> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/source/identity.md).

# xdm.source.identity

The identity who initiated the activity.

|           |                   |
| --------- | ----------------- |
| Datatype  | Compound.Identity |
| Dataclass | Compound          |

## Field groups

* [`xdm.source.identity.idp`](/xsiam-data-model-schema/fields/source/identity/idp.md)
* [`xdm.source.identity.app_registration`](/xsiam-data-model-schema/fields/source/identity/app-registration.md)
* [`xdm.source.identity.group`](/xsiam-data-model-schema/fields/source/identity/group.md)
* [`xdm.source.identity.policy`](/xsiam-data-model-schema/fields/source/identity/policy.md)
* [`xdm.source.identity.secret`](/xsiam-data-model-schema/fields/source/identity/secret.md)
* [`xdm.source.identity.access_keys`](/xsiam-data-model-schema/fields/source/identity/access-keys.md)
* [`xdm.source.identity.access_statistics`](/xsiam-data-model-schema/fields/source/identity/access-statistics.md)
* [`xdm.source.identity.key_management`](/xsiam-data-model-schema/fields/source/identity/key-management.md)

## Fields

#### `xdm.source.identity.user_type`

|             |                                                                                                                  |
| ----------- | ---------------------------------------------------------------------------------------------------------------- |
| Description | The type of the identity who initiated the activity.                                                             |
| Datatype    | [`XDM_CONST.USER_TYPE`](/xsiam-data-model-schema/consts/user-type.md)                                            |
| Dataclass   | Scalar                                                                                                           |
| Examples    | XDM\_CONST.USER\_TYPE\_REGULAR, XDM\_CONST.USER\_TYPE\_SERVICE\_ACCOUNT, XDM\_CONST.USER\_TYPE\_MACHINE\_ACCOUNT |

#### `xdm.source.identity.identifier`

|             |                                                                                                                         |
| ----------- | ----------------------------------------------------------------------------------------------------------------------- |
| Description | The ID of the user, such as GUID, SID or any other ID that uniquely identifies the identity who initiated the activity. |
| Datatype    | String                                                                                                                  |
| Dataclass   | Scalar                                                                                                                  |

#### `xdm.source.identity.username`

|             |                                                                                   |
| ----------- | --------------------------------------------------------------------------------- |
| Description | The user name used for identification of the identity who initiated the activity. |
| Datatype    | String                                                                            |
| Dataclass   | Scalar                                                                            |

#### `xdm.source.identity.first_name`

|             |                                                            |
| ----------- | ---------------------------------------------------------- |
| Description | The first name of the identity who initiated the activity. |
| Datatype    | String                                                     |
| Dataclass   | Scalar                                                     |

#### `xdm.source.identity.last_name`

|             |                                                           |
| ----------- | --------------------------------------------------------- |
| Description | The last name of the identity who initiated the activity. |
| Datatype    | String                                                    |
| Dataclass   | Scalar                                                    |

#### `xdm.source.identity.middle_name`

|             |                                                             |
| ----------- | ----------------------------------------------------------- |
| Description | The middle name of the identity who initiated the activity. |
| Datatype    | String                                                      |
| Dataclass   | Scalar                                                      |

#### `xdm.source.identity.employee_id`

|             |                                                             |
| ----------- | ----------------------------------------------------------- |
| Description | The employee ID of the identity who initiated the activity. |
| Datatype    | String                                                      |
| Dataclass   | Scalar                                                      |

#### `xdm.source.identity.badge_id`

|             |                                                               |
| ----------- | ------------------------------------------------------------- |
| Description | The work badge ID of the identity who initiated the activity. |
| Datatype    | String                                                        |
| Dataclass   | Scalar                                                        |

#### `xdm.source.identity.ou`

|             |                                                                   |
| ----------- | ----------------------------------------------------------------- |
| Description | The organization unit of the identity who initiated the activity. |
| Datatype    | String                                                            |
| Dataclass   | Scalar                                                            |

