Search query in sailpoint idn to get details of user's disabled in last 24hrs,1week,1month.(attribute leaver)

Welcome to the community.

Note that if you were basing this on a termination date for an ISC Identity attribute, your date format should be in the ISO-8601 (yyyy-MM-dd) format.

You may want to combine it with lifecycle data in your search to also investigate accounts out of bounds with their LCS values. Example would be if someone manually transitioned someone to a given LCS state.

See:
Search Examples within the Identity Security Cloud User Interface - Identity Security Cloud (ISC) / ISC Community Knowledge Base - SailPoint Developer Community

Note Patrick’s comment on the thread.

1 Like