---
updatedAt: 2025-11-04T15:07:55.000Z
agentTools:
  projectIndex: https://docs.query.ai/llms.txt
---

# Identity Activity Metrics

<code>identity\_activity\_metrics</code>

The Identity Activity Metrics object captures usage patterns, authentication activity, credential usage and other metrics for identities across cloud and on-premises environments. Example identities include AWS IAM Users, Roles, Azure AD Principals, GCP Service Accounts, on-premises Active Directory accounts.

## Attributes

<table>
    <tr><th>Caption</th><th>Name</th><th>Type</th><th>Description</th></tr>
    <tr id="attr-first_seen_time">
        <td>First Seen</td>
        <td><code>first_seen_time</code></td>
        <td>
            <a href="/docs/types#timestamp_t">Timestamp</a>
        </td>
        <td>
        The timestamp when this identity was first observed or created in the system. This helps establish the identity&#39;s age and lifecycle stage for risk assessment.
        
        </td>
    </tr>
    <tr id="attr-last_authentication_time">
        <td>Last Authentication Time</td>
        <td><code>last_authentication_time</code></td>
        <td>
            <a href="/docs/types#timestamp_t">Timestamp</a>
        </td>
        <td>
        The timestamp when this identity last successfully authenticated to any system or service. This differs from last_seen_time as it specifically tracks authentication events rather than all activities.
        
        </td>
    </tr>
    <tr id="attr-last_seen_time">
        <td>Last Seen</td>
        <td><code>last_seen_time</code></td>
        <td>
            <a href="/docs/types#timestamp_t">Timestamp</a>
        </td>
        <td>
        The timestamp of the most recent activity performed by this identity, including authentication, resource access, or API calls. This is the most comprehensive indicator of identity usage recency.
        
        </td>
    </tr>
    <tr id="attr-password_last_used_time">
        <td>Password Last Used Time</td>
        <td><code>password_last_used_time</code></td>
        <td>
            <a href="/docs/types#timestamp_t">Timestamp</a>
        </td>
        <td>
        The timestamp when password-based authentication was last used by this identity. This helps distinguish between password and other authentication methods (MFA, SSO, certificates) and identify password-specific usage patterns.
        
        </td>
    </tr>
    <tr id="attr-programmatic_credentials">
        <td>Programmatic Credentials</td>
        <td><code>programmatic_credentials</code></td>
        <td>
            <a href="/docs/obj-programmatic_credential">Programmatic Credential[]</a>
        </td>
        <td>
        Details about the programmatic credentials associated with this identity, such as API keys, service account keys, access tokens, and client certificates used for automated access.
        
        </td>
    </tr>
    <tr id="attr-raw_data">
        <td>Raw Data</td>
        <td><code>raw_data</code></td>
        <td>
            <a href="/docs/types#json_t">JSON</a>
        </td>
        <td>
            <strong>Group:</strong><code>context</code><br/>
        The event data as received from the event source.
        
        </td>
    </tr>
    <tr id="attr-record_id">
        <td>Record ID</td>
        <td><code>record_id</code></td>
        <td>
            <a href="/docs/types#string_t">String</a>
        </td>
        <td>
            <strong>Group:</strong><code>primary</code><br/>
        Unique identifier for the object
        
        </td>
    </tr>
    <tr id="attr-unmapped">
        <td>Unmapped</td>
        <td><code>unmapped</code></td>
        <td>
            <a href="/docs/obj-unmapped">Unmapped[]</a>
        </td>
        <td>
        Data from the source that was not mapped into the schema.
        
        </td>
    </tr>
</table>

## Relationships

<img src="https://schema.query.ai/images/obj-identity_activity_metrics.svg" alt="Identity Activity Metrics shown in context" />

### Inbound Relationships

These objects and events reference Identity Activity Metrics in their attributes:

<ul>
    <li><a href="/docs/event-iam_analysis_finding">IAM Analysis Finding</a></li>
</ul>

### Outbound Relationships

Identity Activity Metrics references the following objects and events in its attributes:

<ul>
    <li><a href="/docs/obj-unmapped">Unmapped</a></li>
    <li><a href="/docs/obj-programmatic_credential">Programmatic Credential</a></li>
</ul>

<p><small><i>This page describes qdm-1.5.1+ocsf-1.6.0</i></small></p>