#### `xdm.source.identity.title`

|             |                                                            |
| ----------- | ---------------------------------------------------------- |
| Description | The work title of the identity who initiated the activity. |
| Datatype    | String                                                     |
| Dataclass   | Scalar                                                     |
| Examples    | Sr Staff Engineer Software                                 |

#### `xdm.source.identity.location`

|             |                                                               |
| ----------- | ------------------------------------------------------------- |
| Description | The work location of the identity who initiated the activity. |
| Datatype    | String                                                        |
| Dataclass   | Scalar                                                        |
| Examples    | Office - Israel - Tel Aviv                                    |

#### `xdm.source.identity.employee_type`

|             |                                                               |
| ----------- | ------------------------------------------------------------- |
| Description | The employee type of the identity who initiated the activity. |
| Datatype    | String                                                        |
| Dataclass   | Scalar                                                        |
| Examples    | EMPLOYEE, CONTRACTOR                                          |

#### `xdm.source.identity.domain`

|             |                                                                      |
| ----------- | -------------------------------------------------------------------- |
| Description | The domain to which the identity who initiated the activity belongs. |
| Datatype    | String                                                               |
| Dataclass   | Scalar                                                               |

#### `xdm.source.identity.full_domain_name`

|             |                                                                                |
| ----------- | ------------------------------------------------------------------------------ |
| Description | The full domain name to which the identity who initiated the activity belongs. |
| Datatype    | String                                                                         |
| Dataclass   | Scalar                                                                         |
| Examples    | example.onmicrosoft.com                                                        |

#### `xdm.source.identity.clean_domain_name`

|             |                                                                                 |
| ----------- | ------------------------------------------------------------------------------- |
| Description | The clean domain name to which the identity who initiated the activity belongs. |
| Datatype    | String                                                                          |
| Dataclass   | Scalar                                                                          |
| Examples    | example.com                                                                     |

#### `xdm.source.identity.clean_trimmed_domain_name`

|             |                                                                                         |
| ----------- | --------------------------------------------------------------------------------------- |
| Description | The clean trimmed domain name to which the identity who initiated the activity belongs. |
| Datatype    | String                                                                                  |
| Dataclass   | Scalar                                                                                  |
| Examples    | example                                                                                 |

#### `xdm.source.identity.is_password_changeable`

|             |                                                                                |
| ----------- | ------------------------------------------------------------------------------ |
| Description | Whether the password of the identity who initiated the activity is changeable. |
| Datatype    | Boolean                                                                        |
| Dataclass   | Scalar                                                                         |

#### `xdm.source.identity.is_password_expired`

|             |                                                                              |
| ----------- | ---------------------------------------------------------------------------- |
| Description | Whether the password of the identity who initiated the activity has expired. |
| Datatype    | Boolean                                                                      |
| Dataclass   | Scalar                                                                       |

#### `xdm.source.identity.is_password_required`

|             |                                                                              |
| ----------- | ---------------------------------------------------------------------------- |
| Description | Whether the password of the identity who initiated the activity is required. |
| Datatype    | Boolean                                                                      |
| Dataclass   | Scalar                                                                       |

#### `xdm.source.identity.is_disabled`

|             |                                                              |
| ----------- | ------------------------------------------------------------ |
| Description | Whether the identity who initiated the activity is disabled. |
| Datatype    | Boolean                                                      |
| Dataclass   | Scalar                                                       |

#### `xdm.source.identity.groups`

|             |                                                                      |
| ----------- | -------------------------------------------------------------------- |
| Description | The groups to which the identity who initiated the activity belongs. |
| Datatype    | String                                                               |
| Dataclass   | Array                                                                |

#### `xdm.source.identity.roles`

|             |                                                           |
| ----------- | --------------------------------------------------------- |
| Description | Current roles of the identity who initiated the activity. |
| Datatype    | String                                                    |
| Dataclass   | Array                                                     |

