| Element | Description |
|---|---|
| User | The user's display name and their corresponding email or username |
| Trust Level | The user's current Trust Level |
| Checks | The total number of checks a user is failing. A 🚫 icon in this column indicates that the corresponding user is not part of the protected population and checks are not being evaluated against this user |
| # IPs | The total number of IP addresses associated with a user's activity across all providers |
| # Logins | The total number of attempted logins across all providers, regardless of result (success, failure, challenge, other) |
| Last Seen (UTC) | The date and time of the last login attempt, regardless of outcome, for a user across all providers |
| Last IP Address | The IP address associated with the last successful or failed login attempt for a user across all providers Read more below about how to pivot on the last IP address |
| Last Location | The location associated with the last successful or failed login attempt for a user across all providers |
| MFA | |
| Providers | The logo icon(s) for the corresponding identity data sources where a user's account has been associated |
| Status | The user's Identity Intelligence Status and Lifecycle Event tag, if applicable. Lifecycle events highlight recent, notable events that have occurred on a user's account that can be beneficial to know about during an investigation. Lifecycle event badges are displayed for 7 days after the event is noted Status - Active (green badge): This account is enabled in an identity data source and has successfully logged in over the last X days. The number of days is consistent with the value set on the Inactive Users and Inactive Guest Users checks (default setting is 30 days) - Inactive (Grey badge): This account is enabled in an identity data source, but has not successfully logged in over the last X days. The number of days is consistent with the value set on the Inactive Users and Inactive Guest Users checks. (default setting is 30 days) - Deprovisioned (Grey badge): This account is no longer enabled in an identity data source and cannot be signed into - Inconsistent (red badge): This account has been flagged because there are account status discrepancies that may pose a significant security threat. See Inconsistent Users to learn about what factors contribute to a user being marked as inconsistent Lifecycle Events (yellow badge) - New Account: indicates that this account was recently created. Includes the date the account was created Significant Change: indicates that an uncommon, but important, activity has recently happened on this account (for ex: MFA factor added, admin privileges granted, sensitive app assigned, etc). You can query for specific Significant change events using Advanced Query mode |
| Compiled Status | Compiled status combines provider user types (ie: internal, external, service accounts, etc) and the user's Identity Intelligence Status |
| Element | Description |
|---|---|
| Created Date (UTC) | The date a user's account was created. Uses the first creation date available across all configured providers |
| Employee ID | The employee ID, gathered from the provider if available |
| Manager Login | The user's manager's email address, gathered from the provider if available |
| Title | The user's job title, gathered from the provider(s) if available |
| Department | The department a user belongs to, gathered from the provider(s) if available |
| Registered Location | The location a user is supposed to be working from based on hiring agreements, if available from the HRIS or the IdP. If the user has multiple registered locations that differ, the HRIS data always takes precedence. If HR information is not available for a user, then the data comes from the IdP |
| Inconsistency Severity | The severity of the inconsistency noted for a user with Inconsistent status |
| User Type | The Identity Intelligence user type assigned based on compiled identity data source user types |
| Element | Definition |
|---|---|
| User Type | Combines IdP Status, Identity Intelligence Status, and HRIS status if available, to provide more context on this user's current state
|
| Title | The user's current job title
|
| Department | The department the user belongs to
|
| Organization | The organization the user belongs to
|
| Registered Location | The user's registered working location
|
| MFA Status | Whether this user has any forms of MFA configured on an account
|
| Last Successful Login | The last successful login date, time (UTC), and days elapsed, recorded for this user |
| User Manager | The user's manager's name
This field can be updated directly in Identity Intelligence using the pencil icon; however, updating this field will not modify any data within the IdP. It will only change how the information is presented within Identity Intelligence. This action can always be undo later on |
| Lifecycle Events | Highlights recent, notable events that have occurred on this user's account that can be beneficial to know about during an investigation. Lifecycle events are displayed here for 7 days after the event is noted, though this value can be customized via Tenant Settings if needed
|
| Element | Definition |
|---|---|
| Factor |
