- Get Started with Attack Surface Insights
- Configure Attack Surface Insights
- Search for Entities in Attack Surface Insights
- View Entities in Attack Surface Insights
- Manage Entities in Attack Surface Insights
- Entity Attributes
User Entity Attributes
Review all attributes available in Attack Surface Insights for user entities.
Entity Attribute | Machine Name | Definition | Example | Source |
|---|---|---|---|---|
Full Name |
| The printable display name for the user, usually represented as a combination of first name, middle initial, and last name. | Barbara Salazar | Context |
Source |
| The sources from where the entity attributes are derived. |
| Event or Context |
User Name |
| The user names associated with the user. To derive the username from an event, Attack Surface Insights considers certain event fields in a specific order:
The first event field with a value is considered the username. | barbara.salazar | Event |
Email Address |
| The email addresses associated with the user. | Event | |
First Name |
| The given name for the user. | Barbara | Context |
Last Name |
| The surname or family name for the user. | Salazar | Context |
Mobile Number |
| The primary cellular telephone number for the user. | +1 123 456 7890 | Context |
Security Criticality |
| The level of potential organizational risk if the entity becomes compromised. | High | Attack Surface Insights |
Tags |
| Labels or keywords you create and add to entities to categorize them or indicate they have a certain characteristic. | Privileged User | Attack Surface Insights |
Badge ID |
| The badge ID in the event associated with the user. | C102230 | Event |
Employee ID |
| The code used to identify that the user works for a company. | ISED0003 | Event |
Phone Number |
| The primary work phone number for the user. | +1 123 456 7890 | Context |
Department |
| Name of the department in which the user works. | Engineering | Context |
Department Number |
| A number used to identify a department within an organization. | 1100 | Context |
Title |
| The formal job title for the user. Not typically used to indicate occupational class, like programmer; or for titles with suffixes like Esq. or DDS. | Senior Programmer | Context |
Manager |
| The manager to whom a user reports. | Tu Peterson | Context |
Country |
| Country or region where the user is located. | US | Context |
City |
| A locality, such as a town or city, in the user's address. | Philadelphia | Context |
Employee Type |
| An employment category for an employee. | Contractor | Context |
Division |
| The division of the company in which the user works. | R&D | Context |
Lockout |
| Whether the user is locked out of their accounts. | Unlocked | Event |
Is Active |
| Whether the user has successfully logged into an account within the last 12 hours. | True | Event |
Current Logged Endpoint |
| The endpoint into which the user is currently logged in. | Barbaras-MacBook-Pro | Event |
Last Logged Endpoint |
| The endpoint into which the user was most recently logged in. | src_host_name | Event |
Is On VPN |
| Whether the user is currently connected to VPN. | Connected | Event |
Last Password Reset |
| The time when the last user last reset their password. | 10/26/2023, 3:37:23 PM | Event |
First Seen |
| The time when the user was first seen. | 10/26/2023, 3:37:23 PM | Event |
Last Seen |
| The time when the user was last seen. | 10/26/2023, 3:37:23 PM | Event |
Last Badge Access |
| The location and time when the user last used their badge to access a physical location. | Pune 10/26/2023, 3:37:23 PM | Context |
User SID |
| A unique security identifier for a security principal object. Calculated based on a binary value that specifies a unique security identifier for the security pricipal object. | A-1-2-34-567890123-4567890123-4567890123-456789 | Event |
Event ID |
| The ID of the event that created the user entity. | 12a34567-b8c9-01de-2fgh-3i45i6j7k89l | Event |
Account Status |
| Whether an account associated with the user is active, expired, locked out, disabled, or has an expired password. |
| Context |
Rule Name |
| The Attack Surface Insights rule that determined the security criticality and tags for the user entity. | Privileged Users | Attack Surface Insights |
Link Method |
| Added to user entity attributes when an identifier is linked to a user entity as an account. The method used to link the account with the user entity. |
| Attack Surface Insights |
Link Context Field |
| Added to user entity attributes when an identifier is linked to a user entity as an account. The context field that matched the identifying entity attribute. | u_user_name | Attack Surface Insights |
Link Source Key |
| Added to user entity attributes when an identifier is linked to a user entity as an account. The identifying entity attribute that matched the context field. | username | Attack Surface Insights |
Link Matched Value |
| Added to user entity attributes when an identifier is linked to a user entity as an account. The actual value that matched in both the entity and context. | barbara | Attack Surface Insights |
Link Entity ID |
| Added to user entity attributes when an identifier is linked to a user entity as an account. The internal ID of the entity to which the account is linked. | sub123#UXIbarbara | Attack Surface Insights |
Link Context Source |
| Added to user entity attributes when an identifier is linked to a user entity as an account. The context source of the context field. |
| Attack Surface Insights |
Link Context Table Name |
| Added to user entity attributes when an identifier is linked to a user entity as an account. The name of the context table where the context field was stored. | User Entity Links | Attack Surface Insights |
Link Context Table ID |
| Added to user entity attributes when an identifier is linked to a user entity as an account. The internal ID of the context table. | Attack Surface Insights | |
Link Timestamp |
| Added to user entity attributes when an identifier is linked to a user entity as an account. When the link was created. Displayed as a date and time. The machine field value is a Unix timestamp in milliseconds. | 3/9/2024, 11:00:00 AM 1710093600000 | Attack Surface Insights |