#### `xdm.source.identity.identity_type`

|             |                                                                                                                                                                                 |
| ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Description | The identity type of the identity who initiated the activity (auto-enriched field).                                                                                             |
| Datatype    | [`XDM_CONST.IDENTITY_TYPE`](/xsiam-data-model-schema/consts/identity-type.md)                                                                                                   |
| Dataclass   | Scalar                                                                                                                                                                          |
| Examples    | XDM\_CONST.IDENTITY\_TYPE\_MACHINE, XDM\_CONST.IDENTITY\_TYPE\_USER, XDM\_CONST.IDENTITY\_TYPE\_BUILTIN, XDM\_CONST.IDENTITY\_TYPE\_VIRTUAL, XDM\_CONST.IDENTITY\_TYPE\_UNKNOWN |

#### `xdm.source.identity.netbios_domain`

|             |                                                                                                                                                                                                                                 |
| ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Description | The subdomain of the identity who initiated the activity's DNS domain name. See <https://docs.microsoft.com/en-us/exchange/disjoint-namespace-scenarios-exchange-2013-help#dns-and-netbios-domain-names> (auto-enriched field). |
| Datatype    | String                                                                                                                                                                                                                          |
| Dataclass   | Scalar                                                                                                                                                                                                                          |
| Examples    | mycompany                                                                                                                                                                                                                       |

#### `xdm.source.identity.sam_account_name`

|             |                                                                                                                                                                            |
| ----------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Description | The logon name of the identity who initiated the activity. See <https://docs.microsoft.com/en-us/windows/win32/ad/naming-properties#samaccountname> (auto-enriched field). |
| Datatype    | String                                                                                                                                                                     |
| Dataclass   | Scalar                                                                                                                                                                     |
| Examples    | jondoe                                                                                                                                                                     |

#### `xdm.source.identity.upn`

|             |                                                                                                                                                                                   |
| ----------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Description | The principal name of the identity who initiated the activity. See <https://docs.microsoft.com/en-us/windows/win32/ad/naming-properties#userprincipalname> (auto-enriched field). |
| Datatype    | String                                                                                                                                                                            |
| Dataclass   | Scalar                                                                                                                                                                            |
| Examples    | <jon.doe@mycompany.com>                                                                                                                                                           |

#### `xdm.source.identity.scope`

|             |                                                                                                                                                                  |
| ----------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Description | The scope of the identity who initiated the activity (auto-enriched field).                                                                                      |
| Datatype    | [`XDM_CONST.SCOPE_TYPE`](/xsiam-data-model-schema/consts/scope-type.md)                                                                                          |
| Dataclass   | Scalar                                                                                                                                                           |
| Examples    | XDM\_CONST.SCOPE\_TYPE\_LOCAL, XDM\_CONST.SCOPE\_TYPE\_DOMAIN, XDM\_CONST.SCOPE\_TYPE\_AZURE, XDM\_CONST.SCOPE\_TYPE\_MICROSOFT, XDM\_CONST.SCOPE\_TYPE\_UNKNOWN |

#### `xdm.source.identity.dn`

|             |                                                                    |
| ----------- | ------------------------------------------------------------------ |
| Description | The distinguished name of the identity who initiated the activity. |
| Datatype    | String                                                             |
| Dataclass   | Scalar                                                             |

#### `xdm.source.identity.service_principal_names`

|             |                                                                                                     |
| ----------- | --------------------------------------------------------------------------------------------------- |
| Description | An array of Service Principal Names (SPNs) associated with the identity who initiated the activity. |
| Datatype    | String                                                                                              |
| Dataclass   | Array                                                                                               |

#### `xdm.source.identity.os`

|             |                                                                                              |
| ----------- | -------------------------------------------------------------------------------------------- |
| Description | The specific operating system of the identity who initiated the activity, including version. |
| Datatype    | String                                                                                       |
| Dataclass   | Scalar                                                                                       |

#### `xdm.source.identity.creation_time`

|             |                                                              |
| ----------- | ------------------------------------------------------------ |
| Description | The creation time of the identity who initiated the activity |
| Datatype    | UnixMillis                                                   |
| Dataclass   | Scalar                                                       |