If the factor is new or weak, a tag indicator will be displayed next to the Factor Type |
| Assurance Level | Assigned by Identity Intelligence to make it easier to identify the posture of a specific factor. Read more about factor assurance levels in our MFA FAQ doc Possible values: High, Medium, Low, Unknown |
| Status | The enrollment status of a given factor. Note: not all statuses are available with all data sources Active - Factor is enabled and can be utilized Disabled - Factor was reset or disabled and cannot be utilized |
| # Changes | The number of changes that have been made to the factor |
| Usage Count | The number of times the factor has been utilized by the user |
| Device | The name of the device associated with the factor |
| Phone Number | The phone number associated with the factor, if relevant |
| Last Used (UTC) | The date and time the factor was last used successfully |
| Element | Definition |
|---|---|
| Last Updated (UTC) | The date and time of the factor was last changed To see more details about changes to a factor, press the down arrow on the left of Factor to expand the details and see last updated date, created date, and any factor change information. |
| Created (UTC) | The date and time that the factor was set up |
| Element | Definition |
|---|---|
| Name | User's name + name given to a ticket when it was opened ex. John Smith: Ticket Test |
| State | Ticket's state as set in the Ticketing System |
| Priority | Ticket's priority as set in the Ticketing System |
| Urgency | Ticket's urgency as set in the Ticketing System |
| Ticket Opened (UTC) | The date and time the ticket was created |
| Last Updated (UTC) | The date and time the ticket was most recently updated |
| Element | Definition |
|---|---|
| User | User's display name and user's email address The first user in the table is always the user who's User 360 you are currently on |
| Status | The user's Identity Intelligence Status and lifecycle events, if present |
| Identity Intelligence Type | The Identity Intelligence user type assigned based on compiled identity data source user types |
| Last Seen (UTC) | Last login attempt for a user, regardless of result |
| Last Location | Last login attempt location for a user, regardless of result |
| MFA Configured | |
| Providers | Logo icon for each source associated where the user's email was associated Hovering over a logo displays the name given to each source during the Integration setup (link to integrations) |
| Element | Definition |
|---|---|
| Date (UTC) | The date and time the event/action happened |
| Source | The identity source associated with the event/action |
| Event | What the event/action taken by the user was |
| Initiator | Who initiated the event/action and a session ID for the event, if available |
| Target | What the target of the event/action taken by the user was |
| Result | The result of the event/action taken by the user |
| Geo IP | The IP address and respective location for the associated event/action |
| Tags | Tags associated with the event and/or the IP address Hover over each tag to see a tooltip with the source of the tag (ex: Okta: Password Spray, IP info: Hosting, etc). If no source, it is an Identity Intelligence tag (ex: New ISP) |
| OS | The operating system associated with an event/action Hover over the icon in this column to see a tooltip with the OS name |
| Browser | The browser associated with an event/action Hover over the icon in this column to see a tooltip with the browser name |
| Device Type | The device type associated with an event/action |
Events Attributes Tab
Raw Data Tab
| Element | Definition |
|---|---|
| IP Address | The IP address Left-click on an IP address to perform additional actions related to this IP address |
| Last Access (UTC) | The date and time the IP address was last seen |
| Hit Count | The number of events associated with this user and the IP address, regardless of result |
| Successful Events | The number of successful events associated with this user and the IP address |
| Failed Events | The number of failed events associated with this user and the IP address |
| Other Events | The number of other events (neither success nor failure) associated with this user and the IP address Hover over the number to see the sum of events for each result type |
| Tags | Tags associated with the IP Address Hover over each tag to see a tooltip with the source of the tag (ex: IP info: Hosting, etc). If no source, it is an Identity Intelligence tag (ex: New ISP) |
| Location | The location associated with the IP Address |
| Carrier | The carrier associated with the IP Address |
| Source | The identity sources associated with any activity from the IP Address
|
| Same IP Users | The number of users in your environment associated with the IP Address |
| Element | Definition |
|---|---|
| Device | The device name. If available, model and serial number are also displayed in this column under the device name |
| Source | The identity source associated with a particular device |
| OS | The operating system and version of a particular device An exclamation mark is displayed next to the operating system to indicate it is either out of date or end of life. A red background indicates the device's OS is end of life; a yellow background indicates it is out of date. Hover over the icon to see the device's current OS version and status |
