❓Basic Search & Advanced Query Mode
09/2024
Last updated
09/2024
Last updated
Identity Intelligence enables users to create simple but powerful searches with basic filters and also advanced queries that answer critical questions about your identity population. When in Advanced Query mode, you will be able to use Kibana Query Language to form more complex queries to find specific information that you may need that is not available in our Basic filters.
The default search mode within the UI allows for point-and-click combination of filters on the lefthand menu bar of the Users page.
The same type of click-to-filter functionality is available in the Activity tab of the User 360page.
By default, accounts that are disabled, deleted, or deprovisioned are filtered OUT of the Users page results. Clear this filter to see those accounts in your search results.
In Basic mode, searching with a leading wildcard, such as *<some term>, is not supported.
From the Users tab, click the Advanced button on the right side within the search bar
Alternatively, if you select a Basic filter from the left hand side of the Users table, it will add a chip for the selected filter in Basic mode to the Search bar. Click on that chip in the search bar to convert that filter to an Advanced attribute, which enables you to edit that attribute
Additional filters can be added and edited to the existing search string
At any point, you can convert back to the Basic filter mode by clicking the Advanced button and confirming that you'd like to switch back to Basic mode. Please note that converting back will remove anything written into the search string
The user records in Identity Intelligence contain a large number of attributes or fields that can be queried in Advanced search mode. The Attribute List is constantly being updated as new functionality and integrations are added.
The best way to find a particular attribute is to click the Advanced button, which will open the list of available attributes that can be used to create queries. Start typing your desired attribute into the search bar to trigger the auto-complete functionality, which allows you to see what attributes exist that include your keywords, or scroll through the alphabetized list of attributes to see everything that exists! There are also hints frozen to the "bottom" of the attribute list that can help guide you when crafting more complex queries.
The Advanced search follows the convention operators of KQL (reference article), including -
AND
OR
NOT
_exists_
!_exists_
This section provides several examples for building queries within the Advanced search bar.
To find users with the following set of parameters -
users in the GSuite
Admins group
no MFA enabled
recently logged in
subject of an IP threat from a VPN or Tor proxy
The query would look like:
To find users with recent IP activity from a particular Country, such as China, the advanced query would look like:
To list user accounts without an Employee ID attribute value, it would look like:
To find inactive users who's accounts start with "sa." and contain the word "company", the query would look like:
Note: free text search will look in all indexed fields within the user profile, for example email address, UPN, etc.
Identity Intelligence attempts to determine admin privileges or roles granted to accounts. To search for the admin accounts associated with only one specific IDP, the query would look like one of the following, depending on the IDP desired:
Identity Intelligence is able to collect assigned Microsoft license types through the Azure Graph API. This information is displayed in the Azure tile of the Overview tab for a user account.
To query for a specific license type, the search string would look like:
Note: the License name value is a translation from the license UID provided through the Graph API.
A common query is to search for the users who have a particular type of MFA factor enrolled, such as push notification, hardware security keys, etc.
Use the userFactors.factorType.keywordattribute to search for different enrolled factor types, as shown:
The available factor types and names will vary based on which IAM platforms are connected to Identity Intelligence. Some common factor names include:
A comprehensive list of factor types seen so far is below in the Factor List section.
It is frequently useful to look for both which users have an application assigned and which users are actually using the application.
For example, to look for users who have application Salesforce SAML assigned, but not in use in their last 30 days of activity, the query would look like:
Note: Sensitive applications can be seen in the Dashboard tab and all applications that are integrated via an IDP or directly can be seen in a User's Applications tab. Sensitive Applications can be configured through Tenant Settings
If looking for users with sign-in activity from a particular user-agent string or device type, for instance iPhones, the search string might look like:
To find a user account by an alias in Duo Security, use this format:
Across the different IDPs, factors may have a variety of different names, which may change or grow over time. The list below provides examples of factor names that Identity Intelligence has seen so far.