#### `xdm.source.identity.password_last_set`

|             |                                                                                    |
| ----------- | ---------------------------------------------------------------------------------- |
| Description | The time when password of the identity who initiated the activity was last changed |
| Datatype    | UnixMillis                                                                         |
| Dataclass   | Scalar                                                                             |

#### `xdm.source.identity.is_password_never_expire`

|             |                                                                                |
| ----------- | ------------------------------------------------------------------------------ |
| Description | Whether the password of the identity who initiated the activity never expires. |
| Datatype    | Boolean                                                                        |
| Dataclass   | Scalar                                                                         |

#### `xdm.source.identity.has_admin_permissions`

|             |                                                    |
| ----------- | -------------------------------------------------- |
| Description | Does the identity have administrative permissions. |
| Datatype    | Boolean                                            |
| Dataclass   | Scalar                                             |

#### `xdm.source.identity.can_impersonate`

|             |                                                                                                                                            |
| ----------- | ------------------------------------------------------------------------------------------------------------------------------------------ |
| Description | Indicates whether the Azure Entra ID user can impersonate app registrations (This attribute is based on the actions assigned to the user). |
| Datatype    | Boolean                                                                                                                                    |
| Dataclass   | Scalar                                                                                                                                     |

#### `xdm.source.identity.app_registrations_ids`

|             |                                                                                                                                          |
| ----------- | ---------------------------------------------------------------------------------------------------------------------------------------- |
| Description | List of Azure app registrations ids that the user owns.                                                                                  |
| Datatype    | String                                                                                                                                   |
| Dataclass   | Array                                                                                                                                    |
| Examples    | \["mj87tufnb3736dbcnjedid84hfnsdhsaos0sksksks898sdgtegwtwqgafdatsdg","1wsdcgtyh76656yhjui980oi98ijnndhd74hjfdkjkk8jdnssksw3jsjhddsw35t"] |

#### `xdm.source.identity.email`

|             |                                                          |
| ----------- | -------------------------------------------------------- |
| Description | The email address of the identity (auto-enriched field). |
| Datatype    | String                                                   |
| Dataclass   | Scalar                                                   |
| Examples    | <jon.doe@mycompany.com>                                  |

#### `xdm.source.identity.last_login`

|             |                        |
| ----------- | ---------------------- |
| Description | The time of last login |
| Datatype    | UnixMillis             |
| Dataclass   | Scalar                 |

#### `xdm.source.identity.last_used`

|             |                        |
| ----------- | ---------------------- |
| Description | The time of last login |
| Datatype    | UnixMillis             |
| Dataclass   | Scalar                 |

#### `xdm.source.identity.has_mfa`

|             |                                |
| ----------- | ------------------------------ |
| Description | Does the user have MFA enabled |
| Datatype    | Boolean                        |
| Dataclass   | Scalar                         |

#### `xdm.source.identity.is_federated`

|             |                                    |
| ----------- | ---------------------------------- |
| Description | Whether the identity is federated. |
| Datatype    | Boolean                            |
| Dataclass   | Scalar                             |

#### `xdm.source.identity.is_guest`

|             |                                |
| ----------- | ------------------------------ |
| Description | Whether the identity is guest. |
| Datatype    | Boolean                        |
| Dataclass   | Scalar                         |

#### `xdm.source.identity.access_to_services`

|             |                                          |
| ----------- | ---------------------------------------- |
| Description | Which services this identity can access. |
| Datatype    | String                                   |
| Dataclass   | Array                                    |
| Examples    | S3, blob, GKE                            |

#### `xdm.source.identity.number_of_roles`

|             |                                          |
| ----------- | ---------------------------------------- |
| Description | Number of roles the identity can assume. |
| Datatype    | Number                                   |
| Dataclass   | Scalar                                   |

