# \#audit **URL:** https://developer.sailpoint.com/discuss/tag/audit/558.md [Latest](https://developer.sailpoint.com/discuss/latest.md) · [Categories](https://developer.sailpoint.com/discuss/categories.md) · [Tags](https://developer.sailpoint.com/discuss/tags.md) --- ## [How to log AuditEvent on a file and provide information to Splank](https://developer.sailpoint.com/discuss/t/how-to-log-auditevent-on-a-file-and-provide-information-to-splank/222181)
**Author:** [@adolfotrinca](https://developer.sailpoint.com/discuss/u/adolfotrinca)\ **Replies:** 3\ **Last updated:** [September 15, 2026, 9:56am UTC](https://developer.sailpoint.com/discuss/t/how-to-log-auditevent-on-a-file-and-provide-information-to-splank/222181 "2026-09-15T09:56:02Z")
IdentityIq 8.5 We need to generate a log containing all audit activities (AuditEvents), ideally by configuring log4j. Has anyone else encountered this requirement, and if so, how did you solve it? I would like to avoi… --- ## [Optimizing Identity Security Cloud audit and report options](https://developer.sailpoint.com/discuss/t/optimizing-identity-security-cloud-audit-and-report-options/218918)
**Author:** [@darylclaude\_medina](https://developer.sailpoint.com/discuss/u/darylclaude_medina)\ **Replies:** 1\ **Last updated:** [August 13, 2026, 8:30pm UTC](https://developer.sailpoint.com/discuss/t/optimizing-identity-security-cloud-audit-and-report-options/218918 "2026-08-13T20:30:07Z")
In a fast-paced and ever-changing identity landscape, Identity Security Cloud Administrators and auditors need audit reporting that is automatic, adaptive, preventative, and with AI-driven insights. With so many options,… --- ## [Track Your Movers](https://developer.sailpoint.com/discuss/t/track-your-movers/218884)
**Author:** [@Bassem\_Mohamed](https://developer.sailpoint.com/discuss/u/Bassem_Mohamed)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 3:06pm UTC](https://developer.sailpoint.com/discuss/t/track-your-movers/218884 "2026-08-13T15:06:40Z")
Special Thank to @rohit\_prabhu & @mostafa\_helmy for the valuable inputs and support. Problem Overview In many organizations, there’s a growing need for better visibility into Identities movements aka “movers”. These … --- ## [Distinguishing Aggregation Audit Events from UI/Provisioning Audit Events](https://developer.sailpoint.com/discuss/t/distinguishing-aggregation-audit-events-from-ui-provisioning-audit-events/217400)
**Author:** [@shsakshi](https://developer.sailpoint.com/discuss/u/shsakshi)\ **Replies:** 12\ **Last updated:** [July 29, 2026, 6:41am UTC](https://developer.sailpoint.com/discuss/t/distinguishing-aggregation-audit-events-from-ui-provisioning-audit-events/217400 "2026-07-29T06:41:05Z")
Hi, While reviewing spt\_audit\_event, I observed the following: Aggregation (Scheduler) generates audit events such as Create, Update, Delete, with Source = Scheduler. User-driven operations (via UI/provisioning) g… --- ## [Audit Configuration for YAML objects](https://developer.sailpoint.com/discuss/t/audit-configuration-for-yaml-objects/215512)
**Author:** [@rishavghoshacc](https://developer.sailpoint.com/discuss/u/rishavghoshacc)\ **Replies:** 4\ **Last updated:** [July 2, 2026, 3:37pm UTC](https://developer.sailpoint.com/discuss/t/audit-configuration-for-yaml-objects/215512 "2026-07-02T15:37:51Z")
Hi all, I am trying to audit anything that changed through the debug page on YAML objects, etc. I could not find anything Global setting-\>Audit Configuration. Is there a way to do this? I want an audit for create, mod… --- ## [Log incorrect login attempts or other failed attempts in a SIEM solution](https://developer.sailpoint.com/discuss/t/log-incorrect-login-attempts-or-other-failed-attempts-in-a-siem-solution/199729)