| Managed | |
| Registered | |
| Usage Count | The total number of times a given user has used a particular device |
| Enrolled (UTC) | The date and time that a particular device was enrolled as an authentication device |
| Last Seen (UTC) | The date and time of the last login attempt made with a particular device, regardless of outcome |
| Last Sync (UTC) | The date and time a particular device was last synced to the identity source |
| Element | Definition |
|---|---|
| Name | The application name and application user ID associated with the application for the user If an application is on your Sensitive Applications list, there will be a 'Sensitive Applications' tag next to the application name |
| Source | The identity source associated with the application assignment |
| Status | Only available for Okta The Okta application status |
| Assignments | The group membership that allows a user to have access to a particular application. Users can gain access to an application without a group (blank or 'directly assigned application') or via more than one group, where you'd see multiple group names in this column |
| Owners | Only available for Entra The individual listed as the application's owner in Entra |
| Usage Count | The number of times a user has used a particular application
|
| Last Access (UTC) | The last date and time the user accessed an application |
| Result | The result associated with the user's last access attempt for an application |
| Element | Definition |
|---|---|
| Name | The name of a particular group the given user is part of. If available from the source, it will also display a description of the group and the date the user was added to this group Clicking on a group name will take you to the Users page, pre-filtered on the group name to show you other users that are part of a particular group |
| Type | A given user's role type or group type for a specific group within the identity source Note: Certain role (ex: PIM Admin) or group (ex: Microsoft365) types are only available for certain identity source |
| Source | The identity source associated with the group |
| Added By | The email address of the user who added a given user to the group |
| Applications | The number of applications members of the group have access to |
| Users | The total number of users assigned to the group |
| Visibility | Only compatible with Entra groups. Used to manage and control access to applications. Possible values as defined by Entra: - Public - Private - Hidden |
| Element | Definition |
|---|---|
| Name | The name of the failed check |
| Result | Failed check status. Always listed as Failure |
| Times Excluded | The total number of times a given user has been excluded from a particular check |
| First Reported (UTC) | The date and time of the first failed observation for a particular check for a given user |
| Last Reported (UTC) | The most recent date and time of a failed observation for a particular check for a given user |
| User/Manager Notified | The number of times a given user or their manager has been notified about a particular check failure, and an icon representing the method used to notify (Email, Slack, Teams, etc) If a notification target is not set for a particular check, a message prompting you to configure the notification is shown in this column Note: Only some checks support notifying end users or managers. For checks that do not support notifying end users or managers, this column will say 'Not Supported'. If notifications are supported, but have not been sent to end users or managers, the column will say 'Not Notified' |
| Admin Notified | The number of times an admin has been notified about a given user failing a particular check, and an icon representing the method used to notify If a notification target is not set for a particular check, a message prompting you to configure the notification is shown in this column |
| Element | Definition |
|---|---|
| Observed At | The date and time a given observation was recorded |
| Source | The identity source associated with a given failing observation |
| Feedback provided | The user who provided feedback on a given observation, if applicable. If there has been no feedback, the value is N/A. |
| Feedback date | The day and time a user provided feedback on a given observation, if applicable. If there has been no feedback, the value is N/A. |
| Element | Definition |
|---|---|
| Name | The name of the resolved check |
| Result | Resolved check statusExpiredMitigatedExcluded - includes email of Identity Intelligence User who excluded and comment, if present |
| Total Handling Time | The number of days elapsed between the first date a check/observation failed and the date it was resolved |
| Resolved Date (UTC) | The date and time that a check/observation was no longer failing for a given user |
| Identity Intelligence Status | Compiled Status | Definition |
|---|---|---|
| Active | Active | User is authorized in the IdP and has had activity in an IdP in the last 30 days |
| Inactive | Inactive | User is authorized in the IdP, but has not had activity in an IdP in the last 30 days |
| Deprovisioned | Deprovisioned | User is unauthorized in the IdP and has not had activity in an IdP in the last 30 days |
