# Search query for changed attribute and entitlement **URL:** \ **Category:** SHF Discussion and Questions\ **Tags:** identity-security-cloud, search\ **Created:** [March 25, 2025, 9:17pm UTC](https://developer.sailpoint.com/discuss/t/search-query-for-changed-attribute-and-entitlement/105391 "2025-03-25T21:17:20Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![jared-fox](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/jared-fox/32/18888_2.png) [@jared-fox](https://developer.sailpoint.com/discuss/u/jared-fox)\ **Post date:** [March 25, 2025, 9:17pm UTC](https://developer.sailpoint.com/discuss/t/search-query-for-changed-attribute-and-entitlement/105391/1 "2025-03-25T21:17:20Z")
I want to create a saved search that: 1. Searches all identities that possess a specific entitlement 2. Checks if a specific attribute has changed for any of those identities in the past week 3. If it has, sends me an email with their names I’d want to schedule it to run once a week. Basically, I am trying to see if users with a specific logon group entitlement change primaryRolecodes and if they do I want to get notified of it weekly so I can make necessary changes. ---
**Author:** ![kdfreeman](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/kdfreeman/32/22737_2.png) [@kdfreeman](https://developer.sailpoint.com/discuss/u/kdfreeman)\ **Post date:** [March 25, 2025, 9:26pm UTC](https://developer.sailpoint.com/discuss/t/search-query-for-changed-attribute-and-entitlement/105391/2 "2025-03-25T21:26:12Z")
Hi Jared, I think the optimal way to tackle this problem is to use workflow. - Trigger workflow on “That certain identity attribute change”. - Get Identity - Get their Access [Entitlement] - Loop on Access[Entitlement] and check if they have those specific entitlement. - If yes, then send notification email. Thanks ---
**Author:** ![jared-fox](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/jared-fox/32/18888_2.png) [@jared-fox](https://developer.sailpoint.com/discuss/u/jared-fox)\ **Post date:** [March 25, 2025, 9:38pm UTC](https://developer.sailpoint.com/discuss/t/search-query-for-changed-attribute-and-entitlement/105391/3 "2025-03-25T21:38:53Z")
Hey Kapil, Thanks for the quick reply. I was wondering if this was a job for workflows. I figured I’d start with searches and work my way up from there. I am going to try that out and keep you posted on my results. ---
**Author:** ![kdfreeman](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/kdfreeman/32/22737_2.png) [@kdfreeman](https://developer.sailpoint.com/discuss/u/kdfreeman)\ **Post date:** [March 26, 2025, 12:56am UTC](https://developer.sailpoint.com/discuss/t/search-query-for-changed-attribute-and-entitlement/105391/4 "2025-03-26T00:56:08Z")
Hi Jared, I don’t think search will be able to track attribute change. If you want to track attribute change, workflow is the way to go. Search will only list data based on the query and I don’t think you can generate query to track attribute change and list identities. Thanks ---
**Author:** ![David\_Norris](https://avatars.discourse-cdn.com/v4/letter/d/b9e5f3/32.png) [@David\_Norris](https://developer.sailpoint.com/discuss/u/David_Norris)\ **Post date:** [March 26, 2025, 1:15am UTC](https://developer.sailpoint.com/discuss/t/search-query-for-changed-attribute-and-entitlement/105391/5 "2025-03-26T01:15:50Z")
Try this for attribute changes: `"Update Native Change Detected" AND attributes.singleValueAttributeChanges.exact:/.*\"name\":\"MYCUSTOMATTRIBUTENAME\".*/` (It doesn’t track identity attribute changes though, this is only native account attribute changes) In order to track a ‘specific’ identity attribute change, we had to introduce an additional identity attribute. e.g. Previous Job Title, and Job Title. And if the “when” is important, the value would be stored with a yyyymmdd prefix. e.g. “20241231:Summer Intern” ---
**Author:** ![NeetuDixit](https://avatars.discourse-cdn.com/v4/letter/n/e8c25b/32.png) [@NeetuDixit](https://developer.sailpoint.com/discuss/u/NeetuDixit)\ **Post date:** [March 26, 2025, 6:05am UTC](https://developer.sailpoint.com/discuss/t/search-query-for-changed-attribute-and-entitlement/105391/6 "2025-03-26T06:05:37Z")
1. you can use the following Search command to pull the list of users for a specific entitlement. @access(name:“EntitlementName” AND source.name:“sourcename”) 2. if you’re only looking for the data then, using the below search query to extract the list of identities updated for a specific attribute. This will extract the events and “Target” in the events is the updated Identity. name:“Modify Account Passed” AND “attributename” AND created:[now-6d TO now] ---
**Author:** ![jared-fox](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/jared-fox/32/18888_2.png) [@jared-fox](https://developer.sailpoint.com/discuss/u/jared-fox)\ **Post date:** [March 26, 2025, 1:48pm UTC](https://developer.sailpoint.com/discuss/t/search-query-for-changed-attribute-and-entitlement/105391/7 "2025-03-26T13:48:01Z")
I put this in changing “name” to the name of the attribute and “MYCUSTOMATTRIBUTENAME” to the name of the entitlement. Both returned nothing, so I think I’m using it wrong. I also ran it exactly as you wrote it, which returned nothing. Can you give me a little more detail on how to use that query? ---