**Author:** [@tamalika01](https://developer.sailpoint.com/discuss/u/tamalika01)\ **Replies:** 6\ **Last updated:** [April 28, 2026, 4:45pm UTC](https://developer.sailpoint.com/discuss/t/log-incorrect-login-attempts-or-other-failed-attempts-in-a-siem-solution/199729 "2026-04-28T16:45:36Z")
Hi Experts, Is it possible to log suspicions activities reactively to an external SIEM system for use cases such as: Too many failed login attempts Login without SSO Accessing the ISC tenant from a suspicious network … --- ## [SaaS Connector Customizers - no audit trail?](https://developer.sailpoint.com/discuss/t/saas-connector-customizers-no-audit-trail/205126)
**Author:** [@sup3rmark](https://developer.sailpoint.com/discuss/u/sup3rmark)\ **Replies:** 7\ **Last updated:** [April 24, 2026, 1:54am UTC](https://developer.sailpoint.com/discuss/t/saas-connector-customizers-no-audit-trail/205126 "2026-04-24T01:54:19Z")
So, SaaS Connector Customizers. They’re pretty cool. However, new customizers or updates to existing customizers don’t seem to show up in the audit logs. You also can’t pull down a customizer’s code, because it’s compile… --- ## [Q-Radar Integration with Sailpoint ISC](https://developer.sailpoint.com/discuss/t/q-radar-integration-with-sailpoint-isc/200396)
**Author:** [@Shwetamongia01](https://developer.sailpoint.com/discuss/u/Shwetamongia01)\ **Replies:** 2\ **Last updated:** [March 23, 2026, 3:47pm UTC](https://developer.sailpoint.com/discuss/t/q-radar-integration-with-sailpoint-isc/200396 "2026-03-23T15:47:04Z")
Hi Team, We need to integrate Sailpoint ISC with Qradar, but since there is no direct connector available, we found a GitHub repository link that also mentions the APIs are deprecated. We are searching for documentation… --- ## [How can we identify the source of account change audit events in SailPoint?](https://developer.sailpoint.com/discuss/t/how-can-we-identify-the-source-of-account-change-audit-events-in-sailpoint/192387)
**Author:** [@shsakshi](https://developer.sailpoint.com/discuss/u/shsakshi)\ **Replies:** 3\ **Last updated:** [January 8, 2026, 3:00am UTC](https://developer.sailpoint.com/discuss/t/how-can-we-identify-the-source-of-account-change-audit-events-in-sailpoint/192387 "2026-01-08T03:00:34Z")
I want to understand how to differentiate audit events for account-level changes—such as account create, modify, delete, entitlement add, and entitlement remove—based on whether they were triggered by an aggregation task,… --- ## [SailPoint IIQ not capturing audit events for Edit Role](https://developer.sailpoint.com/discuss/t/sailpoint-iiq-not-capturing-audit-events-for-edit-role/186204)
**Author:** [@nighorpade](https://developer.sailpoint.com/discuss/u/nighorpade)\ **Replies:** 12\ **Last updated:** [January 2, 2026, 5:38pm UTC](https://developer.sailpoint.com/discuss/t/sailpoint-iiq-not-capturing-audit-events-for-edit-role/186204 "2026-01-02T17:38:54Z")
Which IIQ version are you inquiring about? 8.4 Please share any images or screenshots, if relevant. NA Please share any other relevant files that may be required (for example, logs). NA Share all details about your p… --- ## [Enhancement: Source Auditing Capabilities for the Schema Events](https://developer.sailpoint.com/discuss/t/enhancement-source-auditing-capabilities-for-the-schema-events/191616)
**Author:** [@dinesh\_mishra](https://developer.sailpoint.com/discuss/u/dinesh_mishra)\ **Replies:** 0\ **Last updated:** [December 23, 2025, 4:19am UTC](https://developer.sailpoint.com/discuss/t/enhancement-source-auditing-capabilities-for-the-schema-events/191616 "2025-12-23T04:19:52Z")
:bangbang: As an extension to our source auditing capability, we are excited to announce that the source auditing capability is now extended for the specific schema attribute auditing in the Identity Security Cloud! Now… --- ## [Filtering AuditEvent in a custom report inside an attribute (8.4)](https://developer.sailpoint.com/discuss/t/filtering-auditevent-in-a-custom-report-inside-an-attribute-8-4/185440)
