Investigate a user

Investigate user activity and related security context.

Drill down on a user in the User Risk View or the User View. In this view Cortex Cloud aggregates all of the data collected for a user, displays the information in graphs and tables, and provides further drilldown options for easy investigation. Cortex Cloud uses Identity Analytics to aggregate information on a user and displays insights about the user.

You can take the following actions to investigate a user:

• Assess the user's behavior and score.
• Star the user to be included in the watchlist.

How to investigate a user

1. Right-click a user name and select Open User Card.

   Tip: You can also see a list of all users under Inventory → Assets → Asset Scores.
2. Select the timeframe to view the user's details.

   Note: Cortex Cloud normalizes and displays case and issue times in your time zone. If you're in a half-hour time zone, the activity in the Issues & Insights Heatmap is displayed in the whole-hour time slot preceding it. For example, if you're in a UTC +4.5 time zone, the time displayed for the activity will be UTC +4.5, however, the visualization in the Issues & Insights Heatmap will be in the UTC +4 slot.
3. Investigate the user.

User View

Review the sections of the User View. Depending on your permissions, some information might be limited by your scope.

1. In the left panel, review the overview of the user. The displayed information is aggregated by Cortex Cloudfrom cases, Workday, and Active Directory data.

   The User Score displays the score that is currently assigned to the user and is updated continuously as new issues are associated with cases.
2. Review the Score Trend graph.

   The graph is based on new cases created within the selected time frame, and updates on past cases that are still active. The straight line represents the user score, which is based on the scores of the cases associated with the user.

   Select a score to display in the Cases table, the cases that contributed to the total user score on a specific day.
3. Click a score to drill down on the score for a specific day. Alternatively, review the user information for the selected timeframe (Last 7D, 30D, or custom timeframe).

   The widgets in the right panel reflect the selected timeframe.
4. Review the Related Cases for the selected timeframe or score selected in the Score Trend graph. If you are drilling down on a score, you can see the cases that contributed to the total score on the selected day. Review the following data:

   • The Status column provides visibility into the reason for the score change. For example, if a case is resolved, its score will decrease, bringing down the host score.
   • The Points column displays the risk score that the case contributed to the host score. The points are calculated according to SmartScore or Case Scoring Rules.
5. Review the following additional widgets:

   • User Associated Insights
   • Top 5 Hosts Logged Into
   • Top 5 Authentication Target Hosts
   • Top 5 Authentication Source Hosts
   • Recent Login
   • Recent Authentications