Search query - SailPoint

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

Search query

Is there a query that returns all active identities in the environment on different dates?

2

To clarify - are you looking for a query that returns the identities that were active on a given date in the past? That wouldn’t quite be possible - as the search is going to give you results on the current state.

You could take those results - and then search for events for people changing status and build to that previous state perhaps. But that would involve some processing/scripting.

For an individual user you can check against Access History or events.

2 Likes
3

Use following

Id:* AND attributes.cloudLifecycleState:active

1 Like
4

Hi @kaiolima ,

You can use the search query to return the active identities with the specific dates as per the below provided sample query :

attributes.cloudLifecycleState:active AND created:2020-05-01 OR created:<=2020-04-05

Created date can also be specific as - created:[now-1M TO now] or any other dates in place of now.

I hope this might help!

Thanks,
Prashant

2 Likes
5

Hi @kaiolima ,

Query that return active identity is,

attributes.cloudLifecycleState:active

For created date,

created:2023-08-09

This returns all identities that were created on August 9, 2023.

(Or)

created:<=2015-02-04

This returns all identities created on or before February 4, 2015.

(Or)

created:[now-1M TO now]

You can specify the dates using a Range queries and Date Maths. This returns objects created within the last month.

Yeah. Use AND and OR to build the query as like @PrashantMishra said, as per your requirement.

For further reference, take a look at below link:

You can also have a look at suggested searches for reference too.

3 Likes
6

@PrashantMishra , Just small correction in your search query. The condition after AND should be enclosed within brackets. It should be like below.

attributes.cloudLifecycleState:active AND (created:2024-01-01 OR created<=2024-01-01)

Thanks!!

2 Likes
7

Yes @GOKUL_ANANTH_M that’s correct.

Here I just provided the query on a high-level. Rest it’s always advisable to use brackets in case of having multiple operators check throughout the conditions.

Thanks,
Prashant

2 Likes
8

Prashant - this would only return identities who were active now and created in a time span, but not who all who were active during that time period.

9

Hi @adunker ,

Yes result will be fetched out based on current state of an identity with a specific date.

To find the identities based on their LifecycleStatus on past date can’t be retrieved via a search query. It would need an extra efforts comparing the current data with the audit report etc.

Thanks,
Prashant

10

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.