Search Query to list accounts delete operations in a specific source

Identity Security Cloud (ISC) ISC Discussion and Questions
1

I need to generate a report that will list all accounts delete operations in a specific Source. Wondering what should be the query.

Any help would be highly appreciated

2

Hi @iamology

Try this and see if it works :

@accountRequests(op:delete) AND @accountRequests(source.name:"source name")

3

Hi @iamology ,

Yes, the query provided by jesvin should work too, you may also try the below one

@accountRequests(op:“Delete” AND source.name:“source.name”)

Strange, but the events are not able capture these requests so we will need to search it in account requests.

Thank You.
Regards
Vikas.

4

Thanks both @jesvin90 and @vguleria

Both queries work as per my needs.