how to get the termination failed report… do you have any search query or any API
we need to check the daily basis for user termination failed report.
let say for example user termination date is today and the termination is failed, we need to get notification
if notification is not required (without notification), how can we get the data(user termination failed) through search query
Hi @mrahulbb,
You can consider using the below search query to check if there are any active accounts in a source with the employee status as “Terminated”.
attributes.employeeStatus:Terminated AND @accounts(source.name:"ActiveDirectory" AND disabled:false)
You may add more sources to the above query and that will act as your reporting query.
You will probably need to look at the failed events if you need to capture each event failure related to a user termination
created:[now-1d TO now] AND status:FAILED