| Inconsistent | Unauthorized | See below |
| Identity Intelligence Status | Compiled status | Definition |
|---|---|---|
| Active | Active Employee | User's HRIS employment account exists and is authorized. User is authorized in the IdP and has had activity in an IdP in the last 30 days |
| Active | Non-employee | User's HRIS Employment account does not exist and is unauthorized. User is authorized in the IdP and has had activity in an IdP in the last 30 days |
| Inactive | Inactive Employee | User's HRIS Employment account exists and is authorized. User is authorized in the IdP, but has not had activity in an IdP in the last 30 days |
| Inactive | Non-employee | User's HRIS Employment account does not exist and is unauthorized. User is authorized in an IdP, but has not had activity in an IdP in the last 30 days |
| Deprovisioned | Deprovisioned | User's HRIS Employment account exists, and the HRIS account and an IdP account are both unauthorized with no noted activity on an IdP or User's HRIS Employment account does not exist, and the HRIS account and the IdP account are both unauthorized with no noted activity on an IdP |
| Inconsistent | Non-employee | User's HRIS employment account does not exist, the user is unauthorized in both the HRIS and in an IdP, but there was activity noted on a data source after the user's IdP status changed |
| Inconsistent | Unauthorized Employee | See below |
| Element | Description |
|---|---|
| Name | The name given to the app and the assigned app ID from the identity source |
| Status | The current state of an app such as active, deleted, deprovisioned, etc |
| Sensitive | Applications that have been flagged as sensitive for your organization will have an enabled (blue) toggle. Applications that are not marked as sensitive will have a disabled (grey) toggle. Learn more about how to configure sensitive apps and why it is important |
| Source | The identity source where a given application is connected |
| Tags | Identity Intelligence will apply tags to an application if it matches certain criteria, such as Key Expires Soon , Password Expires Soon or No Assignment Required, to highlight applications that may require action or clean up. If you hover over a tag regarding a password or key expiration, a tool tip with more information will appearAn application can have more than one tag applied to it. All the tags present in your environment are displayed in the relevant Tags filter |
| #Logins | The number of successful sign in events for a given application across all users in your environment |
| Assignees | The number of users who are assigned, or entitled to access a given application. Select the value in this column to go to the Users page, pre-filtered for the given app and its assigned users so that you can filter or investigate further, export the impacted users, etc. If this column displays N/A for a given application it can indicate that there is no assignment required to access the application or that the data is not available from the source |
| Used | The number of users who have successfully signed in to a given application during the configured application utilization timeframe. Select the value in this column to go to the Users page, pre-filtered for the given app and the users who accessed the app, so that you can filter or investigate further, export the impacted users, etc. By default, the utilization timeframe is set to 30 days but this can be modified if needed. Learn more about how to configure the utilization timeframe |
| Unused | The number of users who have no successful sign in events to a given application during the configured application utilization timeframe. Select the value in this column to go to the Users page, pre-filtered for the given app and the users who have not accessed the app, so that you can filter or investigate further, export the impacted users, etc. By default, the utilization timeframe is set to 30 days but this can be modified if needed. Learn more about how to configure the utilization timeframe |
| Utilization | The percentage of users who have successfully signed in during the configured application utilization timeframe out of the total number of assigned users for a given application. If this column displays By default, the utilization timeframe is set to 30 days but this can be modified if needed. Learn more about how to configure the utilization timeframe |
An example of a tenant that has disabled the default sensitive app list
Top app is marked as sensitive
Bottom app is not sensitive
| Column | Meaning |
|---|---|
| Name | Name and serial number (if available) of the device |
| Type |
|
| Sources | Identity sources associated with a given device. If the same device can be associated across more than one source using a common, strong device identifier, such as a serial number, the devices are aggregated into one device record. |
| Managed | Managed devices are those are have been enrolled in an organization's centralized management system such as an MDM, Unified Endpoint Management (UEM) or IT Service Management tool. These devices are typically company owned and provided to its users with pre-installed MDM software. Devices are "managed" to meet compliance requirements or enforce security policies. Typically, the user logs in to a managed device before being allowed to access network resources. |
