Caption | Name | Requirement | Type | Description |
|---|---|---|---|---|
Modified Time | active | optional | boolean_t | User.modified_time: The timestamp when the user entry was last modified. |
Created Time | created_time | optional | timestamp_t | User.created_time: The timestamp when the user was created. |
Email Address | email_addr | optional | email_t | User.email_addr: The user's primary email address. For example: |
Email Addresses | email_addrs | optional | email_t Array | User.email_addresses: A list of additional email addresses for the user. |
Employee ID | employee_uid | optional | string_t | User.employee_uid: The employee identifier assigned to the user by the organization. |
End Time | end_time | optional | timestamp_t | User.end_time: The end time of when a particular state of the user was valid. Using the |
Full Name | full_name | optional | string_t | User.full_name: The full name of the person, as per the LDAP Common Name attribute (cn). |
Given Name | given_name | optional | string_t | User.given_name: The given or first name of the user. |
Groups Name | group_names | optional | string_t Array | User.groups: The administrative groups to which the user belongs. |
History ID | hid | required | integer_t | User.hid: The unique DataBee ID to identify a particular history entry in an object table. This field is the PK and should not be mapped manually as the DataBee product populates this field itself. |
Hire Date | hire_time | optional | timestamp_t | User.ldap_person: The additional LDAP attributes that describe a person. LdapPerson.hire_time: The timestamp when the user was or will be hired by the organization. |
ID | id | required | integer_t | User.id: The unique identifier used by DataBee for a specific user. This will be logged as |
Job Title | job_title | optional | string_t | User.job_title: The user's job title. |
Leave Date | leave_time | optional | timestamp_t | User.ldap_person: The additional LDAP attributes that describe a person. LdapPerson.leave_time: The timestamp when the user left or will be leaving the organization. |
Geo Location City | location_city | optional | string_t | User.location: The detailed geographical location associated with a user. When used with the |
Geo Location Country | location_country | optional | string_t | User.location: The detailed geographical location associated with a user. When used with the |
Geo Location Postal Code | location_postal_code | optional | string_t | User.ldap_person: The additional LDAP attributes that describe a person. LdapPerson.location: The geographical location associated with a user. Location.postal_code: The postal code of the location. |
Geo Location Region | location_region | optional | string_t | User.ldap_person: The additional LDAP attributes that describe a person. LdapPerson.location: The geographical location associated with a user. Location.region: The alphanumeric code that identifies the principal subdivision (e.g. province or state) of the country. |
Manager | manager_id | optional | integer_t | User.manager: The user's manager. This helps in understanding an org hierarchy. This should only ever be populated once in an event. I.e. there should not be a manager's manager in an event. |
Modified Time | modified_time | optional | timestamp_t | User.modified_time: The timestamp when the user entry was last modified. |
Name | name | recommended | string_t | User.name: The username. For example, |
Office Location | office_location | optional | string_t | User.office_location: The primary office location associated with the user. This could be any string and isn't a specific address. For example, |
Organization Name | org_name | optional | string_t | User.org: Organization and org unit related to the user. Organization.name: The name of the organization. For example, Widget, Inc. |
Organization Org Unit Name | org_ou_name | optional | string_t | User.org: Organization and org unit related to the user. Organization.ou_name: The name of the organizational unit, within an organization. For example, Finance, IT, R&D. |
Organization Unique ID | org_uid | optional | string_t | User.org: Organization and org unit related to the user. Organization.uid: The unique identifier of the organization. For example, an AWS Org ID or Oracle Cloud Domain ID. |
Record Created At | record_created_at | required | timestamp_t | CDPs generated timestamp when record was created. |
Record Updated At | record_updated_at | required | timestamp_t | CDPs generated timestamp when record was last updated. |
Sources | sources | recommended | string_t Array | User.backtrace: This object is a key value set that relates each field in the user to the earliest raw event that gave DataBee that particular value in the correlation. For example, |
Start Time | start_time | optional | timestamp_t | User.start_time: The start time when a particular state of the user became valid. |
Surname | surname | optional | string_t | User.surname: The last or family name for the user. |
Type | type | optional | string_t | User.type: The type of the user. For example, System, AWS IAM User, etc. |
Type ID | type_id | recommended | integer_t | User.type_id: The account type identifier. |
Unique ID | uid | recommended | string_t | User.uid: The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. |
User
- Updated on Jul 14, 2026
- Published on May 31, 2024
- 3 minute(s) read
Was this article helpful?