Caption | Name | Requirement | Type | Description |
|---|---|---|---|---|
Active | active | optional | boolean_t | User.modified_time: The timestamp when the user entry was last modified. Useful for tracking changes to user attributes or status. Synonyms: last modified, update time. |
Created Time | created_time | optional | timestamp_t | User.created_time: The timestamp when the user was created in the system. Useful for tracking user lifecycle and onboarding events. Synonyms: creation date, onboarding time. |
LDAP Person Email Addresses | email_addrs | optional | string_t Array | User.ldap_person: The additional LDAP attributes that describe a person. LdapPerson.email_addrs: A list of additional email addresses for the user. |
LDAP Person Employee ID | employee_uid | optional | string_t | User.ldap_person: The additional LDAP attributes that describe a person. LdapPerson.employee_uid: The unique identifier for an employee, often used for linking and integration with HR systems. This is often different and distinct from the users email address and user principal name (UPN). For exampl |
End Time | end_time | optional | timestamp_t | User.end_time: The end time of when a particular state of the user was valid. Using the |
Full Name | full_name | optional | string_t | User.full_name: The full name of the user, as reported by the product. |
LDAP Person Given Name | given_name | optional | string_t | User.ldap_person: The additional LDAP attributes that describe a person. LdapPerson.given_name: The given or first name of the user. |
Groups Name | group_names | optional | string_t Array | User.groups: The administrative groups to which the user belongs. Group.name: The group name. |
History ID | hid | optional | integer_t | User.hid: The unique DataBee ID to identify a particular history entry or row in an entity table (i.e., user, device or product table). This field is the primary key and should not be mapped manually as the DataBee product populates this field itself. |
LDAP Person Hire Time | hire_time | optional | timestamp_t | User.ldap_person: The additional LDAP attributes that describe a person. LdapPerson.hire_time: The timestamp when the user was or will be hired by the organization. |
LDAP Person ID | id | required | integer_t | User.ldap_person: The additional LDAP attributes that describe a person. LdapPerson.id: None |
LDAP Person Job Title | job_title | optional | string_t | User.ldap_person: The additional LDAP attributes that describe a person. LdapPerson.job_title: The user's job title. |
LDAP Person Leave Time | leave_time | optional | timestamp_t | User.ldap_person: The additional LDAP attributes that describe a person. LdapPerson.leave_time: The timestamp when the user left or will be leaving the organization. |
LDAP Person Geo Location | location_city | optional | string_t | User.ldap_person: The additional LDAP attributes that describe a person. LdapPerson.location: The geographical location associated with a user. This is typically the user's usual work location. |
LDAP Person Geo Location | location_country | optional | string_t | User.ldap_person: The additional LDAP attributes that describe a person. LdapPerson.location: The geographical location associated with a user. This is typically the user's usual work location. |
LDAP Person Manager | manager_id | optional | integer_t | User.ldap_person: The additional LDAP attributes that describe a person. LdapPerson.manager: The user's manager. This helps in understanding an org hierarchy. This should only ever be populated once in an event. I.e. there should not be a manager's manager in an event. |
Modified Time | modified_time | optional | timestamp_t | User.modified_time: The timestamp when the user entry was last modified. Useful for tracking changes to user attributes or status. Synonyms: last modified, update time. |
LDAP Person Office Location | office_location | optional | string_t | User.ldap_person: The additional LDAP attributes that describe a person. LdapPerson.office_location: The primary office location associated with the user. This could be any string and isn't a specific address. For example, |
Organization Name | org_name | optional | string_t | User.org: Organization and org unit related to the user. Organization.name: The name of the organization, Oracle Cloud Tenancy, Google Cloud Organization, or AWS Organization. For example, |
Organization Org Unit Name | org_ou_name | optional | string_t | User.org: Organization and org unit related to the user. Organization.ou_name: The name of an organizational unit, Google Cloud Folder, or AWS Org Unit. For example, the |
Record Created At | record_created_at | required | timestamp_t | CDPs generated timestamp when record was created. |
Record Updated At | record_updated_at | required | timestamp_t | CDPs generated timestamp when record was last updated. |
Data Sources | sources | recommended | string_t Array | User.backtrace: This object is a key value set that relates each field in the user to the earliest raw event that gave DataBee that particular value in the correlation. For example, |
Start Time | start_time | optional | timestamp_t | User.start_time: The start time when a particular state of the user became valid |
LDAP Person Surname | surname | optional | string_t | User.ldap_person: The additional LDAP attributes that describe a person. LdapPerson.surname: The last or family name for the user. |
Type | type | optional | string_t | User.type: The type of the user. For example, System, AWS IAM User, etc. |
Type ID | type_id | recommended | integer_t | User.type_id: The user type identifier. |
Person
- Published on Aug 3, 2026
- 3 minute(s) read
Was this article helpful?