ISC Query returning all AD Accounts instead of only Enabled PHSI AD Accounts

Identity Security Cloud (ISC) ISC Discussion and Questions
1

Hi everyone,

I am trying to create a query to identify identities that are on LOA or Terminated but still have their PHSI Active Directory Account enabled.

The issue I am running into is that ISC is returning identities that have any Active Directory account enabled, instead of only those with an enabled PHSI AD account. For example; it returns any identity that have enabled EXT AD or enabled Azure AD or PHSI AD.

Here’s my current query:
(attributes.cloudLifecycleState:LOA OR attributes.cloudLifecycleState:term*) AND @accounts(name:PHSI Active Directory AND disabled:false)

Has anyone run into this before or know the best way to filter the query so it only evaluates the PHSI AD account?

Thanks!

2

Hi @AmulyaWasti25

Try this query instead:

(attributes.cloudLifecycleState:LOA OR attributes.cloudLifecycleState:term*) AND @accounts(source.name.exact:"PHSI Active Directory" AND disabled:false)

The name field in your @accounts() query is referring to the account name, not the source name like you are attempting. Try using source.name.exact instead.

3

Thanks, that was informative and it worked.