**Author:** [@bjarcilla](https://developer.sailpoint.com/discuss/u/bjarcilla)\ **Replies:** 1\ **Last updated:** [October 29, 2025, 7:24am UTC](https://developer.sailpoint.com/discuss/t/filtering-auditevent-in-a-custom-report-inside-an-attribute-8-4/185440 "2025-10-29T07:24:20Z")
Filtering AuditEvent in a custom report inside an attribute (8.4) Hi all, I’m trying to filter the AuditEvent from the Native Change Operation from this sample \ **Author:** [@karamchandr\_wipro](https://developer.sailpoint.com/discuss/u/karamchandr_wipro)\ **Replies:** 6\ **Last updated:** [October 15, 2025, 5:32pm UTC](https://developer.sailpoint.com/discuss/t/application-configuration-history-tracking/185060 "2025-10-15T17:32:13Z") Which IIQ version are you inquiring about? 8.3 and 8.4 Please share any images or screenshots, if relevant. No Please share any other relevant files that may be required (for example, logs). No Share all details about… --- ## [How do YOU audit transform changes?](https://developer.sailpoint.com/discuss/t/how-do-you-audit-transform-changes/174196)
**Author:** [@sup3rmark](https://developer.sailpoint.com/discuss/u/sup3rmark)\ **Replies:** 5\ **Last updated:** [September 24, 2025, 4:25am UTC](https://developer.sailpoint.com/discuss/t/how-do-you-audit-transform-changes/174196 "2025-09-24T04:25:53Z")
New transforms and changes to existing transforms are not captured in SailPoint audit logs, but transforms are certainly highly relevant to auditors. The transforms we use to determine lifecycle state, at the very least,… --- ## [Auditing attrib changes on links](https://developer.sailpoint.com/discuss/t/auditing-attrib-changes-on-links/177129)
**Author:** [@ralfonse](https://developer.sailpoint.com/discuss/u/ralfonse)\ **Replies:** 2\ **Last updated:** [September 8, 2025, 2:46am UTC](https://developer.sailpoint.com/discuss/t/auditing-attrib-changes-on-links/177129 "2025-09-08T02:46:00Z")
Which IIQ version are you inquiring about? 8.3 Hello I am looking for an approach to auditing attrib changes on linked accounts. We have various applications configured (webService, ldap, db, etc…) I’ve added some sc… --- ## [How to query provisioning audit event for Certification revocation using code](https://developer.sailpoint.com/discuss/t/how-to-query-provisioning-audit-event-for-certification-revocation-using-code/159159)
**Author:** [@maniG](https://developer.sailpoint.com/discuss/u/maniG)\ **Replies:** 6\ **Last updated:** [August 4, 2025, 2:55pm UTC](https://developer.sailpoint.com/discuss/t/how-to-query-provisioning-audit-event-for-certification-revocation-using-code/159159 "2025-08-04T14:55:35Z")
Is it possible to query an audit event for revocation during Certification ? Using Source and action and application as input for the query Thanks --- ## [Generate Audit Report](https://developer.sailpoint.com/discuss/t/generate-audit-report/160774)
**Author:** [@sjagirdar1580](https://developer.sailpoint.com/discuss/u/sjagirdar1580)\ **Replies:** 3\ **Last updated:** [July 27, 2025, 6:22pm UTC](https://developer.sailpoint.com/discuss/t/generate-audit-report/160774 "2025-07-27T18:22:59Z")
Which IIQ version are you inquiring about? 8.1,8.2 Share all details about your problem, including any error messages you may have received. I am looking to generate an audit report of all user activity of the default a… --- ## [Merge Tag for Audit Configuration](https://developer.sailpoint.com/discuss/t/merge-tag-for-audit-configuration/103071)
