Identities
The Identities page displays all active identities within your organization, along with actions taken or related settings that, intentionally or not, are exposing your environment to threats. It provides information such as the identity name, level of overall risk severity for that identity, the identity's title and department, number of risks they are exposed to, and their status in calculating the overall company risk.
Note
For more details about identity data processing, refer to Identity risk data collection.
The Smart views panel. This feature allows you to customize, save, and switch between different loadouts of the Identities page.
The panel has the following sections:
Search views - Use this search field to filter out the views displayed in the sections below, by name.
Saved - This section displays a list of all your saved views that have not been marked as favorites.
Favorites - All views marked as favorites are displayed under this section.
Defaults - This section displays the views that are available by default:
All identities
High risk score
Detected
Ignored
Watchlist
For any view in the Saved or Favorites category, you can click the vertical ellipses
to Rename or Delete the view.The Identity actions. This section contains the buttons to all the available actions you can take on the selected risks on the page:
State - Change the state of the selected risks. The following options are available:
Ignore identities
Restore ignored identities
Watchlist - Add or remove the selected risks from your watchlist.
Scan - Perform a scan to check for new risks or updates on known risks.
The Filters section. You can use these options to customize the risks that are displayed in the table.
The following filters are currently available:
Filtering option
Details
Company name
Use the searchable drop-down menu to filter the list of identities by company name.
Only the identities within the selected company are displayed.
Identity name
Use the searchable drop-down menu to filter the list of identities by name. Select the names of the identity risks you want and click Apply.
Only the selected identities are displayed.
Risk score
Select a score range between 1 and 100.
Only controls with a risk score between these values are displayed.
Identity risk name
Use the searchable drop-down menu to filter the list of identities by their associated identity risk. Select the names of the identity risks you want and click Apply.
Only identities associated with the selected identity risks are displayed.
Identity type
Use the searchable drop-down menu to filter the list of identities by type. Select the identity types you want and click Apply. Available identity types:
Local
Active Directory (AD)
IAM user
Azure Active Directory (AAD)
IAM service account
Root user
Only identities of the selected types are displayed.
Identity resources
Use the searchable drop-down menu to filter the list of identities by associated resource. Select the resources you want and click Apply.
Only identities that use the selected resources are displayed.
Department
Use the searchable drop-down menu to filter the list of identities by associated departments. Select the departments you want to display and click Apply.
Only identities belonging to the selected departments are displayed.
Status
Use the searchable drop-down menu to filter the list of identities by status. Select the statuses you want and click Apply. Available statuses:
Compliant
Detected
Only identities with the statuses you selected are displayed.
State
Use the searchable drop-down menu to filter the list of identities by state. Select the states you want and click Apply. Available states:
Active
Ignored
Only identities with the states you selected are displayed.
In watchlist
Use this filter to display identities based on them currently being included in a watchlist or not.
Region
Use the searchable drop-down menu to filter the list of identities by the region of associated devices.
Only identities associated with devices in the selected regions are displayed.
Resource ID
Use the searchable drop-down menu to filter the list of identities by the IDs of associated devices.
Only identities associated with devices with the selected IDs are displayed.
Platforms
Use the searchable drop-down menu to filter the list of identities by the operating systems of associated devices.
Only identities associated with devices with the selected operating systems are displayed.
The View options menu. This section provides you with multiple functions for working with views:
Save - Save changes you make to a saved view.
Save as - Save a modified view under a different name.
Discard changes - Revert the saved view to its original state.
Add to favorites - Add the view to the Favorites category.
Export view - Download the information in a
.csvfile, which can contain up to 1500 rows.Show or hide filters - Hide or display the filters menu.
Open settings - Display the Settings panel.
You can use this panel to customize what columns are displayed in the view and enable or disable the Compact view.
The Identities grid. The grid displays all known identities in your company, based on your last scan.
The information available for each identities displayed under the following columns:
Identity name - The name of the identity.
Risk score - The risk score of the identity.
Identity risks - The number of identity risks that have been detected for this identity.
Identity type - The type of the identity.
Identity resources - The number of resources that this identity is assigned to, grouped per endpoint type.
Department - The department the identity is assigned to.
Platforms - The operating systems of the devices where the identity has been detected.
Status - The status of the identity.
State - The state of the identity.
In watchlist - Indicates if the identity is currently in the watchlist.
Resource ID - The ID of the devices where the identity has been detected.
Region - The region of the devices where the identity has been detected.
Note
More details regarding the information in each column are available type in the Filters section.
Actions button - The
Actions button at the right of each identity row, enables you to take the necessary actions: Ignore risk
Restore ignored identity
Add to watchlist
Remove from watchlist
View additional information
To view additional information about a specific identity in a side panel, locate it in the grid and click anywhere on its row, except its checkbox.
The panel displays specific information that varies based on the type of risk and the related data available.
General
This section contains general information regarding the risk:
Risk score - The risk score of the identity.
Identity type - The type of the identity.
Department - The department the identity is assigned to.
Identity resources - The number of resources that this identity typically uses or has logged in to in the past 30 days.
Email - The email address of the identity.
Platforms - The operating systems where this identity was detected.
Last scanned on - The timestamp for the last time the identity was last scanned.
Status - The status of the identity.
State - The state of the identity.
In watchlist - Indicates if the identities currently in the watchlist.
Additionally, the following actions are available:
View risks - This link takes you to the User behavior risks page, where it displays the risks that are associated with this identity.
Add to watchlist - Add this resource to your watchlist.
View events and alerts - This link takes you to the Search page, where it displays all EDR and XDR events and alerts associated with this identity.
View incidents - This link takes you to the Incidents page, where it displays all EDR and XDR incident associated with this identity.
Risk mitigation
This section provides the actions available for this resource.
The following options are available:
Ignore identity - Ignore all the risks associated to the selected identity.
Identity risks
This section provides you with a list of risk associated to that specific identity.