Scheduled Search Trigger for Workflow

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

Hi there!

I have been experimenting with the Scheduled Search Event Trigger.

I have saved the search query: attributes.endDate:[now TO now+14d] OR attributes.cloudLifecycleState:expired OR attributes.cloudLifecycleState:archived OR attributes.cloudLifecycleState:terminated AND _exists_:owns

I used this query as a filter in my “Scheduled Search” Event Trigger by using the JSONPath expression: $[?(@.query=="attributes.endDate:[now TO now+14d] OR attributes.cloudLifecycleState:expired OR attributes.cloudLifecycleState:archived OR attributes.cloudLifecycleState:terminated AND _exists_:owns")]

This works perfectly for triggering the Event HTTP call to my webhook site. However, I need this to also work as a trigger for my workflow!

I have tried using the same JSON expression filter in my workflow but it isn’t being triggered. I can’t find any specific examples of how to actually format the trigger itself inside the workflow. The only information in the documentation is about the actual JSON input example.

Why is my Event Trigger Subscription working with my filter but not my Workflow with the “Scheduled Search” Trigger filter?

Workflow Trigger Filter (NOT WORKING):
image

Event Trigger Subscription Filter:

image
image884×95 2.84 KB

Webhook JSON output from Event Trigger HTTP call:

image
image1635×350 13.2 KB

2

NVM I must’ve missed a letter somewhere,

The filter also works for the workflow now…

Leaving the post up in case this might help people.

1 Like
3

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.