| Registered | Sometimes referred to as joined, a device can be registered with your organization by logging in to the device and joining the work network. (The user can optionally download and install MDM software like Microsoft Intune.) A registered device might be either provided by the organization or it might be a personal device. |
| OS | Name of the operating system. An A red background indicates the OS is end of life; a yellow background indicates out of date. Hover the mouse pointer over the icon to see the device's current OS version and status. |
| Tags | Identity Intelligence-assigned tags, including:
|
| Assigned Users | Number of users allocated to that device via the IdP or MDM. Devices that are not assigned to a user will still appear in the table Hover over the number to view the user names (if the number is non-zero) or select the number to drill into the Users page, pre-filtered on the associated user(s) |
| Used By | Number of users with recent events using that device. Devices do not need to have recent usage to appear in the table If the number is non-zero, hover over it to view the user names or select the number to view the Users page, pre-filtered on the associated users. |
| Last Seen (UTC) | Universal time code-formatted date and time the device was last seen by the identity source. |
| Element | Description |
| Name | The name or ID given to a non-human identity |
| Type | The functional category of the identity such as service account, breakglass, Agentic |
| Source | The identity source where a given NHI is connected. |
| Status | The current state of an app such as active, inactive, deprovisioned, etc |
| Providers | The logo icon(s) for the corresponding identity data sources where a user's account has been associated. |
| Tags | Identity Intelligence will apply tags to non-human identities if it matches certain criteria, such as Key Expires Soon, Password Expires Soon or No Assignment Required, to highlight applications that may require action or clean up. NHI can have more than one tag applied to it. All the tags present in your environment are displayed in the relevant Tags filter |
| Created | The date and time when the non-human identity was initially created |
| Last Seen | The date and time of the last login attempt, regardless of outcome, for a non-human identity across all providers |
| Title | Cover | |
|---|---|---|
| Jira | /files/s4mNEFvQWrGAHcKYEeb1 | /pages/TXxUvoyimnMP8CIY4Bee |
| ServiceNOW | /files/t84U3itPAnv57EWcFLoL | /pages/9cnKm2JxNFcyhvJmVfq8 |
| Scope | Description | Purpose |
|---|---|---|
read:users | Read Users | Get a list of Users |
read:logs | Read Logs | Read Auth0 Event logs |
read:logs_users | Read logs relating to users | Read Auth0 User logs |
read:guardian_factors | Read Guardian factors configuration | Get a list of Users and Authenticator configurations |
| Input Field | Description |
|---|---|
| Region/location | Which Azure region Deployment Script should be deployed |
| Event Hub Namespace Name | Name of Event Hub Namespace to be created |
| Event Hub Name | Name for Event Hub |
| Consumer Group Name | Name for Consumer Group inside the Event Hub (Using $Default is acceptable) |
SIEM Integration - Azure Sentinel
| Write Permission | Associated Remediation Type |
|---|---|
User.ReadWrite.All, User.ManageIdentities.All, Directory.ReadWrite.All | Update User Type, Delete Guest User |
User.ReadWrite.All, Directory.ReadWrite.All | User Log out |
UserAuthenticationMethod.ReadWrite.All | Reset MFA |
User.ReadWrite.All | Delete Guest User |
| Input Field | Description |
|---|---|
| Region | Which Azure region Deployment Script should be deployed |
| App Registration Name | Name of App Registration for Data Integration |
| Assign write permissions | Yes or No (Recommended: Yes) Identity Intelligence does NOT take automated write actions. Selecting Yes grants Identity Intelligence a limited set of write permissions to Entra. If write permissions are granted, Admins or Helpdesk users in Identity Intelligence can manually trigger certain remediation actions on Entra users, directly within the Identity Intelligence interface, instead of navigating back to Entra to complete the same task (e.g: log user out of active Entra sessions, reset user's MFA). For more information on the actions available, see #add-api-permissions and /pages/qKAN2j0zanyuw7ewCvxi#remediation-actions |
| Tenant has Intune License | Yes or No Select Yes if this Entra ID tenant has Intune Licenses. This grants Identity Intelligence read permissions to Device Management data.Select No if this Entra ID tenant does not have Intune Licenses |
| Managed Identity Name | User-Assigned Managed Identity name from previous section |
| Managed Identity Resource Group | Resource Group name where Managed Identity is created |
= Device is managed by an organization, as reported by identity source or MDM
= Device is not managed by an organization, as reported by from identity source or MDM
= Device is registered
