User

Purpose

The User CDP contains information on all users/employees within an organization. The User CDP is ideal for answering questions about the current and historical status of the organization's workforce and can be joined to OCSF event tables for further historical trend analysis.

Entity Correlation

The User CDP contains every user DataBee has identified, of both types:

Person: a human identity, such as an employee or contractor. Persons are also available on their own in the Person CDP.
Account: any other user type, such as a directory, cloud, application, local, or service account. Accounts are also available on their own in the Account CDP.

Persons and accounts each receive their own DataBee user ID. The Entity Correlator identifies and differentiates them using these fields, in order of priority:

Persons: Employee UID, then Email Address.
Accounts: Username and Domain together, then Username, then Email Address. The same username in two different domains (for example, john.smith in azure_ad and in microsoft_entra) produces two separate accounts.

For more on how persons and accounts are resolved, see Asset and Entity Resolution.

Understanding the Table

The User CDP is a Type 2 Slowly Changing table meaning that any modifications to an entity will result in the creation of new rows for that user ID, capturing the updated fields. The active column for the older row is set to False, ensuring that historical data remains unaltered and providing a clear distinction between current and previous states. Consequently, users can trace the evolution of the data over time, making it easier to perform audits and historical analyses.

End_time is populated only if a user has been merged into another user by the Entity Correlator. In such cases, a new row is created to reflect the merged user, and the ‘end_time’ field is populated for all previous rows associated with the user. This ensures that there is a clear distinction between the historical data and the current state of the Entity Correlator. By tracking the end_time, users can easily identify when a particular user entity was last active before being merged.

On the other hand, if a user’s attributes are merely updated without merging, the end_time will not be populated for the older row. Instead, the active field will be set to False. This indicates that the older information is no longer current but still retains its historical significance.

Schema

Joining to CDPs and OCSF

If the security hygiene entitlement is enabled, user.id can be used to join back to OCSF and CDP tables, otherwise another id like user.name or user.email_addr or user.employee_uid should be employed.

Example Queries

Find all active users

SELECT * FROM user where active=TRUE

Find the latest record for a given id

SELECT * FROM user where id = {id} and active=TRUE

Find all active entities and their latest row

SELECT * FROM user where active=TRUE

How to join back to OCSF

SELECT * FROM CDP.user left join OCSF.{activity} on CDP.user.id = OCSF.{activity}.user_id

CDP Data Dictionary

Caption	Name	Requirement	Type	Description
Active	active	optional	boolean_t	User.modified_time: The timestamp when the user entry was last modified.
Created Time	created_time	optional	timestamp_t	User.created_time: The timestamp when the user was created.
Email Address	email_addr	optional	email_t	User.email_addr: The user's primary email address. For example: `noone@nowhere.ru`.
Email Addresses	email_addrs	optional	email_t Array	User.email_addresses: A list of additional email addresses for the user.
Employee UID	employee_uid	optional	string_t	User.employee_uid: The employee identifier assigned to the user by the organization.
End Time	end_time	optional	timestamp_t	User.end_time: The end time of when a particular state of the user was valid. Using the `start_time` and `end_time` together bound the time when a particular user state was valid. If there is no `end_time` it tells the analyst that this is the current state of the user as DataBee understands it. There will ever only be a single user for which the `end_time` is `null`.
Full Name	full_name	optional	string_t	User.full_name: The full name of the person, as per the LDAP Common Name attribute (cn).
Given Name	given_name	optional	string_t	User.given_name: The given or first name of the user.
Group Names	group_names	optional	string_t Array	User.groups: The administrative groups to which the user belongs. Group.name: The group name.
History ID	hid	required	integer_t	User.hid: The unique DataBee ID to identify a particular history entry in an object table. This field is the PK and should not be mapped manually as the DataBee product populates this field itself.
Hire Time	hire_time	optional	timestamp_t	User.ldap_person: The additional LDAP attributes that describe a person. LdapPerson.hire_time: The timestamp when the user was or will be hired by the organization.
User ID	id	required	integer_t	User.id: The unique identifier used by DataBee for a specific user. This will be logged as `user_id` in activity tables to link to a particular user in this table. This field should not be mapped manually as the DataBee product populates this field itself.
Job Title	job_title	optional	string_t	User.job_title: The user's job title.
Leave Time	leave_time	optional	timestamp_t	User.ldap_person: The additional LDAP attributes that describe a person. LdapPerson.leave_time: The timestamp when the user left or will be leaving the organization.
Geo Location City	location_city	optional	string_t	User.location: The detailed geographical location associated with a user. When used with the `user_inventory` event class, this typically documents the users usual work location. Location.city: The name of the city. For example: san diego.
Geo Location Country	location_country	optional	string_t	User.location: The detailed geographical location associated with a user. When used with the `user_inventory` event class, this typically documents the users usual work location. Location.country: The ISO 3166-1 Alpha-2 country code. For the complete list of country codes see `ISO 3166-1 alpha-2 codes <https://www.iso.org/obp/ui/#iso:pub:PUB500001:en>`_.
Geo Location Postal Code	location_postal_code	optional	string_t	User.ldap_person: The additional LDAP attributes that describe a person. LdapPerson.location: The geographical location associated with a user. Location.postal_code: The postal code of the location.
Geo Location Region	location_region	optional	string_t	User.ldap_person: The additional LDAP attributes that describe a person. LdapPerson.location: The geographical location associated with a user. Location.region: The alphanumeric code that identifies the principal subdivision (e.g. province or state) of the country.
Manager ID	manager_id	optional	integer_t	User.manager: The user's manager. This helps in understanding an org hierarchy. This should only ever be populated once in an event. I.e. there should not be a manager's manager in an event.
Modified Time	modified_time	optional	timestamp_t	User.modified_time: The timestamp when the user entry was last modified.
Username	name	recommended	string_t	User.name: The username. For example, `janedoe1`.
Office Location	office_location	optional	string_t	User.office_location: The primary office location associated with the user. This could be any string and isn't a specific address. For example, `South East Virtual`.
Organization Name	org_name	optional	string_t	User.org: Organization and org unit related to the user. Organization.name: The name of the organization. For example, Widget, Inc.
Organization Org Unit Name	org_ou_name	optional	string_t	User.org: Organization and org unit related to the user. Organization.ou_name: The name of the organizational unit, within an organization. For example, Finance, IT, R&D.
Organization Unique ID	org_uid	optional	string_t	User.org: Organization and org unit related to the user. Organization.uid: The unique identifier of the organization. For example, an AWS Org ID or Oracle Cloud Domain ID.
Record Created At	record_created_at	required	timestamp_t	CDPs generated timestamp when record was created.
Record Updated At	record_updated_at	required	timestamp_t	CDPs generated timestamp when record was last updated.
Data Sources	sources	recommended	string_t Array	User.backtrace: This object is a key value set that relates each field in the user to the earliest raw event that gave DataBee that particular value in the correlation. For example, `{'email_addr': 'email_activity.key=123456'}`.
Start Time	start_time	optional	timestamp_t	User.start_time: The start time when a particular state of the user became valid.
Surname	surname	optional	string_t	User.surname: The last or family name for the user.
Type	type	optional	string_t	User.type: The type of the user. For example, System, AWS IAM User, etc.
Type ID	type_id	recommended	integer_t	User.type_id: The account type identifier.
Unique ID	uid	recommended	string_t	User.uid: The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN.