Search query report that will list event date, target user, source name and entitlement added

Identity Security Cloud (ISC) ISC Discussion and Questions
1

Hello All -

I need to be able to run a report on all source accounts created by IDN and the entitlements added. I’ve had no luck trying to figure this out through the search UI and now trying to see if this is possible through the search API. I ran the query below in the UI which lists all the events, but I have to click on each individual event to see the name of the entitlement added. Downloading the report does not give the details of the entitlement added.

Is it possible to create a downloadable report that will list event creation date, target user, source name and entitlement added via API?

(operation:CREATE OR operation:ADD) AND attributes.sourceName:“Source” AND status:“Passed”

1 Like
2

I was able to figure it out.

1 Like
3

@johnpaul_tran Glad you were able to resolve it. Do you mind sharing your solution here to help other community members who may have a similar issue?

4

@johnpaul_tran

Hey, We also have the similar requirement can you provide us solution on how you were able to resolve this.?

If you could share the the API/ Search Query it will be helpful for us.

Thanks

5

Hey there. It’s not a complete solution but it was enough for me to import the json into excel for a more readable format. I did a POST to */v3/search with the below in the body. I would suggest leaving the “queryResultFilter” value empty initially where you can see all results and select which which key/values you would like to return.

{
“query”: {
“query”: “(operation:CREATE OR operation:ADD) AND attributes.sourceName:"Application Name" AND status:"Passed" AND created:[2022-09-01 TO 2022-12-31]”
},
“indices”: [
“events”
],
“sort”: [
“-status”
],
“queryResultFilter”: {
“includes”: [
“created”,
“action”,
“type”,
“target”,
“attributes.sourceName”,
“attributes.accountName”,
“attributes.attributeName”,
“attributes.attributeValue”,
“trackingNumber”
]
}
}

1 Like