= Device is not registeredhttps://www.googleapis.com/auth/admin.directory.group.member.readonly,https://www.googleapis.com/auth/admin.directory.group.readonly,https://www.googleapis.com/auth/admin.directory.user.readonly,https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly,https://www.googleapis.com/auth/admin.directory.orgunit.readonly,https://www.googleapis.com/auth/admin.directory.device.mobile.readonly,https://www.googleapis.com/auth/admin.reports.audit.readonly,https://www.googleapis.com/auth/admin.directory.device.chromeos.readonly,https://www.googleapis.com/auth/admin.directory.user.security,https://www.googleapis.com/auth/logging.read
| Command | Use |
./start.sh | Pull the released image once, run first-time setup when needed, and start the agent |
./start.sh --reconfigure | Re-enter ISE credentials and the optional outbound proxy; restart with the new encrypted values |
./start.sh --enable-pxgrid | Configure or replace pxGrid state, then restart |
./start.sh --update | Pull ghcr.io/duosecurity/ise-agent:latest and restart the deployment |
./start.sh --no-pull | Start using an already-loaded local image. Use only for offline or explicitly preloaded-image environments |
./start.sh --update --no-pull | Skip the pull and restart the already-loaded local image |
./start.sh --stop | Stop and remove the Compose-managed agent container without deleting the installation files or encrypted credentials |
| Symptom | Next action |
| No container runtime found | Install Docker with Compose or Podman with a Compose provider, then rerun ./start.sh |
| Required file not found | Re-extract the complete package or reset agent credentials in the UI and deploy the replacement package. Do not reconstruct the missing file |
| Container repeatedly restarts | Read the first fatal error in logs. Common causes are missing env values, missing encrypted ISE credentials, authentication failure, or unreachable endpoints |
| Image pull fails | Verify access to ghcr.io and proxy/firewall policy. Use --no-pull only when the exact image is already present locally |
| Deployment material cannot be used | Generate replacement deployment material in Cisco Identity Intelligence and redeploy the package |
| Log / symptom | Meaning and next action |
| HTTP 401 / authentication failed | Rerun ./start.sh --reconfigure and enter the current ISE service-account credentials |
| HTTP 403 / access denied | Ask the ISE administrator to confirm the account has the required ERS API access |
| Connection error or timeout | Verify the configured ISE hostname and port, then confirm DNS, routing, and firewall access from the agent host |
| JSON or unexpected-response error | Capture the timestamp and surrounding redacted log lines, then contact support. Do not run diagnostic commands inside the container |
| Image pull failed | Verify registry and proxy access. Use --no-pull only when the released image is already present locally |
| Log / symptom | Meaning and response |
| Waiting for admin approval | Approve the displayed client under Administration > pxGrid Services > Client Management > Clients |
| Account disabled by ISE admin | Re-enable or recreate the pxGrid client, then rerun --enable-pxgrid if credentials changed |
| Activation timed out | Verify approval, node name, password, ISE reachability, and pxGrid service availability |
| Session service not found / pubsub service not found | Verify pxGrid services are enabled and advertised by the deployment |
| WebSocket connection failed | Verify TCP 8910 connectivity, routing, and pxGrid node availability |
| pxGrid activation failed | Correct the approval, credentials, TCP 8910 connectivity, or pxGrid service configuration, then restart the agent |
| Option 1: Do not collect ChatGPT or Codex conversation logs | Option 2: Collect conversation metadata only without conversation message content | Option 3: Collect conversation metadata & conversation content | |
|---|---|---|---|
| Baseline visibility | ✅ | ✅ | ✅ |
| Account directory-based data and insights Eg: Account activity, dormant accounts, admin privileges, etc. | ✅ | ✅ | ✅ |
| GPT definition-based data and insights Eg: Known risky tools, broadly defined tools, tools available to users who shouldn’t have access, etc. | ✅ | ✅ | ✅ |
| Basic tool usage insights Eg: Which tools were executed, what tool replied, etc. | ✅ | ✅ | |
| Deeper insights based on detailed conversation logs Eg: Tool misuse, AI drift, data exfiltration, etc. | ✅ |
| Field | Description | Type | Is Required |
|---|---|---|---|
| login | end user login | string | true |
| displayName | User's Display Name | string | true |
| status | Status, such as Active or Inactive | string | true |
| userTypeClassification | Valid values: INTERNAL, EXTERNAL, MISSING, UNCLASSIFIED, INCONSISTENT, SERVICE_ACCOUNT | string | true |
| ipAddresses | Up to 5 IP addresses recently used by the user | list of IP addresses along with geo location | false |
| lastSignInLocation | Last geolocation the user signed in from | city, country, state if available | false |
| managerLogin | Manager LoginID | string | false |
| phoneNumber | Phone Number | string | false |
| unusedApplications | Up to 2 applications the user is assigned to but not using | CSV | false |
| usedApplications | Up to 5 applications used by the user | CSV | false |
| usedFactors | Up to 5 factors used by the user | CSV string | false |
CREATE ROLE <cii_integration_role>;
-- 1) Existing agents: grant MONITOR per agent. Repeat for each existing agent.
