Skip to main content

Responses are generated using AI and may contain mistakes.

Attack Surface InsightsAttack Surface Insights Guide

How Linking Works

Learn how Attack Surface Insights links related identities to an entity using context data.

Linking Prerequisites

Linking requires context data that you must provide, either by onboarding context tables from a supported context source or customizing the User Entity Links pre-built context table in Context Management.

The Linking Process

After Attack Surface Insights creates a new entity, it queries your context tables for the attribute value it used to uniquely identify an entity in an event. If there is a match for the attribute value in context, other identities that share the same attribute are considered related and are linked.

In most cases, Attack Surface Insights matches attributes to the equivalent context field only. For example, if the identifying entity attribute is email_address, Attack Surface Insights queries context for u_email field only. The only exceptions are:

  • user_name and email_address

  • email_address and Primary Login (Email Format)

Attack Surface Insights tries different methods to find a match in a specific order:

  1. Attack Surface Insights searches the User Entity Link context table for the attribute.

    Example

    In an event, Attack surface Insights identifies the username value barbara.

    In the User Entity Links context table, it finds username value barbara.

    Attack Surface Insights links the identity created from the event with all other identities that share context data username barbara.

  2. If the attribute is user_sid, Attack Surface Insights searches for a matching objectSid in Active Directory context data. This is the only linking method where Attack Surface Insights links together two different attributes.

    Example

    In an event, Attack Surface Insights identifies the user_sid value S-1-2-34-567.

    In context, it finds objectSid with value S-1-2-34-567.

    Attack Surface Insights links the identity created from event with all other identities linked that share context data objectSid S-1-2-34-567.

  3. If the attribute value contains @, Attack Surface Insights conducts a prefix search, matching the attribute against the same context fields.

    During a prefix search, Attack Surface Insights removes everything after the delimiter, @, matching only the prefix. If the prefixes match, Attack Surface Insights links the entity to the context record.

    Note

    Example

    In an event, Attack Surface Insights identifies username attribute value [email protected].

    In context, it finds username field with value [email protected].

    Attack Surface Insights links the identity created from the event with all other identities that share context data username [email protected].

    There are two exceptions to this:

    • If the attribute is email_address, Attack Surface Insights first checks if the domains after @ match. If the domains don't match, the entity isn't linked to that context record.

      Example

      In an event, Attack Surface Insights identifies email_address attribute value [email protected].

      In context, it finds email_address field with value [email protected].

      Because the domains after @ are not the same, Attack Surface Insights does not link the identity created from the event to identities that share context data email_address [email protected].

    • If the attribute value contains a hyphen and the prefix is administrator, admin, or root, the entity is excluded from the linking process.

      Example

      In an event, Attack Surface Insights identifies user_name attribute value [email protected].

      Because the attribute value contains a hyphen and the prefix before @ is admin, the entity is not linked to any other identities.

  4. If the attribute value contains - , space hyphen space, Attack Surface Insights conducts another prefix search, matching the attribute value against username context field values.

    In a prefix search with the - delimiter, Attack Surface Insights removes everything after the delimiter, - , matching only the prefix. If the prefixes match, Attack Surface Insights links the entity to the context record.

    Example

    In an event, Attack Surface Insights identifies user_name attribute value barbara.salazar - admin.

    In context, it finds username field with value barbara.salazar - user.

    Attack Surface Insights links the identity created from the event to all other identities that share context data username barbara.salazar - user.

    The only exception is if the prefix is administrator, admin, or root. In this case, the entity is excluded from the linking process.

    Example

    In an event, Attack Surface Insights identifies user_name attribute value admin - Cisco.

    Because the attribute value contains a hyphen and the prefix before - is admin, the entity is not linked to any other identities.

  5. If the attribute value does not meet any of the previous criteria, Attack Surface Insights searches for an exact match in context.

    Example

    In an event, Attack Surface Insights identifies username attribute value barbara.salazar.

    In context, it finds a matching u_user_name field with value barbara.salazar.

    Attack Surface Insights links the identity created from the event to all other identities that share context data u_user_name barbara.salazar.

If no matches are found, an entity isn't linked to any other identities and isn't enriched with context data. These entities are called orphaned entities.

If a match is found:

  • And a link doesn't already exist, Attack Surface Insights links the entity to all other entities linked through the context data, then enriches the entity with context data from the matching context record.

    If you configured multiple context sources, by default, Attack Surface Insights enriches entities with context data from Microsoft Active Directory and the User Entity Links pre-built context table first, then context data from the next available context source.

  • Linked identities are unified under a single entity. For user entities, each related identity is an account.

  • If a newly created entity is a user entity and it is uniquely identified by the username attribute, Attack Surface Insights searches orphaned entities using prefix searching with @ and - delimiters on username. If an orphaned entity attribute value matches the prefix of username, the orphaned entity is linked to the user entity and becomes an account under the user entity.

After the Linking Process

After a context record is linked to an entity, whenever an event containing the identifying attribute value is created and Attack Surface Insights hasn't looked up the attribute in your context tables in the last 12 hours, Attack Surface Insights queries the context record and updates the entity attribute with any new context data.

Linking Exceptions

There are a three exceptions to how Attack Surface Insights typically links entities to context:

Local Administrator Accounts

Local administrator accounts are not linked to context and always create individual entities.

If the attribute value contains a hyphen and the prefix before the @ or - delimeter is administrator, admin, or root, it is excluded from the linking process and Attack Surface Insights always creates an individual entity using the attribute value.

Example

In an event, Attack Surface Insights identifies user_name attribute value [email protected].

Because the attribute value contains a hyphen and the prefix before @ is admin, the entity is not linked to any other identities.

Example

In an event, Attack Surface Insights identifies user_name attribute value admin - Cisco.

Because the attribute value contains a hyphen and the prefix before - is admin, the entity is not linked to any other identities.

Example

In an event, Attack Surface Insights identifies user_name attribute value [email protected].

Because the attribute value does not contain a hyphen, it proceeds with prefix searching using the @ delimiter.

In context, it finds user_name attribute value [email protected].

Attack Surface Insights links the entity to the context record.

Optional Configuration for Email Address and Username Prefix Linking

Typically, email_address and user_name must be an exact match for entities to link. With an optional configuration, you can use prefix search so email addresses and usernames with identical prefixes but different domains are linked.

With this configuration, the prefix of the email_address or user_name is added to the entity as a username. For example, for email_address [email protected], the username barbara is added to the entity.

To enable this configuration for your environment, contact Exabeam Support.

Warning

Enabling this configuration may cause unrelated identities with the same user_name prefix to be merged under the same entity.

Entities Prohibited from Linking Using the User Entity Do-Not-Link Pre-Built Context Table

User identities mapped to each other through the User Entity Do-Not-Link pre-built context table will never link.