Search query to obtain identities disabled over e period of time

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

Hi! I would like to perform a query (and a report) for identities being disabled, for example, last 24 hours. I tried something like modified:[now-24h TO now] AND attributes.cloudlifecycle:inactive, but if another attribute is modified after LCS going inactive, will be returned in results.

Is there some way to search for some identity attribute specific attribute changed in some date?

2

@jsosa

Cloud life cycle state change is an event in identityNow, Please filter by events in search and use the below query to find all life cycle change events:

name: "Change Identity State Passed" AND attributes.oldState:"active" AND attributes.newState:"inactive" AND created:[now-24h TO now]

1 Like
3

Thanks! Worked perfectly!

4

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.