Search query for identities that changed lifecycle state to inactive today

Identity Security Cloud (ISC) ISC Discussion and Questions
1

Hello,

Can you please help with a search query to get all identities that changed lifecycle state to inactive today ?

Thank you in advance!
Laks.

2

This will find Events and not Identities. At least in our tenant, the ‘Target’ value of the event is the employee ID of the identity.

name:"Change Identity State Passed" AND attributes.oldState:"active" AND attributes.newState:"inactive" AND created:[now-1d TO now]

2 Likes
3

Excellent solution! I agree that looking this up by event is the most accurate way to do it. If you want to use this query via search API instead of the UI, you can use the following payload.

{
  "indices": [
    "events"
  ],
  "query": {
    "query": "name:\"Change Identity State Passed\" AND attributes.oldState:\"active\" AND attributes.newState:\"inactive\" AND created:[now-1d TO now]"
  }
}
1 Like