🔬Activity Tab

Overview

The Activity tab's purpose is to show a detailed view of all activities, across all sources, associated with a given identity over time in one view. Without having to jump across different tools and platforms to piece together bits of a user's activity, the Activity tab can save you time and is incredibly valuable when investigating a user.

The Activity tab is the second tab of the User 360. This article will describe the different information and functionality available on the Activity tab in detail.

Activity table elements

The Activity table contains all the detailed event information for a particular user. Above the column headers on the left, you can see the total number of events for the selected timeframe, and on the right, the last data collection timestamp for each source, if you hover over "Last data collection".

The section below details the fields that appear in the table by default, as well as the definition of each field:

Element	Definition
Date (UTC)	The date and time the event/action happened
Source	The identity source associated with the event/action
Event	What the event/action taken by the user was
Initiator	Who initiated the event/action and a session ID for the event, if available
Target	What the target of the event/action taken by the user was
Result	The result of the event/action taken by the user
Geo IP	The IP address and respective location for the associated event/action
Tags	Tags associated with the event and/or the IP address Hover over each tag to see a tooltip with the source of the tag (ex: Okta: Password Spray, IP info: Hosting, etc). If no source, it is an Identity Intelligence tag (ex: New ISP)
OS	The operating system associated with an event/action Hover over the icon in this column to see a tooltip with the OS name
Browser	The browser associated with an event/action Hover over the icon in this column to see a tooltip with the browser name
Device Type	The device type associated with an event/action

Diving deeper into an event

To see more information on an event in the Activity table, click on any blank space in the row related to the specific event you'd like to dig into.

This will open a slide panel from the right side of the page, that has 2 tabs - Event Attributes and Raw data. The event attributes themselves and raw data will vary depending on the relevant information for the event/action you are looking at.

• Event attributes shows you more detailed information on the attributes related to the event

• Raw data shows you the raw data for a given event

To close the slide panel, click the X in the top right corner, or click anywhere outside of slide panel.

Events Attributes Tab

Raw Data Tab

Activity Tab general actions

This section describes the high level actions you can perform on the Activity tab. Click through the tabs below to learn more about how to utilize each feature.

Search

Search issues

Use the search bar above the Activity table to search based on various items such as a specific IP address, session ID, application name, source, location, etc. When searching, you do not need to provide an exact value. Typing a piece of the word will return results.

If you have searched on a particular parameter, the search criteria is retained as you navigate between different tabs within the platform.

To clear the search bar click the X on the right most side of the search bar, next to the Advanced button.

Adjust timeframe

Adjust timeframe

By default, the Activity tab is filtered to show all events over the last 30 days. If you would like to see a larger or smaller window, you can customize your view with the date selector, which can be found directly to the right of the search bar.

Click anywhere in the box to open a dropdown where you can select from preset timeframes (ex: Last 4 hours, Last day, Last 7 days, etc), a custom period, or 'View All', based on your needs.

Download results

Download results

You can download tabular data from the table to a CSV using the Download icon button on the right after the timeframe filter. All filters applied are included in the CSV output. If there are no results in the table, the CSV export will contain only headers and no user data. Note: The CSV output has a limit of 2,000 rows.

Timeline visualization

The Activity tab has a timeline widget which displays a given user's total number of events per day, color coded by result type (ie: success, failure, challenge, etc). Hovering over a segment of the bar will display a tooltip with the date, the result, and the count of events for that result. By default, the view is set for 30 days but this can be adjusted to see a wider or smaller window of time using the + and - buttons in the top right corner of the timeline widget.

To export this visualization, click on the 3 line button in the top right corner of the widget. Downloading as a SVG or PNG will export an image, whereas downloading as a CSV will export the raw data for you in CSV format.

If you would like to hide this widget to get more space for the Activity table, click the Graph icon button next to the timeframe filter. To get the widget back, click the Graph icon button again.

Filters

Like the Users table, the Activity table is filterable by multiple attributes, enabling you to slice and dice the activity based on the parameters that are important to you.

There are several ways to filter the results of the Activity table - basic filters, directly from attributes in the table or slide panel, and Advanced Query mode, which can be enabled via the search bar above the Activity table. Click here to learn about how to use Advanced Query Mode.

Basic filters

To access the basic filters, click on the filter button that is to the left of the search bar, above the Activity table. This will open a slide panel from the left side of the page with the available filters.

The filter categories available via the slide panel are Result and Event. You can enable a filter by clicking the check box for the attribute you would like to filter by. The applied filters will be added to the search bar. The number of events that you are currently viewing, based on any filters and searches used, will appear in the top left corner of the Activity table, above the column headers.

Filter attributes will vary user to user based on the results and events available for a particular user

Like on the Users tab, you can also select all attributes or exclude an attribute. To select all values within a given filter, hover over a filter value and click All. To exclude a value from filtered results (ie: NOT), you can click on the 🚫 icon in either the filter box in the search bar or the left hand filter menu. To remove a filter, you can either deselect a filter attribute from the filters list on left hand side of the Activity table, or click the X on the right hand side of the filter box that is in the search bar. To remove all filters, click the X located next to the Advanced Filter button in the search bar.

After you have selected your filters, the filters are retained as you navigate between different tabs within the platform.

Filtering via event attributes

Another way to filter in the Activity table is by clicking on an event attribute in the table or in the slide panel, which will add it to the search bar as a filter. The elements that can be filtered on via the table elements are:

• Source

• Event

• Session ID (in Initiator column if present)

• Target application (in Target column if relevant)

• Result

• OS and Browser (only works on icons, not free text)

Additionally, if you open the slide panel and click on any of the attributes in the Event Attribute tab, the attribute will be added as a filter.

Pivot on IP address

The IP address in the table or in the slide panel has a few actions associated with it that can be useful to learn more about an IP address and the associated activity.

The actions menu will pop up when left-clicking on a specific IP address in the Activity table. The actions are:

• Find user activity - Adds the selected IP address as a filter on the given user's Activity tab so you can see all the user's activity associated with this particular IP address

• Find users who attempted to sign in from X.X.X.X - Adds the selected IP address as a search parameter on the Users page so you can see any other users who have activity associated with this particular IP address

• See IP info - Add the selected IP address as a filter on the given user's Networks tab and opens the slide panel so you can see more detailed information about that IP address

• Copy to clipboard - Copies the IP address to your clipboard so that you can paste it within Identity Intelligence or another tool