Skip to main content

Responses are generated using AI and may contain mistakes.

Attack Surface InsightsAttack Surface Insights Guide

Apply Custom Linking Updates to an Existing User Entity

When you update the User Entity Links or User Entity Do-Not-Link pre-built context tables, these updates are not automatically applied to existing user entities. To ensure user identities are linked according to the updated information in the context tables, you must delete the affected entity, then allow Attack Surface Insights to recreate it.

Warning

Removing a relationship from the context tables can have unintended consequences that affect your investigations. Always consult with Exabeam Support before making any changes.

  1. Update the context table with new or updated information.

  2. To allow Attack Surface Insights to process the update and clear any cached details, wait 15 to 30 minutes.

  3. Delete the user entities affected by the updated information.

    With the next relevant event, Attack Surface Insights recreates the entity and correctly links it to the relevant user identities according to the relationships you defined in the context tables.