**Author:** [@Rounak\_Bal](https://developer.sailpoint.com/discuss/u/Rounak_Bal)\ **Replies:** 1\ **Last updated:** [March 6, 2025, 3:27am UTC](https://developer.sailpoint.com/discuss/t/merge-tag-for-audit-configuration/103071 "2025-03-06T03:27:51Z")
Which IIQ version are you inquiring about? 8.4p2 Please share any images or screenshots, if relevant. Share all details about your problem, including any error messages you may have received. Hello Everyone, I am tr… --- ## [Can't see Audit Debug Object Browser Checkbox](https://developer.sailpoint.com/discuss/t/cant-see-audit-debug-object-browser-checkbox/102147)
**Author:** [@NaderTareen](https://developer.sailpoint.com/discuss/u/NaderTareen)\ **Replies:** 1\ **Last updated:** [February 25, 2025, 7:54am UTC](https://developer.sailpoint.com/discuss/t/cant-see-audit-debug-object-browser-checkbox/102147 "2025-02-25T07:54:07Z")
Which IIQ version are you inquiring about? \[Replace this text with your version of IIQ. The more specific you can be (7.1, 8.3, 8.X), the more people can help. If you do not know, put Unsure.\] 8.4p2 Please share any im… --- ## [SailPoint ISC addon installation on a Splunk Universal Forwarder?](https://developer.sailpoint.com/discuss/t/sailpoint-isc-addon-installation-on-a-splunk-universal-forwarder/96214)
**Author:** [@smithi1524](https://developer.sailpoint.com/discuss/u/smithi1524)\ **Replies:** 0\ **Last updated:** [January 8, 2025, 9:37am UTC](https://developer.sailpoint.com/discuss/t/sailpoint-isc-addon-installation-on-a-splunk-universal-forwarder/96214 "2025-01-08T09:37:19Z")
Is there a way to install SailPoint ISC addon for Splunk, on a Splunk Universal Forwarder? This is not mentioned in the official page of then addon: What have you tried? I attempted to install on a Single (non-dist… --- ## [Rule to get Audit event in IIQ](https://developer.sailpoint.com/discuss/t/rule-to-get-audit-event-in-iiq/94531)
**Author:** [@rishavghoshacc](https://developer.sailpoint.com/discuss/u/rishavghoshacc)\ **Replies:** 3\ **Last updated:** [December 31, 2024, 7:39am UTC](https://developer.sailpoint.com/discuss/t/rule-to-get-audit-event-in-iiq/94531 "2024-12-31T07:39:01Z")
Hi all, Can you please guide me on how to get only the old value and new value change in audit? I want to get only the ones where the status has changed from Active to Terminated Thanks in advance --- ## [Audit Event for Attribute Change](https://developer.sailpoint.com/discuss/t/audit-event-for-attribute-change/94487)
**Author:** [@MakileshP](https://developer.sailpoint.com/discuss/u/MakileshP)\ **Replies:** 4\ **Last updated:** [December 23, 2024, 4:05pm UTC](https://developer.sailpoint.com/discuss/t/audit-event-for-attribute-change/94487 "2024-12-23T16:05:58Z")
Hello, I have a requirement to create an Audit event when a user’s particular identity Attribute changes. There is an mover event already existing that triggers when user’s department attribute changes. Can I create ano… --- ## [Track approved access requests that failed during provisioning](https://developer.sailpoint.com/discuss/t/track-approved-access-requests-that-failed-during-provisioning/88584)
**Author:** [@khalilgahbiche](https://developer.sailpoint.com/discuss/u/khalilgahbiche)\ **Replies:** 5\ **Last updated:** [November 5, 2024, 9:43am UTC](https://developer.sailpoint.com/discuss/t/track-approved-access-requests-that-failed-during-provisioning/88584 "2024-11-05T09:43:37Z")
As part of our internal audit controls, we’d like to track approved access requests that failed during provisioning. We’ve made several search queries, but couldn’t find the one that satisfies our need. Can anyone help … --- ## [Audit log for user invitation: actor is incorrect](https://developer.sailpoint.com/discuss/t/audit-log-for-user-invitation-actor-is-incorrect/86841)
**Author:** [@adamian](https://developer.sailpoint.com/discuss/u/adamian)\ **Replies:** 1\ **Last updated:** [October 25, 2024, 2:50pm UTC](https://developer.sailpoint.com/discuss/t/audit-log-for-user-invitation-actor-is-incorrect/86841 "2024-10-25T14:50:40Z")
What problem are you observing? If the user ADMIN invites the user TARGET to ISC, the logs say that the actor was TARGET, not ADMIN. The actor and the target are the same, although I haven’t invited myself. Why? Wha… --- ## [IDN API events audit](https://developer.sailpoint.com/discuss/t/idn-api-events-audit/85801)