#### `xdm.source.identity.number_of_policies`

|             |                             |
| ----------- | --------------------------- |
| Description | Number of attached policies |
| Datatype    | Number                      |
| Dataclass   | Scalar                      |

#### `xdm.source.identity.number_of_bounded_identities`

|             |                                                          |
| ----------- | -------------------------------------------------------- |
| Description | How many identities can assume this role or bound to it. |
| Datatype    | Number                                                   |
| Dataclass   | Scalar                                                   |

#### `xdm.source.identity.account_access`

|             |                                                                                                                                                                                                                                                                                          |
| ----------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Description | The level of access that is granted to this identity.                                                                                                                                                                                                                                    |
| Datatype    | [`XDM_CONST.IDENTITY_ACCOUNT_ACCESS`](/xsiam-data-model-schema/consts/identity-account-access.md)                                                                                                                                                                                        |
| Dataclass   | Array                                                                                                                                                                                                                                                                                    |
| Examples    | XDM\_CONST.IDENTITY\_ACCOUNT\_ACCESS\_SAME\_ACCOUNT, XDM\_CONST.IDENTITY\_ACCOUNT\_ACCESS\_INTERNAL\_KNOWN, XDM\_CONST.IDENTITY\_ACCOUNT\_ACCESS\_INTERNAL\_UNKNOWN, XDM\_CONST.IDENTITY\_ACCOUNT\_ACCESS\_THIRD\_PARTY\_VENDOR, XDM\_CONST.IDENTITY\_ACCOUNT\_ACCESS\_EXTERNAL\_UNKNOWN |

#### `xdm.source.identity.managing_identities_count`

|             |                                                 |
| ----------- | ----------------------------------------------- |
| Description | Number of identities who can manage this asset. |
| Datatype    | Number                                          |
| Dataclass   | Scalar                                          |

#### `xdm.source.identity.last_managed_time`

|             |                                       |
| ----------- | ------------------------------------- |
| Description | The last time this asset was managed. |
| Datatype    | UnixMillis                            |
| Dataclass   | Scalar                                |

#### `xdm.source.identity.sid`

|             |                                                                           |
| ----------- | ------------------------------------------------------------------------- |
| Description | The Security Identifier (SID) of the identity who initiated the activity. |
| Datatype    | String                                                                    |
| Dataclass   | Scalar                                                                    |

#### `xdm.source.identity.guid`

|             |                                                             |
| ----------- | ----------------------------------------------------------- |
| Description | The unique GUID of the identity who initiated the activity. |
| Datatype    | String                                                      |
| Dataclass   | Scalar                                                      |

#### `xdm.source.identity.netbios`

|             |                                        |
| ----------- | -------------------------------------- |
| Description | The Legacy short domain/workgroup name |
| Datatype    | String                                 |
| Dataclass   | Scalar                                 |

#### `xdm.source.identity.netbios_sam_account_name`

|             |                                                 |
| ----------- | ----------------------------------------------- |
| Description | The Logon name in netbios sam account name form |
| Datatype    | String                                          |
| Dataclass   | Scalar                                          |

#### `xdm.source.identity.access_levels`

|             |                                                                                                                                                                                                                               |
| ----------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Description | The level of access that is granted to this identity                                                                                                                                                                          |
| Datatype    | [`XDM_CONST.IDENTITY_ACCESS_LEVEL`](/xsiam-data-model-schema/consts/identity-access-level.md)                                                                                                                                 |
| Dataclass   | Array                                                                                                                                                                                                                         |
| Examples    | XDM\_CONST.IDENTITY\_ACCESS\_LEVEL\_READ, XDM\_CONST.IDENTITY\_ACCESS\_LEVEL\_WRITE, XDM\_CONST.IDENTITY\_ACCESS\_LEVEL\_LIST, XDM\_CONST.IDENTITY\_ACCESS\_LEVEL\_CONFIG, XDM\_CONST.IDENTITY\_ACCESS\_LEVEL\_ADMINISTRATIVE |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/source/identity.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.