> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/target/identity.md). # xdm.target.identity The target identity. | | | | --------- | ----------------- | | Datatype | Compound.Identity | | Dataclass | Compound | ## Field groups * [`xdm.target.identity.idp`](/xsiam-data-model-schema/fields/target/identity/idp.md) * [`xdm.target.identity.app_registration`](/xsiam-data-model-schema/fields/target/identity/app-registration.md) * [`xdm.target.identity.group`](/xsiam-data-model-schema/fields/target/identity/group.md) * [`xdm.target.identity.policy`](/xsiam-data-model-schema/fields/target/identity/policy.md) * [`xdm.target.identity.secret`](/xsiam-data-model-schema/fields/target/identity/secret.md) * [`xdm.target.identity.access_keys`](/xsiam-data-model-schema/fields/target/identity/access-keys.md) * [`xdm.target.identity.access_statistics`](/xsiam-data-model-schema/fields/target/identity/access-statistics.md) * [`xdm.target.identity.key_management`](/xsiam-data-model-schema/fields/target/identity/key-management.md) ## Fields #### `xdm.target.identity.user_type` | | | | ----------- | ---------------------------------------------------------------------------------------------------------------- | | Description | The type of the target identity. | | Datatype | [`XDM_CONST.USER_TYPE`](/xsiam-data-model-schema/consts/user-type.md) | | Dataclass | Scalar | | Examples | XDM\_CONST.USER\_TYPE\_REGULAR, XDM\_CONST.USER\_TYPE\_SERVICE\_ACCOUNT, XDM\_CONST.USER\_TYPE\_MACHINE\_ACCOUNT | #### `xdm.target.identity.identifier` | | | | ----------- | --------------------------------------------------------------------------------------------------- | | Description | The ID of the user, such as GUID, SID or any other ID that uniquely identifies the target identity. | | Datatype | String | | Dataclass | Scalar | #### `xdm.target.identity.username` | | | | ----------- | ------------------------------------------------------------- | | Description | The user name used for identification of the target identity. | | Datatype | String | | Dataclass | Scalar | #### `xdm.target.identity.first_name` | | | | ----------- | -------------------------------------- | | Description | The first name of the target identity. | | Datatype | String | | Dataclass | Scalar | #### `xdm.target.identity.last_name` | | | | ----------- | ------------------------------------- | | Description | The last name of the target identity. | | Datatype | String | | Dataclass | Scalar | #### `xdm.target.identity.middle_name` | | | | ----------- | --------------------------------------- | | Description | The middle name of the target identity. | | Datatype | String | | Dataclass | Scalar | #### `xdm.target.identity.employee_id` | | | | ----------- | --------------------------------------- | | Description | The employee ID of the target identity. | | Datatype | String | | Dataclass | Scalar | #### `xdm.target.identity.badge_id` | | | | ----------- | ----------------------------------------- | | Description | The work badge ID of the target identity. | | Datatype | String | | Dataclass | Scalar | #### `xdm.target.identity.ou` | | | | ----------- | --------------------------------------------- | | Description | The organization unit of the target identity. | | Datatype | String | | Dataclass | Scalar | #### `xdm.target.identity.title` | | | | ----------- | -------------------------------------- | | Description | The work title of the target identity. | | Datatype | String | | Dataclass | Scalar | | Examples | Sr Staff Engineer Software | #### `xdm.target.identity.location` | | | | ----------- | ----------------------------------------- | | Description | The work location of the target identity. | | Datatype | String | | Dataclass | Scalar | | Examples | Office - Israel - Tel Aviv | #### `xdm.target.identity.employee_type` | | | | ----------- | ----------------------------------------- | | Description | The employee type of the target identity. | | Datatype | String | | Dataclass | Scalar | | Examples | EMPLOYEE, CONTRACTOR | #### `xdm.target.identity.domain` | | | | ----------- | ------------------------------------------------ | | Description | The domain to which the target identity belongs. | | Datatype | String | | Dataclass | Scalar | #### `xdm.target.identity.full_domain_name` | | | | ----------- | ---------------------------------------------------------- | | Description | The full domain name to which the target identity belongs. | | Datatype | String | | Dataclass | Scalar | | Examples | example.onmicrosoft.com | #### `xdm.target.identity.clean_domain_name` | | | | ----------- | ----------------------------------------------------------- | | Description | The clean domain name