Search API not returning sourceId

Identity Security Cloud (ISC) ISC Discussion and Questions
1

I’m trying to use the V3 search API to look for event data regarding source aggregations and I’m running into some unexpected behavior in the results. Below is my API body and the response in question.

{
	"query": {
		"query": "created:[now-1d TO now] AND operation:AGGREGATE AND status:PASSED"
	},
	"indices": [
		"events"
	],
	"sort": [
		"-created"
	],
	"includeNested": false
}

{
        "stack": "qpoc",
        "synced": "2022-08-23T04:03:27.941Z",
        "created": "2022-08-23T04:03:27.620Z",
        "objects": [
            "SOURCE",
            "ACCOUNT"
        ],
        "type": "SOURCE_MANAGEMENT",
        "technicalName": "SOURCE_ACCOUNT_AGGREGATE_PASSED",
        "target": {
            "name": "Workday [source]"
        },
        "actor": {},
        "name": "Aggregate Source Account Passed",
        "action": "SOURCE_ACCOUNT_AGGREGATION_PASSED",
        "details": "redacted",
        "attributes": {
            "sourceId": "source",
            "sourceName": "Workday"
        },
        "id": "redacted",
        "operation": "AGGREGATE",
        "status": "PASSED",
        "_type": "event",
        "_version": "v7"
    }

Is it expected behavior that attributes.sourceId only says “source”?

2

Welcome to the developer community Adam,

Thank you for bringing this to our attention. I’m going to say that this is not the expected behavior. The GUID should be returned in the sourceId attribute. I’m going to open an engineering ticket to get this resolved.

1 Like
3

Great thank you Colin! I’m happy to submit whatever you guys need to help move this along.