Search - I need a query to retrieve identities that changed some attribute xxxx

[jsosa (Julian Sosa)]

Hi people!

We are needing a query, that brings us the identities on which some attribute X has changed. For simplicity, let say that this attribute is givenName. How can I retrieve all identities whose givenName was updated last 24hs?

[Sachin_Rajathadri]

Hi @jsosa,

I was able to get both Identity Attribute Update and Account Attribute Update using Search UI. But it does not show which attribute got updated. You will have to click individual item to see that. Here’s an example,

Here’s the search - modified:[now-24h TO now] AND action:"Identity Attribute Update"
or
modified:[now-24h TO now] AND action:"Account Attribute Update"

Another option is to use the API to get the same results in JSON, and then maybe you can just filter out using notepad or VS code.

I used this - {{baseUrl}}/account-activities?filters=type eq "IdentityAttributeUpdate" and modified gt 2024-10-05T20:54:50.660Z

Hope this helps!

[jesvin90 (Jesvin Joseph)]

Hi @jsosa,

I am not sure if the above suggestion from @Sachin_Rajathadri works for all Identity attributes, but it works if a manual change is done on the LCS.

We have relied upon the attribute sync events (assuming that you sync the given name to AD or some other source) to get the desired results.

Here is a sample query you may want to try :

attributes.attributeName:"givenName" AND attributes.sourceName:"ActiveDirectory" AND created:[now-1d TO now]

[CraigSpowart1990 (Craig Spowart)]

Hi

I’ve been trying the suggestion in this topic to see if it can help with a Search Query with no luck. The query I’m trying to run is to get results to show if the value in identity attribute code level or BS Responsible changed from one value to another value the previous day.

Is this something that can be done in Search ?