> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/intermediate/user.md).

# xdm.intermediate.user

The intermediate user.

|           |               |
| --------- | ------------- |
| Datatype  | Compound.User |
| Dataclass | Compound      |

## Field groups

* [`xdm.intermediate.user.idp`](/xsiam-data-model-schema/fields/intermediate/user/idp.md)
* [`xdm.intermediate.user.app_registration`](/xsiam-data-model-schema/fields/intermediate/user/app-registration.md)
* [`xdm.intermediate.user.group`](/xsiam-data-model-schema/fields/intermediate/user/group.md)
* [`xdm.intermediate.user.policy`](/xsiam-data-model-schema/fields/intermediate/user/policy.md)
* [`xdm.intermediate.user.secret`](/xsiam-data-model-schema/fields/intermediate/user/secret.md)
* [`xdm.intermediate.user.access_keys`](/xsiam-data-model-schema/fields/intermediate/user/access-keys.md)
* [`xdm.intermediate.user.access_statistics`](/xsiam-data-model-schema/fields/intermediate/user/access-statistics.md)
* [`xdm.intermediate.user.key_management`](/xsiam-data-model-schema/fields/intermediate/user/key-management.md)

## Fields

#### `xdm.intermediate.user.user_type`

|             |                                                                                                                  |
| ----------- | ---------------------------------------------------------------------------------------------------------------- |
| Description | The type of the intermediate user.                                                                               |
| Datatype    | [`XDM_CONST.USER_TYPE`](/xsiam-data-model-schema/consts/user-type.md)                                            |
| Dataclass   | Scalar                                                                                                           |
| Examples    | XDM\_CONST.USER\_TYPE\_REGULAR, XDM\_CONST.USER\_TYPE\_SERVICE\_ACCOUNT, XDM\_CONST.USER\_TYPE\_MACHINE\_ACCOUNT |

#### `xdm.intermediate.user.identifier`

|             |                                                                                                       |
| ----------- | ----------------------------------------------------------------------------------------------------- |
| Description | The ID of the user, such as GUID, SID or any other ID that uniquely identifies the intermediate user. |
| Datatype    | String                                                                                                |
| Dataclass   | Scalar                                                                                                |

#### `xdm.intermediate.user.username`

|             |                                                                 |
| ----------- | --------------------------------------------------------------- |
| Description | The user name used for identification of the intermediate user. |
| Datatype    | String                                                          |
| Dataclass   | Scalar                                                          |

#### `xdm.intermediate.user.first_name`

|             |                                          |
| ----------- | ---------------------------------------- |
| Description | The first name of the intermediate user. |
| Datatype    | String                                   |
| Dataclass   | Scalar                                   |

#### `xdm.intermediate.user.last_name`

|             |                                         |
| ----------- | --------------------------------------- |
| Description | The last name of the intermediate user. |
| Datatype    | String                                  |
| Dataclass   | Scalar                                  |

#### `xdm.intermediate.user.middle_name`

|             |                                           |
| ----------- | ----------------------------------------- |
| Description | The middle name of the intermediate user. |
| Datatype    | String                                    |
| Dataclass   | Scalar                                    |

#### `xdm.intermediate.user.employee_id`

|             |                                           |
| ----------- | ----------------------------------------- |
| Description | The employee ID of the intermediate user. |
| Datatype    | String                                    |
| Dataclass   | Scalar                                    |

#### `xdm.intermediate.user.badge_id`

|             |                                             |
| ----------- | ------------------------------------------- |
| Description | The work badge ID of the intermediate user. |
| Datatype    | String                                      |
| Dataclass   | Scalar                                      |

#### `xdm.intermediate.user.ou`

|             |                                                 |
| ----------- | ----------------------------------------------- |
| Description | The organization unit of the intermediate user. |
| Datatype    | String                                          |
| Dataclass   | Scalar                                          |

#### `xdm.intermediate.user.title`

|             |                                          |
| ----------- | ---------------------------------------- |
| Description | The work title of the intermediate user. |
| Datatype    | String                                   |
| Dataclass   | Scalar                                   |
| Examples    | Sr Staff Engineer Software               |

#### `xdm.intermediate.user.location`

|             |                                             |
| ----------- | ------------------------------------------- |
| Description | The work location of the intermediate user. |
| Datatype    | String                                      |
| Dataclass   | Scalar                                      |
| Examples    | Office - Israel - Tel Aviv                  |

#### `xdm.intermediate.user.employee_type`

|             |                                             |
| ----------- | ------------------------------------------- |
| Description | The employee type of the intermediate user. |
| Datatype    | String                                      |
| Dataclass   | Scalar                                      |
| Examples    | EMPLOYEE, CONTRACTOR                        |

