LDAP Person

The cost center associated with the user.

The timestamp when the user was created.

The timestamp when the user was deleted. In Active Directory (AD), when a user is deleted they are moved to a temporary container and then removed after 30 days. So, this field can be populated even after a user is deleted for the next 30 days.

Entity:EMAIL_ADDRESS
A list of additional email addresses for the user.

The employee identifier assigned to the user by the organization.

The given or first name of the user.

The timestamp when the user was or will be hired by the organization.

The user's job title.

The labels associated with the user. For example in AD this could be the userType, employeeType. For example: Member, Employee.

The last time when the user logged in.

The LDAP and X.500 commonName attribute, typically the full name of the person. For example, John Doe.

The X.500 Distinguished Name (DN) is a structured string that uniquely identifies an entry, such as a user, in an X.500 directory service For example, cn=John Doe,ou=People,dc=example,dc=com.

The timestamp when the user left or will be leaving the organization.

Entity:GEO_LOCATION
The geographical location associated with a user. This is typically the user's usual work location.

Entity:USER
The user's manager. This helps in understanding an org hierarchy. This should only ever be populated once in an event. I.e. there should not be a manager's manager in an event.

The timestamp when the user entry was last modified.

The primary office location associated with the user. This could be any string and isn't a specific address. For example, South East Virtual.

The telephone number of the user. Corresponds to the LDAP Telephone-Number CN.

Group:context
The event data as received from the event source.

Group:primary
Unique identifier for the object

The last or family name for the user.

The list of tags; {key:value} pairs associated to the user.

Data from the source that was not mapped into the schema.