Search query to get attribute sync events with attribute changes

Identity Security Cloud (ISC) ISC Discussion and Questions
1

Need a search query to get all the attribute change details for an attribute sync events. should be in one search to get all the details.
I have tried with “created:[now-1M TO now] AND name:”%attribute sync%“” but not getting the sub-event details like what chnages happened to what attributes and their values.

2

created:[now-1M TO now] AND attributes.interface.exact:/Attribute Syn.+/ AND (attributes.appId:“” OR attributes.sourceName:“”)

3

WIth the above query it is showing the event details only. It is not showing the sub-event details. I need attribute change details like newattributeValue and OldattributeValue.
I need attribute sync event details specific to source with all the details. like what attribute changes happen.

6

You won’t get those details, you can find the data in each event.

You can use search API to get the data and format it as per your needs.

1 Like