Search Query Assistance: Nested Provisioning Queries

Identity Security Cloud (ISC) ISC Discussion and Questions
, ,
1

I’m building a search query which looks through account activity to find results for a specified source, with a specific attribute request.

For example: Return all account activity for source “Source1” where one of the attribute requests involves an operation Remove, and the value is “Value1”.

This following query works only when there is one attribute request. It fails to return a result when the account activity has an array of attribute requests:

@accountRequests(source.name:"Source1" AND attributeRequests.op:"Remove" AND attributeRequests.value:"Value1")

Since attributeRequests can be an array of multiple requests, I tried to nest this query like so, but it doesn’t quite work:

@accountRequests(source.name:"Source1" AND @attributeRequests(op:"Remove" AND value:"Value1"))

What can I do to only fetch results when there is one or more Remove operations at an attribute request level?

2

I think your second filter is good :

@accountRequests(source.name:"My Source name" AND @attributeRequests(op: "remove"))

you can only remove the and condition inside attributeRequests or do you need remove operation with specific value ?

3

Yeah, attribute requests of a specific value and a specific operation for a source.

4

Is that work ?

@accountRequests(source.name:"My Source name" AND @attributeRequests(op: "remove"))
5

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.