# Identity Events

**URL:** <https://developer.sailpoint.com/discuss/t/identity-events/185467>\
**Category:** IIQ Discussion and Questions\
**Tags:** identityiq\
**Created:** [October 16, 2025, 10:43am UTC](https://developer.sailpoint.com/discuss/t/identity-events/185467 "2025-10-16T10:43:25Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![enistriminsait](https://avatars.discourse-cdn.com/v4/letter/e/58f4c7/32.png) [@enistriminsait](https://developer.sailpoint.com/discuss/u/enistriminsait)\
**Post date:** [October 16, 2025, 10:43am UTC](https://developer.sailpoint.com/discuss/t/identity-events/185467/1 "2025-10-16T10:43:25Z")

</div>

## Hi at all,

I am searching where are stored and what kind of object are the events that I can see on the identity page.

 ![image](https://global.discourse-cdn.com/sailpoint/original/3X/3/7/3719d97454e6b54d11ad80cc1e249ed21c59a881.png)

Those arent an Audit event, because if I delete it form identity page on audit events nothing changes. Also, I dont have any audit event with that description.

In every case, my requirement is to create a Leaver event when I launch an Emergency termination from Identity Operations. Leaver and termination lauch the same process, but the first one create the Leaver event, the second not.

Can someone help me?

---

<div class="post-metadata">

**Author:** ![aleksander\_jachowicz](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/aleksander_jachowicz/32/22938_2.png) [@aleksander\_jachowicz](https://developer.sailpoint.com/discuss/u/aleksander_jachowicz)\
**Post date:** [October 16, 2025, 12:01pm UTC](https://developer.sailpoint.com/discuss/t/identity-events/185467/2 "2025-10-16T12:01:08Z")

</div>

Hi @enistriminsait , this could be what took me a long time to find. How are you searching for these audit events? target = identity name ?

If so, you are where I was some time ago.

OOTB audit records for triggered IdentityEvents are written with a target field value as “Identity: “+ identity name.

Try this.

And yes, this is totally different then any other IIQ ootb audit.

---

<div class="post-metadata">

**Author:** ![enistriminsait](https://avatars.discourse-cdn.com/v4/letter/e/58f4c7/32.png) [@enistriminsait](https://developer.sailpoint.com/discuss/u/enistriminsait)\
**Post date:** [October 16, 2025, 1:41pm UTC](https://developer.sailpoint.com/discuss/t/identity-events/185467/3 "2025-10-16T13:41:21Z")

</div>

it not that.

like I say, I cant find any correlation with audit event.

In my case, I terminated an idn that have only an AD account.

The accaunt is disable → ok

The ticket on service now are created → ok

I have the audit event for the AD account and nothing else.

I cant find where the Identite event are stored.

---

<div class="post-metadata">

**Author:** ![aleksander\_jachowicz](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/aleksander_jachowicz/32/22938_2.png) [@aleksander\_jachowicz](https://developer.sailpoint.com/discuss/u/aleksander_jachowicz)\
**Post date:** [October 16, 2025, 6:36pm UTC](https://developer.sailpoint.com/discuss/t/identity-events/185467/4 "2025-10-16T18:36:22Z")

</div>

Which page is that screenshot from?

---

<div class="post-metadata">

**Author:** ![BhuvaneshGeddam](https://avatars.discourse-cdn.com/v4/letter/b/eb8c5e/32.png) [@BhuvaneshGeddam](https://developer.sailpoint.com/discuss/u/BhuvaneshGeddam)\
**Post date:** [October 17, 2025, 4:14am UTC](https://developer.sailpoint.com/discuss/t/identity-events/185467/5 "2025-10-17T04:14:05Z")

</div>

They are the pending provisioning requests, they can be searched in debug `ProvisioningRequests`

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/sailpoint/original/2X/f/f2136700ed5e3703e0b85e02f6be799dacca7735.png) [@system](https://developer.sailpoint.com/discuss/u/system)\
**Post date:** [December 16, 2025, 4:14am UTC](https://developer.sailpoint.com/discuss/t/identity-events/185467/6 "2025-12-16T04:14:28Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.