trying to query Identity Security Cloud events to identify when a user gets terminated (specifically when the lifecycle state changes from active Or NULL to terminated).

I tried the following search query in the event logs:

name:"Change Identity Lifecycle State Success" 
AND attributes.cloudLifecycleStateBefore:"active" 
AND (attributes.cloudLifecycleStateAfterActual:"terminated" OR attributes.cloudLifecycleStateAfterActual:null)

However, this is not returning any results.

My goal is to capture the exact termination event timestamp (terminated at) for an identity.

Could anyone please advise:

  1. Is this the correct event name for lifecycle termination events?

  2. Are attributes.cloudLifecycleStateBefore and attributes.cloudLifecycleStateAfterActual the correct fields to filter on?

  3. Is there another event type or API endpoint that would be better for retrieving the termination timestamp?

Any guidance or examples would be appreciated.

Thanks!

2

Try this:

name:“Change Identity State Passed” AND attributes.oldState:“active” AND attributes.newState:“inactive” AND created:[now-1d TO now]

in Created column you will see timestamp in UTC timezone

3

i tried it and still not working

4

would you be able to provide any screenshot?
Also make sure the technical names of the lifecycle state are correct.

5

@ahmed119 The query works for me. Did you check like this?

image
image1803×776 41.6 KB

6

yes i checked the technical names and its now working.
Thanks @gourab