GRANT MONITOR ON AGENT <db>.<schema>.<agent_name> TO ROLE <cii_integration_role>;
-- 2) Future agents in each relevant schema. Repeat for each database/schema.
GRANT MONITOR ON FUTURE AGENTS IN SCHEMA <database_name>.<schema_name> TO ROLE <cii_integration_role>;
-- 3) Cortex database role
GRANT DATABASE ROLE SNOWFLAKE.CORTEX_USER TO ROLE <cii_integration_role>;
-- 4) AI Observability application role
GRANT APPLICATION ROLE SNOWFLAKE.AI_OBSERVABILITY_EVENTS_LOOKUP TO ROLE <cii_integration_role>;
-- 5) Parent database access. Repeat for each database.
GRANT USAGE ON DATABASE <database_name> TO ROLE <cii_integration_role>;
-- 6a) Option A: grant all schemas in database. Repeat for each database.
GRANT USAGE ON ALL SCHEMAS IN DATABASE <database_name> TO ROLE <cii_integration_role>;
-- 6b) Option B: grant only selected schemas. Repeat for each database/schema you would like Identity Intelligence to have access to.
GRANT USAGE ON SCHEMA <database_name>.<schema_name> TO ROLE <cii_integration_role>;
-- 7) Optional: only required if Identity Intelligence should collect Cortex Agent conversation content.
GRANT READ UNREDACTED AI OBSERVABILITY EVENTS TABLE ON ACCOUNT TO ROLE <cii_integration_role>;
| Name | Description | Value Examples | Type/Format | Is Required | How used in Oort |
|---|---|---|---|---|---|
| user_id | Employee/User ID | 14651848 | Numeric | Yes | |
| first_name | First Name | Robert | String | No | |
| middle_name | Middle Name | Douglas | String | No | |
| last_name | Last Name | McGurrin | String | No | |
| nickname | Nickname | Bob | String | No | |
| Email Address | dmcgurrin@personal.com | String | No | ||
| active | Is User Active? | true or false | Boolean | No | |
| org_name | Organization Name | P&S Broadcast | String | No | |
| business_title | Business Title | Partner Account Director | String | No | |
| super_ref | Employee/User ID of the Supervisor/Manager | 91601870 | String | No | |
| managername | Name of the Supervisor/Manager | Marc Heady | String | No | |
| position_title | Position Title | SW Development Eng | String | No | Maps to Title |
| division | Company Division | Belgium Division | String | No | |
| city | City | Sacramento | String | No | |
| state | State | CA | String | No | |
| country | Country | United States | String | No | |
| hire_date | Initial Hire Date | 2022-10-26 or 2022-10-26T17:30:00.000 | ISO 8601 Date Format | Yes | Maps to Start Date (verify) |
| termination_date | Termination Date | 2022-10-26 or 2022-10-26T17:30:00.000 | ISO 8601 Date Format | Yes, if user is not active | |
| category | Category of User | Contingent Worker | String | Yes | Used as User Type and to determine User Type Classification (internal/external) |
Upload a file
Manual file upload screen
Manual HRIS upload successful
New Workday Integration - General Settings
Workday Custom Report
Workday - Report Fields for Worker
| Name | Description | Value Examples [Usage Notes] | Type/Format | Is Required | How used in Oort |
|---|---|---|---|---|---|
| user_id | Employee/User ID | 14651848 | Numeric | Yes | |
| first_name | First Name | Robert | String | No | |
| middle_name | Middle Name | Douglas | String | No | |
| last_name | Last Name | McGurrin | String | No | |
| nickname | Nickname | Bob | String | No | |
| Email Address | dmcgurrin@personal.com | String | No | ||
| active | Is User Active? | true or false | Boolean | No | |
| org_name | Organization Name | P&S Broadcast | String | No | |
| business_title | Business Title | Partner Account Director [Combined with position_title] | String | No | |
| super_ref | Employee/User ID of the Supervisor/Manager | 91601870 | String | No | |
| managername | Name of the Supervisor/Manager | Marc Heady | String | No | |
| position_title | Position Title | SW Development Eng [Combined with business_title] | String | No | Maps to Title |
| division | Company Division | Belgium Division | String | No | |
| city | City | Sacramento | String | No | |
| state | State | CA | String | No | |
