Understanding identityLifecycleEvent vs IdentityStateChange Events

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

Understanding Search Results for Lifecycle Change Events

Hello Everyone,

I have a search subscription which is basically to monitor all the termination events as part of termination process:

created:[now-2d TO now] AND name:"Change Identity State%" AND attributes.oldState:"active" AND attributes.newState:"inactive"

This basically gives all the events in last 2 days where lifecycle status has changed from active to inactive. Or at least that is what we thought.

However, we noticed some identities terminated during that time were not listed who also moved from active to inactive. Looking at the list of events, those identities didn’t have “Change Identity State%” events. They had “Change Identity Lifecycle%” instead.

Further looking into this, the event types(IdentityStateChange vs identityLifecycleEvent) were different and the interface(Cloud Lifecycle Change vs Business Process) was different too. Also, actor is different in both cases.

So, I am trying to understand why we have one vs other in the Identities that are terminated on same day and both moved from active to inactive.

In both cases, our regular termination flow were followed and all accounts were disabled.

Any pointer would be highly appreciated.

Thanks,

Nischal

2

Hi @nadhikari_identitynow,

If your requirement is to get all termination events you can frame a similar query as below.

action:“Cloud Automated <any/terminated LCS name here>” AND created:[now-2d TO now]

3

Hi Ujjwal,

This is helpful. Thank you.

Thanks,
Nischal