**Author:** ![David\_Norris](https://avatars.discourse-cdn.com/v4/letter/d/b9e5f3/32.png) [@David\_Norris](https://developer.sailpoint.com/discuss/u/David_Norris)\ **Post date:** [March 26, 2025, 2:01pm UTC](https://developer.sailpoint.com/discuss/t/search-query-for-changed-attribute-and-entitlement/105391/8 "2025-03-26T14:01:41Z")
“name” doesn’t need to change. It’s the MYCUSTOMATTRIBUTENAME that you need to change. Change that to, say, “telephonNumber”, for example, if that’s the attribute you want to track. Just take a look at a single “`Update Native Change Detected`” record, you’ll see what I mean. ---
**Author:** ![jared-fox](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/jared-fox/32/18888_2.png) [@jared-fox](https://developer.sailpoint.com/discuss/u/jared-fox)\ **Post date:** [March 26, 2025, 2:18pm UTC](https://developer.sailpoint.com/discuss/t/search-query-for-changed-attribute-and-entitlement/105391/9 "2025-03-26T14:18:57Z")
Hey, Thanks for the help. I tried out these queries and tinkered with them a bit. `Search query: @access(name:“APP-PROD-Logon”) AND attributes.cloudLifecycleState:Active` This query gave me every active user. `@access(name:“EntitlementName” AND source.name:“sourcename”)` Gave me every user ever. For some reason neither of these resolved just the users with the entitlement I’m looking for. They seemed to both give me every user. **HOWEVER** , after some fiddling I found this: `@access(name:"APP-PROD-Logon" AND source.name:"Corp.MyOrg.com AD") AND NOT attributes.cloudLifecycleState:Terminate` This query finds all the users with a specific access item that are not TERMINATE. When I tested this query `“Modify Account Passed” AND "primaryrolecode" AND created:[now-6d TO now]` It returned anything that had been modified in the past 6 days. I’m trying to return identites for whom the “primaryrolecode” attribute has changed in the past 6 days. So right now, I feel like we’re half way there. ---
**Author:** ![jared-fox](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/jared-fox/32/18888_2.png) [@jared-fox](https://developer.sailpoint.com/discuss/u/jared-fox)\ **Post date:** [March 26, 2025, 2:27pm UTC](https://developer.sailpoint.com/discuss/t/search-query-for-changed-attribute-and-entitlement/105391/10 "2025-03-26T14:27:38Z")
Hey Terry, I tried ![image](https://global.discourse-cdn.com/sailpoint/original/3X/6/3/634a6d4d6df5dfd8aaadf5d073c6404d9128de67.png) and I tried it with several other attributes, but it’s not returning anything. I’m wondering what I’m doing wrong. ---
**Author:** ![David\_Norris](https://avatars.discourse-cdn.com/v4/letter/d/b9e5f3/32.png) [@David\_Norris](https://developer.sailpoint.com/discuss/u/David_Norris)\ **Post date:** [March 26, 2025, 2:41pm UTC](https://developer.sailpoint.com/discuss/t/search-query-for-changed-attribute-and-entitlement/105391/11 "2025-03-26T14:41:54Z")
You need to enable Native Change Detection on the source. (Then change a value on the target, natively, then aggregate) > **[Managing Native Change Detection - SailPoint Identity Services](https://documentation.sailpoint.com/saas/help/sources/native_change_detection.html)** > > SailPoint Identity Services Documentation ---
**Author:** ![jared-fox](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/jared-fox/32/18888_2.png) [@jared-fox](https://developer.sailpoint.com/discuss/u/jared-fox)\ **Post date:** [March 26, 2025, 3:02pm UTC](https://developer.sailpoint.com/discuss/t/search-query-for-changed-attribute-and-entitlement/105391/12 "2025-03-26T15:02:42Z")
The source already has native change detection enabled, and we run aggregation every 6 hours. Will this command detect changes that were identified in the last aggregation? I want to avoid testing on this source and prefer to rely on natural events. I tested the query with several attributes that should have changed in the past day or so. ---
**Author:** ![jared-fox](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/jared-fox/32/18888_2.png) [@jared-fox](https://developer.sailpoint.com/discuss/u/jared-fox)\ **Post date:** [March 26, 2025, 3:15pm UTC](https://developer.sailpoint.com/discuss/t/search-query-for-changed-attribute-and-entitlement/105391/13 "2025-03-26T15:15:27Z")
Looking at triggers now, I’m guessing I need to come up with a JSON XPath filter expression to detect the attribute change? Would $.identity.attributes. work? ---
**Author:** ![kdfreeman](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/kdfreeman/32/22737_2.png) [@kdfreeman](https://developer.sailpoint.com/discuss/u/kdfreeman)\ **Post date:** [March 26, 2025, 3:44pm UTC](https://developer.sailpoint.com/discuss/t/search-query-for-changed-attribute-and-entitlement/105391/14 "2025-03-26T15:44:47Z")
It should be something like this using “Identity Attribute Change” trigger. If you know what the changed value is, ` $.changes[?(@.attribute == “Your Attribute” && @.newValue == “new vlaue if you know”)]` If you don’t know the value. `$.changes[?(@.attribute == “Your Attribute” )]` Thanks. ---
**Author:** ![system](https://global.discourse-cdn.com/sailpoint/original/2X/f/f2136700ed5e3703e0b85e02f6be799dacca7735.png) [@system](https://developer.sailpoint.com/discuss/u/system)\ **Post date:** [May 25, 2025, 3:45pm UTC](https://developer.sailpoint.com/discuss/t/search-query-for-changed-attribute-and-entitlement/105391/15 "2025-05-25T15:45:23Z")
This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.