| country | Country | United States | String | No | |
| hire_date | Initial Hire Date | 2022-10-26 or 2022-10-26T17:30:00.000 | ISO 8601 Date Format | Yes | Maps to Start Date (verify) |
| termination_date | Termination Date | 2022-10-26 or 2022-10-26T17:30:00.000 | ISO 8601 Date Format | Yes, if user is not active | |
| category | Category of User | Contingent Worker | String | Yes | Used as User Type and to determine User Type Classification (internal/external) |
Enable As Web Service
Verify the Report Owned by field
Copy the JSON URL
New Workday Integration - General Settings
Collect Now
| Element | Definition |
|---|---|
| Check Compliance | The percent compliance of a given check, where 100% represents full compliance (0 users failing). Calculated by # of users failing a given check compared to # of users in Protected Population Note: If check compliance is 0% and Users column in the Checks table is N/A, this indicates the check is evaluated against data sources, not end users, and has at least 1 item failing |
| Check | The name of a given check The scope of who is being evaluated against the check (end user or Identity Provider) |
| # Failing | The total number of users currently failing a given check The percentage change (increase or decrease) in number of users failing a given check over the last 7 days and 30 days |
| # Excluded | The total number of users excluded from a given check |
| Report Channels | If a Notification Target has not been configured for a given check, an Add button is displayed in this column. Select the Add button to open a modal to choose from existing notification targets, or, if no notification targets are configured in your environment, it will say "No notification targets found". Click the Add Notification Target button to go to Integrations and configure one If one Notification Target has been configured for a given check, you will see the name of the configured notification target and an icon for the target type (Slack icon, email icon, etc) If multiple Notification Targets have been configured on the same given check, this column will say 'Multiple Channels' To modify or add Notification Targets to a given check that already has one or more targets configured, click on the Pencil icon next to the target name to make changes |
| Enabled | If a check is enabled, this check will be evaluated again the users in your protected population. A blue toggle to the right indicates a check is enabled |
| Element | Description |
|---|---|
| User | The user key of the failing user Clicking on a user's name will take to you their User 360 Checks tab |
| First Reported (UTC) | The date and time the user was reported for failing a given check for the first time To sort by this column value, click the First Reported column header to switch between ascending and descending order |
| Last Reported (UTC) | The date and time the user was most recently reported for failing a given check or having a new observation recorded for that check By default, the list of failing users is sorted in descending order (newest to oldest) on Last Reported. To sort by this column value, click the First Reported column header to switch between ascending and descending order |
| Admin Notified | The number of times a notification was sent to admins about a given user failing a given check, the notification method used as an icon (slack logo, email icon, etc) and the last date and time a notification was sent for a given user If notifications are not configured for a given check, this column will say 'Not Notified' |
| User/Manager Notified | Not supported for all checks. If a check is not compatible with end user/manager notifications, this column will not be visible The number of times a notification was sent to an end user and/or end user manager about the user failing a given check, the notification method used as an icon (slack logo, email icon, etc) and the last date and time a notification was sent for the given user |