--- title: "User" slug: "user-2" updated: 2026-10-29T18:07:57Z published: 2026-10-29T18:07:57Z canonical: "docs.databee.buzz/user-2" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.databee.buzz/llms.txt > Use this file to discover all available pages before exploring further. # User ## Purpose The User CDP contains information on all users/employees within an organization. The User CDP is ideal for answering questions about the current and historical status of the organization's workforce and can be joined to OCSF event tables for further historical trend analysis. ## Entity Correlation The User CDP contains every user DataBee has identified, of both types: - **Person**: a human identity, such as an employee or contractor. Persons are also available on their own in the [Person CDP](https://docs.databee.buzz/docs/person). - **Account**: any other user type, such as a directory, cloud, application, local, or service account. Accounts are also available on their own in the [Account CDP](https://docs.databee.buzz/docs/account). Persons and accounts each receive their own DataBee user ID. The Entity Correlator identifies and differentiates them using these fields, in order of priority: - **Persons**: Employee UID, then Email Address. - **Accounts**: Username and Domain together, then Username, then Email Address. The same username in two different domains (for example, `john.smith` in `azure_ad` and in `microsoft_entra`) produces two separate accounts. For more on how persons and accounts are resolved, see [Asset and Entity Resolution](https://docs.databee.buzz/docs/entity-resolution). ## Understanding the Table The User CDP is a Type 2 Slowly Changing table meaning that any modifications to an entity will result in the creation of new rows for that user ID, capturing the updated fields. The `active` column for the older row is set to `False`, ensuring that historical data remains unaltered and providing a clear distinction between current and previous states. Consequently, users can trace the evolution of the data over time, making it easier to perform audits and historical analyses. `End_time` is populated only if a user has been merged into another user by the Entity Correlator. In such cases, a new row is created to reflect the merged user, and the ‘end_time’ field is populated for all previous rows associated with the user. This ensures that there is a clear distinction between the historical data and the current state of the Entity Correlator. By tracking the `end_time`, users can easily identify when a particular user entity was last active before being merged. On the other hand, if a user’s attributes are merely updated without merging, the `end_time` will not be populated for the older row. Instead, the `active` field will be set to `False`. This indicates that the older information is no longer current but still retains its historical significance. ## [Schema](/user-manual/docs/user-1) ## Joining to CDPs and OCSF If the security hygiene entitlement is enabled, `user.id` can be used to join back to OCSF and CDP tables, otherwise another id like `user.name` or `user.email_addr` or `user.employee_uid` should be employed. ## Example Queries Find all active users ```pgsql SELECT * FROM user where active=TRUE ``` Find the latest record for a given id ```pgsql SELECT * FROM user where id = {id} and active=TRUE ``` Find all active entities and their latest row ```pgsql SELECT * FROM user where active=TRUE ``` How to join back to OCSF ```pgsql SELECT * FROM CDP.user left join OCSF.{activity} on CDP.user.id = OCSF.{activity}.user_id ``` ## CDP Data Dictionary | **Caption** | **Name** | **Requirement** | **Type** | **Description** | | --- | --- | --- | --- | --- | | Active | active | optional | boolean_t | User.modified_time: The timestamp when the user entry was last modified. | | Created Time | created_time | optional | timestamp_t | User.created_time: The timestamp when the user was created. | | Email Address | email_addr | optional | email_t | User.email_addr: The user's primary email address. For example: `noone@nowhere.ru`. | | Email Addresses | email_addrs | optional | email_t Array | User.email_addresses: A list of additional email addresses for the user. | | Employee UID | employee_uid | optional | string_t | User.employee_uid: The employee identifier assigned to the user by the organization. | | End Time | end_time | optional | timestamp_t | User.end_time: The end time of when a particular state of the user was valid. Using the `start_time` and `end_time` together bound the time when a particular user state was valid. If there is no `end_time` it tells the analyst that this is the current state of the user as DataBee understands it. There will ever only be a single user for which the `end_time` is `null`. | | Full Name | full_name | optional | string_t | User.full_name: The full name of the person, as per the LDAP Common Name attribute (cn). | | Given Name | given_name | optional | string_t | User.given_name: The given or first name of the