#### `xdm.intermediate.user.domain`

|             |                                                    |
| ----------- | -------------------------------------------------- |
| Description | The domain to which the intermediate user belongs. |
| Datatype    | String                                             |
| Dataclass   | Scalar                                             |

#### `xdm.intermediate.user.full_domain_name`

|             |                                                              |
| ----------- | ------------------------------------------------------------ |
| Description | The full domain name to which the intermediate user belongs. |
| Datatype    | String                                                       |
| Dataclass   | Scalar                                                       |
| Examples    | example.onmicrosoft.com                                      |

#### `xdm.intermediate.user.clean_domain_name`

|             |                                                               |
| ----------- | ------------------------------------------------------------- |
| Description | The clean domain name to which the intermediate user belongs. |
| Datatype    | String                                                        |
| Dataclass   | Scalar                                                        |
| Examples    | example.com                                                   |

#### `xdm.intermediate.user.clean_trimmed_domain_name`

|             |                                                                       |
| ----------- | --------------------------------------------------------------------- |
| Description | The clean trimmed domain name to which the intermediate user belongs. |
| Datatype    | String                                                                |
| Dataclass   | Scalar                                                                |
| Examples    | example                                                               |

#### `xdm.intermediate.user.is_password_changeable`

|             |                                                              |
| ----------- | ------------------------------------------------------------ |
| Description | Whether the password of the intermediate user is changeable. |
| Datatype    | Boolean                                                      |
| Dataclass   | Scalar                                                       |

#### `xdm.intermediate.user.is_password_expired`

|             |                                                            |
| ----------- | ---------------------------------------------------------- |
| Description | Whether the password of the intermediate user has expired. |
| Datatype    | Boolean                                                    |
| Dataclass   | Scalar                                                     |

#### `xdm.intermediate.user.is_password_required`

|             |                                                            |
| ----------- | ---------------------------------------------------------- |
| Description | Whether the password of the intermediate user is required. |
| Datatype    | Boolean                                                    |
| Dataclass   | Scalar                                                     |

#### `xdm.intermediate.user.is_disabled`

|             |                                            |
| ----------- | ------------------------------------------ |
| Description | Whether the intermediate user is disabled. |
| Datatype    | Boolean                                    |
| Dataclass   | Scalar                                     |

#### `xdm.intermediate.user.groups`

|             |                                                    |
| ----------- | -------------------------------------------------- |
| Description | The groups to which the intermediate user belongs. |
| Datatype    | String                                             |
| Dataclass   | Array                                              |

#### `xdm.intermediate.user.roles`

|             |                                         |
| ----------- | --------------------------------------- |
| Description | Current roles of the intermediate user. |
| Datatype    | String                                  |
| Dataclass   | Array                                   |

#### `xdm.intermediate.user.identity_type`

|             |                                                                                                                                                                                 |
| ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Description | The identity type of the intermediate user (auto-enriched field).                                                                                                               |
| Datatype    | [`XDM_CONST.IDENTITY_TYPE`](/xsiam-data-model-schema/consts/identity-type.md)                                                                                                   |
| Dataclass   | Scalar                                                                                                                                                                          |
| Examples    | XDM\_CONST.IDENTITY\_TYPE\_MACHINE, XDM\_CONST.IDENTITY\_TYPE\_USER, XDM\_CONST.IDENTITY\_TYPE\_BUILTIN, XDM\_CONST.IDENTITY\_TYPE\_VIRTUAL, XDM\_CONST.IDENTITY\_TYPE\_UNKNOWN |

#### `xdm.intermediate.user.netbios_domain`

|             |                                                                                                                                                                                                               |
| ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Description | The subdomain of the intermediate user's DNS domain name. See <https://docs.microsoft.com/en-us/exchange/disjoint-namespace-scenarios-exchange-2013-help#dns-and-netbios-domain-names> (auto-enriched field). |
| Datatype    | String                                                                                                                                                                                                        |
| Dataclass   | Scalar                                                                                                                                                                                                        |
| Examples    | mycompany                                                                                                                                                                                                     |

#### `xdm.intermediate.user.sam_account_name`

|             |                                                                                                                                                          |
| ----------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Description | The logon name of the intermediate user. See <https://docs.microsoft.com/en-us/windows/win32/ad/naming-properties#samaccountname> (auto-enriched field). |
| Datatype    | String                                                                                                                                                   |
| Dataclass   | Scalar                                                                                                                                                   |
| Examples    | jondoe                                                                                                                                                   |

#### `xdm.intermediate.user.upn`

|             |                                                                                                                                                                 |
| ----------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Description | The principal name of the intermediate user. See <https://docs.microsoft.com/en-us/windows/win32/ad/naming-properties#userprincipalname> (auto-enriched field). |
| Datatype    | String                                                                                                                                                          |
| Dataclass   | Scalar                                                                                                                                                          |
| Examples    | <jon.doe@mycompany.com>                                                                                                                                         |

