Hello All, Wondering if anyone can help? I am currently looking at RBA and adding a multiplier to any users that are leaving. At first glance, I was wondering whether to look at risk_object_endDate=*, but am now wondering how the lookup for identity works and if I can be clever and add a category "leaver" to the user (or risk_object_identity_tag that index=risk will pick up). From some research I think the identity lookup is being ran by many searches but mainly from ldapsearch. Does this mean it is picking up categories from LDAP? Not sure how to check what the lookup is running to fill it's contents. Any help/guidance would be great! Thank you, J.
... View more