Purpose
The User Feed CDP contains up-to-date information when a user was first seen and last seen by a particular feed. The User Feed CDP is ideal for answering questions about when a user was last seen by a feed.
Understanding the Table
The User Feed CDP contains first_seen and last_seen time stamps. These timestamps indicate when a user (identified by user_id) was last seen by a particular feed and event_type (identified by feed_name and class_uid).
{
"class_name": "Device Inventory Info",
"class_uid": 5001,
"feed_name": "microsoft_intune",
"feed_version": null,
"first_seen": "2025-12-24T21:35:20",
"id": 1251415099,
"last_seen": "2025-12-24T21:35:20",
"record_created_at": "2025-12-24T21:35:20",
"record_updated_at": "2025-12-25T23:01:35",
"user_id": 888123
}Joining to CDPs and OCSF
If the security hygiene entitlement is enabled, user_id can be used to join back to OCSF and other CDP tables
Example Queries
Display user_id from all feeds
SELECT * FROM cdp.user_feed where user_id is <user_id>CDP Data Dictionary
Caption | Name | Requirement | Type | Description |
|---|---|---|---|---|
Class Name | class_name | required | string_t | The class or category of the user feed. |
Class UID | class_uid | required | integer_t | The unique identifier for the class or category of the user feed. |
Feed Name | feed_name | required | string_t | The name of the data feed from which the user information was obtained. |
Feed Version | feed_version | optional | string_t | The version of the data feed from which the user information was obtained. |
First Seen | first_seen | required | timestamp_t | The timestamp when the user was first observed in this data feed. |
ID | id | required | integer_t | Auto-incrementing unique identifier for each record. |
Last Seen | last_seen | required | timestamp_t | The timestamp when the user was most recently observed in this data feed. |
Record Created At | record_created_at | required | timestamp_t | CDPs generated timestamp when record was created. |
Record Updated At | record_updated_at | required | timestamp_t | CDPs generated timestamp when record was last updated. |
User ID | user_id | required | integer_t | The unique identifier used by DataBee for a specific user. This will be logged as |