#### `xdm.intermediate.user.scope`

|             |                                                                                                                                                                  |
| ----------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Description | The scope of the intermediate user (auto-enriched field).                                                                                                        |
| Datatype    | [`XDM_CONST.SCOPE_TYPE`](/xsiam-data-model-schema/consts/scope-type.md)                                                                                          |
| Dataclass   | Scalar                                                                                                                                                           |
| Examples    | XDM\_CONST.SCOPE\_TYPE\_LOCAL, XDM\_CONST.SCOPE\_TYPE\_DOMAIN, XDM\_CONST.SCOPE\_TYPE\_AZURE, XDM\_CONST.SCOPE\_TYPE\_MICROSOFT, XDM\_CONST.SCOPE\_TYPE\_UNKNOWN |

#### `xdm.intermediate.user.dn`

|             |                                                  |
| ----------- | ------------------------------------------------ |
| Description | The distinguished name of the intermediate user. |
| Datatype    | String                                           |
| Dataclass   | Scalar                                           |

#### `xdm.intermediate.user.service_principal_names`

|             |                                                                                   |
| ----------- | --------------------------------------------------------------------------------- |
| Description | An array of Service Principal Names (SPNs) associated with the intermediate user. |
| Datatype    | String                                                                            |
| Dataclass   | Array                                                                             |

#### `xdm.intermediate.user.os`

|             |                                                                            |
| ----------- | -------------------------------------------------------------------------- |
| Description | The specific operating system of the intermediate user, including version. |
| Datatype    | String                                                                     |
| Dataclass   | Scalar                                                                     |

#### `xdm.intermediate.user.creation_time`

|             |                                            |
| ----------- | ------------------------------------------ |
| Description | The creation time of the intermediate user |
| Datatype    | UnixMillis                                 |
| Dataclass   | Scalar                                     |

#### `xdm.intermediate.user.password_last_set`

|             |                                                                  |
| ----------- | ---------------------------------------------------------------- |
| Description | The time when password of the intermediate user was last changed |
| Datatype    | UnixMillis                                                       |
| Dataclass   | Scalar                                                           |

#### `xdm.intermediate.user.is_password_never_expire`

|             |                                                              |
| ----------- | ------------------------------------------------------------ |
| Description | Whether the password of the intermediate user never expires. |
| Datatype    | Boolean                                                      |
| Dataclass   | Scalar                                                       |

#### `xdm.intermediate.user.has_admin_permissions`

|             |                                                    |
| ----------- | -------------------------------------------------- |
| Description | Does the identity have administrative permissions. |
| Datatype    | Boolean                                            |
| Dataclass   | Scalar                                             |

#### `xdm.intermediate.user.can_impersonate`

|             |                                                                                                                                            |
| ----------- | ------------------------------------------------------------------------------------------------------------------------------------------ |
| Description | Indicates whether the Azure Entra ID user can impersonate app registrations (This attribute is based on the actions assigned to the user). |
| Datatype    | Boolean                                                                                                                                    |
| Dataclass   | Scalar                                                                                                                                     |

#### `xdm.intermediate.user.app_registrations_ids`

|             |                                                                                                                                          |
| ----------- | ---------------------------------------------------------------------------------------------------------------------------------------- |
| Description | List of Azure app registrations ids that the user owns.                                                                                  |
| Datatype    | String                                                                                                                                   |
| Dataclass   | Array                                                                                                                                    |
| Examples    | \["mj87tufnb3736dbcnjedid84hfnsdhsaos0sksksks898sdgtegwtwqgafdatsdg","1wsdcgtyh76656yhjui980oi98ijnndhd74hjfdkjkk8jdnssksw3jsjhddsw35t"] |

#### `xdm.intermediate.user.email`

|             |                                                          |
| ----------- | -------------------------------------------------------- |
| Description | The email address of the identity (auto-enriched field). |
| Datatype    | String                                                   |
| Dataclass   | Scalar                                                   |
| Examples    | <jon.doe@mycompany.com>                                  |

#### `xdm.intermediate.user.last_login`

|             |                        |
| ----------- | ---------------------- |
| Description | The time of last login |
| Datatype    | UnixMillis             |
| Dataclass   | Scalar                 |

#### `xdm.intermediate.user.last_used`

|             |                        |
| ----------- | ---------------------- |
| Description | The time of last login |
| Datatype    | UnixMillis             |
| Dataclass   | Scalar                 |

#### `xdm.intermediate.user.has_mfa`

|             |                                |
| ----------- | ------------------------------ |
| Description | Does the user have MFA enabled |
| Datatype    | Boolean                        |
| Dataclass   | Scalar                         |

#### `xdm.intermediate.user.is_federated`

|             |                                    |
| ----------- | ---------------------------------- |
| Description | Whether the identity is federated. |
| Datatype    | Boolean                            |
| Dataclass   | Scalar                             |

