Activity Search
Use the Activity Search panel to generate searches for activity information on applications and targets, by specific identities and population, over specific time periods. These searches can determine risk areas and track activity on sensitive applications in your enterprise.
Search results can be saved as reports for reuse. When you save a search as a report, you can schedule the search on an on-going basis for monitoring and tracking purposes. See Report Use(LINK IN DOC).
Activity Search Criteria
The search fields are inclusive or "AND" type searches. Only actions matching values specified in all fields are included in the search results.
To limit the search results, use search criteria. If you do not enter information or make a selection in a search criteria field, all possible choices are included. For example, if you do not select an application from the Applications list, all application configured to work with IdentityIQ are included.
Specify the search criteria and columns to display and click Run Search to display the search results. From the search results page, you can review the results of your search and save the search.
The Activity Search tab has the following information:
| Criteria | Description |
| Saved Searches: | |
| Search Name | The names of past searches that you saved for reuse. These Saved Searches are only available for your use. To make searches available to IdentityIQ users with Report access, save the search as a report. |
| Loaded Saved Search: | |
| The name and description of your current saved query. | |
| Run Search | Run the search with the criteria displayed on the current page. If you have modified the criteria of the Loaded Saved Search, the modified criteria is used for the search. |
| Clear Search | Unload the Loaded Saved Search and clear all query options. |
| Delete Search | Delete the specified Loaded Saved Query. |
| Activity Attributes: | |
| Type of Time Span: | |
| Time Period | If you want to filter by Time Period, select one or more time periods from the list. The definition for each time period is specified when IdentityIQ is configured. |
| Date of Activity | If you want to filter by Date of Activity, type the start and end dates for the search. Start Date -- include information on activity that occurred on or after this date in the search results. End Date -- include information on activity that occurred on or before this date in the search results. You can type the date manually or click the [...] icon to select a date from the calendar. |
| Actions: | |
| Action | The action that was performed. For example, login or create. Use the Shift and Ctrl keys to select multiple list items. Identities need to match only one of the selected items to be included in the search results. |
| Applications: | |
| Source Application | Select the applications to include in the search. If no applications are specified, all applications are included. Click the arrow to the right of the suggestion field to display a list of all applications or type a few letters in the field to display a list of applications that begin with that letter string. Identities need to match only one of the selected items to be included in the search results. |
| Type of Target: | |
| Category | If you want to filter by Category, select the category to search from the dropdown list. The Category dropdown has all of the activity target categories defined on the Activity Target Categories page. Activity Target Categories are groups of targets from one or more applications. |
| Targets | If you want to filter by Targets, specify the target that was acted upon. For example, a machine name for a login or a file name for a create action. |
| Identities or Populations: | |
| Identities | The name of the user or workgroup that requested the action. Entering the first letter or letters, of a name displays a selection list of users or workgroups with names that have that letter string or click the arrow to the right of the field to display all names. |
| Interesting Population | The population of identities to include in the search. The Interesting Populations dropdown list has the populations created based on the results of Identity Searches. The list has only the populations that you created or that their creator designated as public. |
| Activity Results: | |
| Result | The result of the action, Failure or Success. |
| Fields to Display: | |
| Activity Fields | Specify the information displayed on the Advanced Activity Search Results page.\ |