- Get Started with Attack Surface Insights
- Configure Attack Surface Insights
- Get an Overview of Entities in Attack Surface Insights
- Review Entity Health in Attack Surface Insights
- Search for Entities in Attack Surface Insights
- View Entities in Attack Surface Insights
- Manage Entities in Attack Surface Insights
- Entity Attributes
Prohibit Linking Between Specific User Identities
To ensure specific user entities are never linked, define relationships between user identities in the User Entity Do-Not-Link pre-built context table. By mapping these relationships yourself, you can create standalone user entities and have more control over the accounts linked to user entities.
Caution
Only use the User Entity Do-Not-Link context table with help from Exabeam Support or Exabeam Professional Services.
By default, the User Entity Do-Not-Link context table has one column, User Entity Do Not Link Id. The value of each row should follow a specific format: SourceContextField:::SourceValue:::TargetContextField::::TargetValue.
Entities containing the source field and source value will never link with entities containing the target field and target value.
Example
You enter the following in the context table:
User Entity Link Id |
|---|
u_user_name:::[email protected]:::u_user_name:::[email protected] |
In an event, Attack Surface Insights identifies username attribute value [email protected] and creates a new entity.
Even though the prefix, backup-operator matches the prefix of [email protected], the new entity will never link to any entities that share the u_user_name [email protected] context data.
If there are no other entities to which the new entity can be linked, it remains a standalone entity.
If you map multiple identities together—for example, if a username is mapped to an email, and the email is mapped to an SID—Attack Surface Insights will never link any of the matching identities together.
Example
You enter the following in the context table:
User Entity Link Id |
|---|
u_user_name:::[email protected]:::u_user_name:::[email protected] |
u_user_name:::[email protected]:::u_user_name:::backup.operator - admin |
In an event, Attack Surface Insights identifies username attribute value [email protected] and creates a new entity.
Even though the prefix, backup.operator matches that of both u_user_name values [email protected] and backup.operator - admin, the new entity will never link to any entities that share either context data.
If there are no other entities to which the new entity can be linked, it remains a standalone entity.
You can add column values to the context table, either programmatically using APIs or manually.
Standalone entities not linked to any other entities are still enriched with relevant context data.
Regular Expressions in the User Entity Do-Not-Link Context Table
Regular expressions in the User Entity Do-Not-Link context table uses the Java flavor of regex with one limitation.
Regex can be complex with a steep learning curve, so ensure you understand the syntax and test your queries before entering them in the context table. To test your regex pattern, enter it into Attack Surface Insights search and verify that it returns the entities you expect.
To learn more about regex syntax, you can use the following resources:
Regex101 – To test and view an explanation of your regex pattern, select the Java flavor from the panel, then enter a specific regex pattern.
RegExr – View an explanation of your regex pattern (not Java-specific but very user-friendly).
RE2 Syntax Documentation – Reference for understanding the syntax for the specific regex engine Exabeam supports.
Enter a Regular Expression in the User Entity Do-Not-Link Context Table
You can use regular expressions in both the source value and target value, with some limitations.
To indicate that an expression should be treated as regex, enclose the pattern using the following format: #{pattern}#.
Example
You enter the following in the context table:
User Entity Link Id |
|---|
u_user_name:::#{svc-[a-z]+-(prod|staging|dev)}#:::u_user_name:::#{admin-[a-z]+}# |
The entity created from an event containing username values like svc-backup-prod, svc-demo-staging, or svc-west-dev will never link to entities that share the context data u_user_name with values like admin-billing, admin-security, or admin-barbara.
To test a regular expression used in the context table, you can enter the regular expression as a query in Attack Surface Insights search and verify if it returns the entities you expect.
Regex Limitations in the User Entity Do-Not-Link Context Table
If you define a grouping in the source value, you can't refer to that grouping in the target value.