Purpose
The User Feed CDP contains up-to-date information when a user was first seen and last seen by a particular feed. The User Feed CDP is ideal for answering questions about when a user was last seen by a feed.
Understanding the Table
The User Feed CDP contains first_seen and last_seen time stamps. These timestamps indicate when a user (identified by user_id) was last seen by a particular feed and event_type (identified by feed_name and class_uid).
{
"class_name": "Device Inventory Info",
"class_uid": 5001,
"feed_name": "microsoft_intune",
"feed_version": null,
"first_seen": "2025-12-24T21:35:20",
"id": 1251415099,
"last_seen": "2025-12-24T21:35:20",
"record_created_at": "2025-12-24T21:35:20",
"record_updated_at": "2025-12-25T23:01:35",
"user_id": 888123
}Joining to CDPs and OCSF
If the security hygiene entitlement is enabled, user_id can be used to join back to OCSF and other CDP tables
Example Queries
Display user_id from all feeds
SELECT * FROM cdp.user_feed where user_id is <user_id>