**Author:** [@victdelgado](https://developer.sailpoint.com/discuss/u/victdelgado)\ **Replies:** 2\ **Last updated:** [October 18, 2024, 6:41am UTC](https://developer.sailpoint.com/discuss/t/idn-api-events-audit/85801 "2024-10-18T06:41:59Z")
we are waching that the “API” “events” that was implemented in before api versions, was deprecated, what is the new api to get the audit events, we need to get the changes when some user is assing the “admin user level”. … --- ## [How to identify an actor in an event if appearing as system?](https://developer.sailpoint.com/discuss/t/how-to-identify-an-actor-in-an-event-if-appearing-as-system/82728)
**Author:** [@jsosa](https://developer.sailpoint.com/discuss/u/jsosa)\ **Replies:** 5\ **Last updated:** [September 25, 2024, 12:40pm UTC](https://developer.sailpoint.com/discuss/t/how-to-identify-an-actor-in-an-event-if-appearing-as-system/82728 "2024-09-25T12:40:23Z")
Hi! We need to identify who are changing identity lifecycle state. But looking at event, it appears that actor is “system”. Also, search does not give us more information: Client needs to audit the real autor of… --- ## [Audit Events name under Advanced Analytics](https://developer.sailpoint.com/discuss/t/audit-events-name-under-advanced-analytics/80872)
**Author:** [@schaudhury](https://developer.sailpoint.com/discuss/u/schaudhury)\ **Replies:** 13\ **Last updated:** [September 17, 2024, 8:49am UTC](https://developer.sailpoint.com/discuss/t/audit-events-name-under-advanced-analytics/80872 "2024-09-17T08:49:31Z")
Which IIQ version are you inquiring about? 8.4 Hi Everyone, We have enabled the below list in audit configuration page of IIQ but unable to understand what we need select in the Action tab under Audit in Advanced Analy… --- ## [Tracking Export and Import Activity](https://developer.sailpoint.com/discuss/t/tracking-export-and-import-activity/81042)
**Author:** [@shruthi\_m](https://developer.sailpoint.com/discuss/u/shruthi_m)\ **Replies:** 4\ **Last updated:** [September 12, 2024, 9:41pm UTC](https://developer.sailpoint.com/discuss/t/tracking-export-and-import-activity/81042 "2024-09-12T21:41:51Z")
Is there any way to track export and import activity that is happened in IdentityIQ UI? --- ## [Splunk ISC Addon for audit](https://developer.sailpoint.com/discuss/t/splunk-isc-addon-for-audit/72915)
**Author:** [@baoussounda](https://developer.sailpoint.com/discuss/u/baoussounda)\ **Replies:** 4\ **Last updated:** [August 27, 2024, 2:53pm UTC](https://developer.sailpoint.com/discuss/t/splunk-isc-addon-for-audit/72915 "2024-08-27T14:53:21Z")
Hi, Has any have an experience on Splunk ISC Addon for audit with Splunk Entreprise ? If yes, which type on installation areyou tested ? We tested deployement with index, heavy forwader, etc. but they doesn’t work. … --- ## [Audit Logs for Scheduled Work Reassignment Deleted](https://developer.sailpoint.com/discuss/t/audit-logs-for-scheduled-work-reassignment-deleted/72821)
**Author:** [@schen](https://developer.sailpoint.com/discuss/u/schen)\ **Replies:** 5\ **Last updated:** [August 7, 2024, 8:56am UTC](https://developer.sailpoint.com/discuss/t/audit-logs-for-scheduled-work-reassignment-deleted/72821 "2024-08-07T08:56:02Z")
I was able to use /beta/reassignment-configurations for logs of Scheduled Work Assignments that are Expired or Active in the organization. However, users are able to delete Scheduled Reassignments. Documentation show au… [Next page](https://developer.sailpoint.com/discuss/tag/audit/558.md?match_all_tags=true&page=1&tags%5B%5D=audit)