to which the target identity belongs. | | Datatype | String | | Dataclass | Scalar | | Examples | example.com | #### `xdm.target.identity.clean_trimmed_domain_name` | | | | ----------- | ------------------------------------------------------------------- | | Description | The clean trimmed domain name to which the target identity belongs. | | Datatype | String | | Dataclass | Scalar | | Examples | example | #### `xdm.target.identity.is_password_changeable` | | | | ----------- | ---------------------------------------------------------- | | Description | Whether the password of the target identity is changeable. | | Datatype | Boolean | | Dataclass | Scalar | #### `xdm.target.identity.is_password_expired` | | | | ----------- | -------------------------------------------------------- | | Description | Whether the password of the target identity has expired. | | Datatype | Boolean | | Dataclass | Scalar | #### `xdm.target.identity.is_password_required` | | | | ----------- | -------------------------------------------------------- | | Description | Whether the password of the target identity is required. | | Datatype | Boolean | | Dataclass | Scalar | #### `xdm.target.identity.is_disabled` | | | | ----------- | ---------------------------------------- | | Description | Whether the target identity is disabled. | | Datatype | Boolean | | Dataclass | Scalar | #### `xdm.target.identity.groups` | | | | ----------- | ------------------------------------------------ | | Description | The groups to which the target identity belongs. | | Datatype | String | | Dataclass | Array | #### `xdm.target.identity.roles` | | | | ----------- | ------------------------------------- | | Description | Current roles of the target identity. | | Datatype | String | | Dataclass | Array | #### `xdm.target.identity.identity_type` | | | | ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Description | The identity type of the target identity (auto-enriched field). | | Datatype | [`XDM_CONST.IDENTITY_TYPE`](/xsiam-data-model-schema/consts/identity-type.md) | | Dataclass | Scalar | | Examples | XDM\_CONST.IDENTITY\_TYPE\_MACHINE, XDM\_CONST.IDENTITY\_TYPE\_USER, XDM\_CONST.IDENTITY\_TYPE\_BUILTIN, XDM\_CONST.IDENTITY\_TYPE\_VIRTUAL, XDM\_CONST.IDENTITY\_TYPE\_UNKNOWN | #### `xdm.target.identity.netbios_domain` | | | | ----------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Description | The subdomain of the target identity's DNS domain name. See (auto-enriched field). | | Datatype | String | | Dataclass | Scalar | | Examples | mycompany | #### `xdm.target.identity.sam_account_name` | | | | ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ | | Description | The logon name of the target identity. See (auto-enriched field). | | Datatype | String | | Dataclass | Scalar | | Examples | jondoe | #### `xdm.target.identity.upn` | | | | ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Description | The principal name of the target identity. See (auto-enriched field). | | Datatype | String | | Dataclass | Scalar | | Examples | | #### `xdm.target.identity.scope` | | | | ----------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Description | The scope of the target identity (auto-enriched field). | | Datatype | [`XDM_CONST.SCOPE_TYPE`](/xsiam-data-model-schema/consts/scope-type.md) | | Dataclass | Scalar | | Examples | XDM\_CONST.SCOPE\_TYPE\_LOCAL, XDM\_CONST.SCOPE\_TYPE\_DOMAIN, XDM\_CONST.SCOPE\_TYPE\_AZURE, XDM\_CONST.SCOPE\_TYPE\_MICROSOFT, XDM\_CONST.SCOPE\_TYPE\_UNKNOWN | #### `xdm.target.identity.dn` | | | | ----------- | ---------------------------------------------- | | Description | The distinguished name of the target identity. | | Datatype | String | | Dataclass | Scalar | #### `xdm.target.identity.service_principal_names` | | | | ----------- | ------------------------------------------------------------------------------- | | Description | An array of Service Principal Names (SPNs) associated with the target identity. | | Datatype | String | | Dataclass | Array | #### `xdm.target.identity.os` | | | | ----------- | ------------------------------------------------------------------------ | | Description | The specific operating system of the target identity, including version. | | Datatype | String | | Dataclass | Scalar | #### `xdm.target.identity.creation_time` | | | | ----------- | ---------------------------------------- | | Description | The creation time of the target identity | | Datatype | UnixMillis | | Dataclass | Scalar | #### `xdm.target.identity.password_last_set` | | | | ----------- | -------------------------------------------------------------- | | Description | The time when password of the target identity was last changed | | