Hi, I am looking help on one use case. We have Password interceptor installed in our environment (Sailpoint Password interceptor client) which keeps checking password changed directly from AD system side and sync it across the system through IdentityNow. Here we are looking for some reports which we can tell us which all ids passwords are changed directly from AD system side (date/time, user info) and when the password sync happened from IDN side (with status success or failure).
We use Splunk to retrieve all the PWI logs and have the Splunk app for IdentityNow that retrieves those logs. We can search and report from Splunk on data from both sources.