> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/investigate-artifacts-and-assets/investigate-a-user.md). # Investigate a user Drill down on a user in the User Risk View or the User View. In this view Cortex Cloud aggregates all of the data collected for a user, displays the information in graphs and tables, and provides further drilldown options for easy investigation. Cortex Cloud uses Identity Analytics to aggregate information on a user and displays insights about the user. You can take the following actions to investigate a user: * Assess the user's behavior and score. * Star the user to be included in the watchlist. ### How to investigate a user 1. Right-click a user name and select Open User Card.

Tip: You can also see a list of all users under Inventory → Assets → Asset Scores.

2. Select the timeframe to view the user's details.

Note: Cortex Cloud normalizes and displays case and issue times in your time zone. If you're in a half-hour time zone, the activity in the Issues & Insights Heatmap is displayed in the whole-hour time slot preceding it. For example, if you're in a UTC +4.5 time zone, the time displayed for the activity will be UTC +4.5, however, the visualization in the Issues & Insights Heatmap will be in the UTC +4 slot.

3. Investigate the user.
User View Review the sections of the User View. Depending on your permissions, some information might be limited by your scope. 1. In the left panel, review the overview of the user. The displayed information is aggregated by Cortex Cloudfrom cases, Workday, and Active Directory data. The User Score displays the score that is currently assigned to the user and is updated continuously as new issues are associated with cases. 2. Review the Score Trend graph. The graph is based on new cases created within the selected time frame, and updates on past cases that are still active. The straight line represents the user score, which is based on the scores of the cases associated with the user. Select a score to display in the Cases table, the cases that contributed to the total user score on a specific day. 3. Click a score to drill down on the score for a specific day. Alternatively, review the user information for the selected timeframe (Last 7D, 30D, or custom timeframe). The widgets in the right panel reflect the selected timeframe. 4. Review the Related Cases for the selected timeframe or score selected in the Score Trend graph. If you are drilling down on a score, you can see the cases that contributed to the total score on the selected day. Review the following data: * The Status column provides visibility into the reason for the score change. For example, if a case is resolved, its score will decrease, bringing down the host score. * The Points column displays the risk score that the case contributed to the host score. The points are calculated according to SmartScore or Case Scoring Rules. 5. Review the following additional widgets: * User Associated Insights * Top 5 Hosts Logged Into * Top 5 Authentication Target Hosts * Top 5 Authentication Source Hosts * Recent Login * Recent Authentications
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-posture-management/cases-and-issues/investigation-and-response/investigate-artifacts-and-assets/investigate-a-user.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.