User

The user's account or the account associated with the user.

Entity:USER_CREDENTIAL_ID
The unique identifier of the user's credential. For example, AWS Access Key ID.

The devices related to user.

The domain where the user is defined. For example: the LDAP or Active Directory domain.

Entity:EMAIL_ADDRESS
The user's primary email address.

Entity:EMAIL_ADDRESS
The user's forwarding email address.

The full name of the person, as per the LDAP Common Name attribute (cn).

The administrative groups to which the user belongs.

The user has a multi-factor or secondary-factor device assigned.

The last time when the user logged in.

The additional LDAP attributes that describe a person.

Entity:USER_NAME
The username. For example, janedoe1.

Organization and org unit related to the user.

The telephone number of the user.

Group:context
The event data as received from the event source.

Group:primary
Unique identifier for the object

The risk level, normalized to the caption of the risk_level_id value.

The normalized risk level id.

• 0: Info (INFO)
• 1: Low (LOW)
• 2: Medium (MEDIUM)
• 3: High (HIGH)
• 4: Critical (CRITICAL)
• 99: Other (OTHER)

The risk score as reported by the event source.

The type of the user. For example, System, AWS IAM User, etc.

The account type identifier.

• 0: Unknown (UNKNOWN)
• 1: User (USER)
• 2: Admin (ADMIN)
• 3: System (SYSTEM)
• 99: Other (OTHER)

Entity:USER_OBJECT_UID
The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN.

The alternate user identifier. For example, the Active Directory user GUID or AWS user Principal ID.

Data from the source that was not mapped into the schema.