user. | | Group Names | group_names | optional | string_t Array | User.groups: The administrative groups to which the user belongs. Group.name: The group name. | | History ID | hid | required | integer_t | User.hid: The unique DataBee ID to identify a particular history entry in an object table. This field is the PK and should not be mapped manually as the DataBee product populates this field itself. | | Hire Time | hire_time | optional | timestamp_t | User.ldap_person: The additional LDAP attributes that describe a person. LdapPerson.hire_time: The timestamp when the user was or will be hired by the organization. | | User ID | id | required | integer_t | User.id: The unique identifier used by DataBee for a specific user. This will be logged as `user_id` in activity tables to link to a particular user in this table. This field should not be mapped manually as the DataBee product populates this field itself. | | Job Title | job_title | optional | string_t | User.job_title: The user's job title. | | Leave Time | leave_time | optional | timestamp_t | User.ldap_person: The additional LDAP attributes that describe a person. LdapPerson.leave_time: The timestamp when the user left or will be leaving the organization. | | Geo Location City | location_city | optional | string_t | User.location: The detailed geographical location associated with a user. When used with the `user_inventory` event class, this typically documents the users usual work location. Location.city: The name of the city. For example: san diego. | | Geo Location Country | location_country | optional | string_t | User.location: The detailed geographical location associated with a user. When used with the `user_inventory` event class, this typically documents the users usual work location. Location.country: The ISO 3166-1 Alpha-2 country code. For the complete list of country codes see `ISO 3166-1 alpha-2 codes <https://www.iso.org/obp/ui/#iso:pub:PUB500001:en>`_. | | Geo Location Postal Code | location_postal_code | optional | string_t | User.ldap_person: The additional LDAP attributes that describe a person. LdapPerson.location: The geographical location associated with a user. Location.postal_code: The postal code of the location. | | Geo Location Region | location_region | optional | string_t | User.ldap_person: The additional LDAP attributes that describe a person. LdapPerson.location: The geographical location associated with a user. Location.region: The alphanumeric code that identifies the principal subdivision (e.g. province or state) of the country. | | Manager ID | manager_id | optional | integer_t | User.manager: The user's manager. This helps in understanding an org hierarchy. This should only ever be populated once in an event. I.e. there should not be a manager's manager in an event. | | Modified Time | modified_time | optional | timestamp_t | User.modified_time: The timestamp when the user entry was last modified. | | Username | name | recommended | string_t | User.name: The username. For example, `janedoe1`. | | Office Location | office_location | optional | string_t | User.office_location: The primary office location associated with the user. This could be any string and isn't a specific address. For example, `South East Virtual`. | | Organization Name | org_name | optional | string_t | User.org: Organization and org unit related to the user. Organization.name: The name of the organization. For example, Widget, Inc. | | Organization Org Unit Name | org_ou_name | optional | string_t | User.org: Organization and org unit related to the user. Organization.ou_name: The name of the organizational unit, within an organization. For example, Finance, IT, R&D. | | Organization Unique ID | org_uid | optional | string_t | User.org: Organization and org unit related to the user. Organization.uid: The unique identifier of the organization. For example, an AWS Org ID or Oracle Cloud Domain ID. | | Record Created At | record_created_at | required | timestamp_t | CDPs generated timestamp when record was created. | | Record Updated At | record_updated_at | required | timestamp_t | CDPs generated timestamp when record was last updated. | | Data Sources | sources | recommended | string_t Array | User.backtrace: This object is a key value set that relates each field in the user to the earliest raw event that gave DataBee that particular value in the correlation. For example, `{'email_addr': 'email_activity.key=123456'}`. | | Start Time | start_time | optional | timestamp_t | User.start_time: The start time when a particular state of the user became valid. | | Surname | surname | optional | string_t | User.surname: The last or family name for the user. | | Type | type | optional | string_t | User.type: The type of the user. For example, System, AWS IAM User, etc. | | Type ID | type_id | recommended | integer_t | User.type_id: The account type identifier. | | Unique ID | uid | recommended | string_t | User.uid: The unique user identifier. For example, the Windows user SID, ActiveDirectory DN or AWS user ARN. |