Attack Surface InsightsAttack Surface Insights Guide

A user entity is an individual human who interacts with your environment; for example, an employee, contractor, or customer. A user entity may have multiple identities, called accounts.

To create user entities and accounts, Attack Surface Insights looks for user identities in incoming logs. If a user identity can't be linked to any others, it creates a new user entity. If a user identity is related to other existing user identities, it is considered an account under an existing user entity.

In incoming logs, Attack Surface Insights identifies user identities by any one of the following attributes:

For example: Attack Surface Insights first identifies the username bsalazar in a log and can't link it to any other existing identities, so it creates a new user entity called Barbara Salazar. Later, it identifies the email [email protected] in another log and finds that it is related to bsalazar in a context record. Because both identifiers are linked to the same context record, the email becomes an account under the existing Barbara Salazar user entity.

User entities have a specific set of attributes. You can review the attributes for a particular user entity or user account in Attack Surface Insights.