# Movers Alert in search **URL:** \ **Category:** SHF Discussion and Questions\ **Tags:** identity-security-cloud\ **Created:** [October 15, 2024, 1:45pm UTC](https://developer.sailpoint.com/discuss/t/movers-alert-in-search/85490 "2024-10-15T13:45:00Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![jacobshoe](https://avatars.discourse-cdn.com/v4/letter/j/bb73d2/32.png) [@jacobshoe](https://developer.sailpoint.com/discuss/u/jacobshoe)\ **Post date:** [October 15, 2024, 1:45pm UTC](https://developer.sailpoint.com/discuss/t/movers-alert-in-search/85490/1 "2024-10-15T13:45:01Z")
Hello all, I am attempting to fulfill a request for an audit process in regards to movers in our organization. The route I would like to take is to leverage the search function in SailPoint to trigger every week if a users manager and job title changes. Based off of this trigger and data, I would then filter out low priority job changes and flag privileged users. I am not quite familiar with these [searchable fields](https://documentation.sailpoint.com/saas/help/search/searchable-fields.html) and am not even sure if a time based or delta monitor is possible within SailPoint’s search. Any assistance is appreciated. ---
**Author:** ![Prashanth0707](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/prashanth0707/32/23773_2.png) [@Prashanth0707](https://developer.sailpoint.com/discuss/u/Prashanth0707)\ **Post date:** [October 15, 2024, 1:57pm UTC](https://developer.sailpoint.com/discuss/t/movers-alert-in-search/85490/2 "2024-10-15T13:57:57Z")
> [@jacobshoe](#): > > am attempting to fulfill a request for an audit process in regards to movers in our organization. > > The route I would like to take is to leverage the search function in SailPoint to trigger every week if a users manager and job title changes. Based off of this trigger and data, I would then filter out low priority job changes and flag privileged users. > > I am not quite familiar with these [searchable fields](https://documentation.sailpoint.com/saas/help/search/searchable-fields.html) and am not even sure if a time based or delta monitor is possible within SailPoint’s search. Any assistance is appreciated. Hi @jacobshoe , The Search feature in IdentityNow can be leveraged to identify users based on changes to certain attributes, such as manager and job title. For Ex: identity.attributes.manager identity.attributes.jobTitle However, the native search function does not support time-based or delta-based searches directly (e.g., searching for changes within a certain timeframe. You can try and trigger a workflow for your purpose if you have the module enabled for your tenant! hope this helps! ---
**Author:** ![jacobshoe](https://avatars.discourse-cdn.com/v4/letter/j/bb73d2/32.png) [@jacobshoe](https://developer.sailpoint.com/discuss/u/jacobshoe)\ **Post date:** [October 15, 2024, 2:12pm UTC](https://developer.sailpoint.com/discuss/t/movers-alert-in-search/85490/3 "2024-10-15T14:12:37Z")
Hey @Prashanth0707 , Thank you for confirming that time-based or delta searches are not available. Sadly, my company still has the legacy IdentityNow and we do not have workflows with our tenant. From the sound of it, it does not look like I will be able to leverage the search function to get the outcome I am looking for. I appreciate your time and effort in your reply! ---
**Author:** ![mohammedfavazhrb](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/mohammedfavazhrb/32/16892_2.png) [@mohammedfavazhrb](https://developer.sailpoint.com/discuss/u/mohammedfavazhrb)\ **Post date:** [October 15, 2024, 2:15pm UTC](https://developer.sailpoint.com/discuss/t/movers-alert-in-search/85490/4 "2024-10-15T14:15:00Z")
Hi @jacobshoe, You may use search APIs to get your result and use it in a powershell script. Then you can schedule and run the powershell script from task scheduler as per your requirement. Thanks ---
**Author:** ![agutschow](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/agutschow/32/8543_2.png) [@agutschow](https://developer.sailpoint.com/discuss/u/agutschow)\ **Post date:** [October 15, 2024, 2:15pm UTC](https://developer.sailpoint.com/discuss/t/movers-alert-in-search/85490/5 "2024-10-15T14:15:30Z")
You could write a script that would call the API to look at the identity history. The data you are looking for should be in the snapshots. > **[Identity History | SailPoint Developer Community](https://developer.sailpoint.com/docs/api/v2024/identity-history)** > > Identity History ---
**Author:** ![jacobshoe](https://avatars.discourse-cdn.com/v4/letter/j/bb73d2/32.png) [@jacobshoe](https://developer.sailpoint.com/discuss/u/jacobshoe)\ **Post date:** [October 15, 2024, 2:23pm UTC](https://developer.sailpoint.com/discuss/t/movers-alert-in-search/85490/6 "2024-10-15T14:23:09Z")
@agutschow @mohammedfavazhrb I have written a few powershell scripts, however I am not proficient. Could you possible provide examples of what these API calls would look like to reference identity history? ---
**Author:** ![gourab](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/gourab/32/18650_2.png) [@gourab](https://developer.sailpoint.com/discuss/u/gourab)\ **Post date:** [October 15, 2024, 2:31pm UTC](https://developer.sailpoint.com/discuss/t/movers-alert-in-search/85490/7 "2024-10-15T14:31:51Z")
Hi @jacobshoe , I have a workaround on this , Create an ISC workflow to detect attribute changes, and send an email to admin. as example if jobtitle and manager both changes occur , ISC will sent an email to admin notifying about potential mover.Admin team and keep track of those users or create a full report of those users weekly. ---
**Author:** ![jesvin90](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/jesvin90/32/5301_2.png) [@jesvin90](https://developer.sailpoint.com/discuss/u/jesvin90)\ **Post date:** [October 16, 2024, 1:08pm UTC](https://developer.sailpoint.com/discuss/t/movers-alert-in-search/85490/8 "2024-10-16T13:08:45Z")
Hi @jacobshoe, One way is to make use of the events search, incase you are doing an attribute sync on the manager & jobtitle attributes (eg. on Active Directory). The below search query should fetch you the events for the required attribute syncs (jobTitle & manager are the AD attribute names) `(attributes.attributeName:"jobTitle" OR attributes.attributeName:"manager") AND created:[now-1d TO now] AND attributes.sourceName:"ActiveDirectory"` The above query would only fetch you the event times and the user ID’s though. If you need more details, you can leverage the Search API with the body looking something as below : ```auto { "indices": [ "events" ], "query": { "query": "(attributes.attributeName:\"jobTitle\" OR attributes.attributeName:\"manager\") AND created:[now-1d TO now] AND attributes.sourceName:\"ActiveDirectory\"" }, "queryResultFilter": { "includes": [ "name", "displayName", "target", "attributes.accountName", "attributes.attributeName", "attributes.previousValue", "attributes.attributeValue" ] } } ``` ---
**Author:** ![system](https://global.discourse-cdn.com/sailpoint/original/2X/f/f2136700ed5e3703e0b85e02f6be799dacca7735.png) [@system](https://developer.sailpoint.com/discuss/u/system)\ **Post date:** [December 15, 2024, 1:08pm UTC](https://developer.sailpoint.com/discuss/t/movers-alert-in-search/85490/9 "2024-12-15T13:08:57Z")
This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.