#### `xdm.intermediate.user.is_guest`

|             |                                |
| ----------- | ------------------------------ |
| Description | Whether the identity is guest. |
| Datatype    | Boolean                        |
| Dataclass   | Scalar                         |

#### `xdm.intermediate.user.access_to_services`

|             |                                          |
| ----------- | ---------------------------------------- |
| Description | Which services this identity can access. |
| Datatype    | String                                   |
| Dataclass   | Array                                    |
| Examples    | S3, blob, GKE                            |

#### `xdm.intermediate.user.number_of_roles`

|             |                                          |
| ----------- | ---------------------------------------- |
| Description | Number of roles the identity can assume. |
| Datatype    | Number                                   |
| Dataclass   | Scalar                                   |

#### `xdm.intermediate.user.number_of_policies`

|             |                             |
| ----------- | --------------------------- |
| Description | Number of attached policies |
| Datatype    | Number                      |
| Dataclass   | Scalar                      |

#### `xdm.intermediate.user.number_of_bounded_identities`

|             |                                                          |
| ----------- | -------------------------------------------------------- |
| Description | How many identities can assume this role or bound to it. |
| Datatype    | Number                                                   |
| Dataclass   | Scalar                                                   |

#### `xdm.intermediate.user.account_access`

|             |                                                                                                                                                                                                                                                                                          |
| ----------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Description | The level of access that is granted to this identity.                                                                                                                                                                                                                                    |
| Datatype    | [`XDM_CONST.IDENTITY_ACCOUNT_ACCESS`](/xsiam-data-model-schema/consts/identity-account-access.md)                                                                                                                                                                                        |
| Dataclass   | Array                                                                                                                                                                                                                                                                                    |
| Examples    | XDM\_CONST.IDENTITY\_ACCOUNT\_ACCESS\_SAME\_ACCOUNT, XDM\_CONST.IDENTITY\_ACCOUNT\_ACCESS\_INTERNAL\_KNOWN, XDM\_CONST.IDENTITY\_ACCOUNT\_ACCESS\_INTERNAL\_UNKNOWN, XDM\_CONST.IDENTITY\_ACCOUNT\_ACCESS\_THIRD\_PARTY\_VENDOR, XDM\_CONST.IDENTITY\_ACCOUNT\_ACCESS\_EXTERNAL\_UNKNOWN |

#### `xdm.intermediate.user.managing_identities_count`

|             |                                                 |
| ----------- | ----------------------------------------------- |
| Description | Number of identities who can manage this asset. |
| Datatype    | Number                                          |
| Dataclass   | Scalar                                          |

#### `xdm.intermediate.user.last_managed_time`

|             |                                       |
| ----------- | ------------------------------------- |
| Description | The last time this asset was managed. |
| Datatype    | UnixMillis                            |
| Dataclass   | Scalar                                |

#### `xdm.intermediate.user.sid`

|             |                                                         |
| ----------- | ------------------------------------------------------- |
| Description | The Security Identifier (SID) of the intermediate user. |
| Datatype    | String                                                  |
| Dataclass   | Scalar                                                  |

#### `xdm.intermediate.user.guid`

|             |                                           |
| ----------- | ----------------------------------------- |
| Description | The unique GUID of the intermediate user. |
| Datatype    | String                                    |
| Dataclass   | Scalar                                    |

#### `xdm.intermediate.user.netbios`

|             |                                        |
| ----------- | -------------------------------------- |
| Description | The Legacy short domain/workgroup name |
| Datatype    | String                                 |
| Dataclass   | Scalar                                 |

#### `xdm.intermediate.user.netbios_sam_account_name`

|             |                                                 |
| ----------- | ----------------------------------------------- |
| Description | The Logon name in netbios sam account name form |
| Datatype    | String                                          |
| Dataclass   | Scalar                                          |

#### `xdm.intermediate.user.access_levels`

|             |                                                                                                                                                                                                                               |
| ----------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Description | The level of access that is granted to this identity                                                                                                                                                                          |
| Datatype    | [`XDM_CONST.IDENTITY_ACCESS_LEVEL`](/xsiam-data-model-schema/consts/identity-access-level.md)                                                                                                                                 |
| Dataclass   | Array                                                                                                                                                                                                                         |
| Examples    | XDM\_CONST.IDENTITY\_ACCESS\_LEVEL\_READ, XDM\_CONST.IDENTITY\_ACCESS\_LEVEL\_WRITE, XDM\_CONST.IDENTITY\_ACCESS\_LEVEL\_LIST, XDM\_CONST.IDENTITY\_ACCESS\_LEVEL\_CONFIG, XDM\_CONST.IDENTITY\_ACCESS\_LEVEL\_ADMINISTRATIVE |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/intermediate/user.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.