- Get Started with Attack Surface Insights
- Configure Attack Surface Insights
- Get an Overview of Entities in Attack Surface Insights
- Review Entity Health in Attack Surface Insights
- Search for Entities in Attack Surface Insights
- View Entities in Attack Surface Insights
- Manage Entities in Attack Surface Insights
- Entity Attributes
Enforce Linking Between Specific User Identities
To ensure specific user identities are always linked, define relationships between user identities in the User Entity Links pre-built context table. By mapping these relationships yourself, you have more control over the accounts linked to user entities.
Caution
Only use the User Entity Links context table with help from Exabeam Support or Exabeam Professional Services.
Custom linking isn't automatically applied to existing user entities. Custom linking applies only when:
Entities containing the source context field and source value are linked with entities containing the target context field and target value.
Example
You enter the following in the context table:
User Entity Link Id |
|---|
u_user_name:::barbara.salazar:::u_employee_id:::salazar1 |
In an event, Attack Surface Insights identifies username attribute value barbara.salazar.
The entity created from the event is linked to all other identities that share context data u_employee_id salazar1. The new entity is merged and becomes a new account under a single unified entity.
If you map multiple identities together—for example, if a username is mapped to an email, and the email is mapped to an SID—Attack Surface Insights unifies them all under a single user entity.
Example
You enter the following in the context table:
User Entity Link Id |
|---|
u_username:::barbara.salazar:::u_employee_id:::salazar1 |
u_employee_id:::salazar1:::u_object_sid::::S-1-2-34-567 |
In an event, Attack Surface Insights identifies username attribute value barbara.salazar.
The entity created from the event is linked to all other identities that share context data u_employee_id salazar1 AND u_object_sid S-1-2-34-567. The new entity is merged and becomes a new account under a single unified entity.
You can use regular expressions in the source value only.
You can add column values to the context table, either programmatically using APIs or manually.
Attack Surface Insights prioritizes enriching user entities with context data from the User Entity Links context data first, alongside Microsoft Active Directory and before any other context source.
Regular Expressions in the User Entity Links Context Table
Regular expressions in the User Entity Links context table uses the Java flavor of regex.
Regex can be complex with a steep learning curve, so ensure you understand the syntax and test your queries before entering them in the context table. To test your regex pattern, enter it into Attack Surface Insights search and verify that it returns the entities you expect.
To learn more about regex syntax, you can use the following resources:
Regex101 – To test and view an explanation of your regex pattern, select the Java flavor from the panel, then enter a specific regex pattern.
RegExr – View an explanation of your regex pattern (not Java-specific but very user-friendly).
RE2 Syntax Documentation – Reference for understanding the syntax for the specific regex engine Exabeam supports.
Enter a Regular Expression in the User Entity Links Context Table
You can use regular expressions in the source value only.
To indicate that an expression should be treated as regex, enclose the pattern using the following format: #{pattern}#.
Example
If you enter in the context table:
User Entity Link Id |
|---|
u_user_name:::#{svc-backup-(prod|staging}dev)}:::u_user_name:::[email protected] |
The entity created from an event containing username svc-backup-prod, svc-backup-staging, or svc-backup-dev is linked with any entities that share context data u_user_name [email protected]. The new entity is merged and becomes a new account under a single unified entity.
If you use a capture group in the source value, you can substitute the capture group in the target value using the syntax $(#), where # represents the group number.
Example
If you enter in the context table:
User Entity Link Id |
|---|
u_user_name:::#{svc-backup-(prod|staging|dev)-([a-z]{2})}#:::u_user_name:::backup-operator-$(2)-$(1)@acme.com |
$(1) in the target value references the first group, (prod|staging|dev).
$(2) in the target value references the second group, ([a-z]{2}).
If an event contains username svc-backup-prod-us creates a new entity, the new entity is linked with any entities that share context data u_user_name [email protected]. The new entity is merged and becomes a new account under a single unified entity.
To test a regular expression used in the context table, you can enter the regular expression as a query in Attack Surface Insights search and verify if it returns the entities you expect.