- Get Started with Attack Surface Insights
- Configure Attack Surface Insights
- Search for Entities in Attack Surface Insights
- View Entities in Attack Surface Insights
- Manage Entities in Attack Surface Insights
- Entity Attributes
User Entity Attributes
Review all attributes available in Attack Surface Insights for user entities.
ara
Entity Attribute | Machine Name | Definition | Example | Source |
|---|---|---|---|---|
Full Name |
| The printable display name for the user, usually represented as a combination of first name, middle initial, and last name. | Barbara Salazar | Context |
Source |
| The sources from where the entity attributes are derived. |
| Event or Context |
User Name |
| The user names associated with the user. To derive the username from an event, Attack Surface Insights considers certain event fields in a specific order:
The first event field with a value is considered the username. | barbara.salazar | Event |
Email Address |
| The email addresses associated with the user. | Event | |
First Name |
| The given name for the user. | Barbara | Context |
Last Name |
| The surname or family name for the user. | Salazar | Context |
Mobile Number |
| The primary cellular telephone number for the user. | +1 123 456 7890 | Context |
Security Criticality |
| The level of potential organizational risk if the entity becomes compromised. When an entity is created, it is assigned a security criticality of Low (3) by default. For user entities, security criticality is determined by either the highest security criticality of all accounts associated with the user entity or an Attack Surface Insights rule. | High | Attack Surface Insights |
Tags |
| Labels or keywords you create and add to entities to categorize them or indicate they have a certain characteristic. | Privileged User | Attack Surface Insights |
Badge ID |
| The badge ID in the event associated with the user. | C102230 | Event |
Employee ID |
| The code used to identify that the user works for a company. | ISED0003 | Event |
Phone Number |
| The primary work phone number for the user. | +1 123 456 7890 | Context |
Department |
| Name of the department in which the user works. | Engineering | Context |
Department Number |
| A number used to identify a department within an organization. | 1100 | Context |
Title |
| The formal job title for the user. Not typically used to indicate occupational class, like programmer; or for titles with suffixes like Esq. or DDS. | Senior Programmer | Context |
Manager |
| The manager to whom a user reports. | Tu Peterson | Context |
Country |
| Country or region where the user is located. | US | Context |
City |
| A locality, such as a town or city, in the user's address. | Philadelphia | Context |
Employee Type |
| An employment category for an employee. | Contractor | Context |
Division |
| The division of the company in which the user works. | R&D | Context |
Lockout |
| Whether the user is locked out of their accounts. | Unlocked | Event |
Is Active |
| Whether the user has successfully logged into an account within the last 12 hours. | True | Event |
Current Logged Endpoint |
| The endpoint into which the user is currently logged in. | Barbaras-MacBook-Pro | Event |
Last Logged Endpoint |
| The endpoint into which the user was most recently logged in. | src_host_name | Event |
Is On VPN |
| Whether the user is currently connected to VPN. | Connected | Event |
Last Password Reset |
| The time when the last user last reset their password. | 10/26/2023, 3:37:23 PM | Event |
First Seen |
| The time when the user was first seen. | 10/26/2023, 3:37:23 PM | Event |
Last Seen |
| The time when the user was last seen. | 10/26/2023, 3:37:23 PM | Event |
Last Badge Access |
| The location and time when the user last used their badge to access a physical location. | Pune 10/26/2023, 3:37:23 PM | Context |
User SID |
| A unique security identifier for a security principal object. Calculated based on a binary value that specifies a unique security identifier for the security pricipal object. | A-1-2-34-567890123-4567890123-4567890123-456789 | Event |
Event ID |
| The ID of the event that created the user entity. | 12a34567-b8c9-01de-2fgh-3i45i6j7k89l | Event |
Account Status |
| Whether an account associated with the user is active, expired, locked out, disabled, or has an expired password. |
| Context |
Rule Name |
| The Attack Surface Insights rule that determined the security criticality and tags for the user entity. | Privileged Users | Attack Surface Insights |
Link Method |
| Added to user entity attributes when an identifier is linked to a user entity as an account. The method used to link the account with the user entity. |
| Attack Surface Insights |
Link Context Field |
| Added to user entity attributes when an identifier is linked to a user entity as an account. The context field that matched the identifying entity attribute. | u_user_name | Attack Surface Insights |
Link Source Key |
| Added to user entity attributes when an identifier is linked to a user entity as an account. The identifying entity attribute that matched the context field. | username | Attack Surface Insights |
Link Matched Value |
| Added to user entity attributes when an identifier is linked to a user entity as an account. The actual value that matched in both the entity and context. | barbara | Attack Surface Insights |
Link Entity ID |
| Added to user entity attributes when an identifier is linked to a user entity as an account. The internal ID of the entity to which the account is linked. | sub123#UXIbarbara | Attack Surface Insights |
Link Context Source |
| Added to user entity attributes when an identifier is linked to a user entity as an account. The context source of the context field. |
| Attack Surface Insights |
Link Context Table Name |
| Added to user entity attributes when an identifier is linked to a user entity as an account. The name of the context table where the context field was stored. | User Entity Links | Attack Surface Insights |
Link Context Table ID |
| Added to user entity attributes when an identifier is linked to a user entity as an account. The internal ID of the context table. | Attack Surface Insights | |
Link Timestamp |
| Added to user entity attributes when an identifier is linked to a user entity as an account. When the link was created. Displayed as a date and time. The machine field value is a Unix timestamp in milliseconds. | 3/9/2024, 11:00:00 AM 1710093600000 | Attack Surface Insights |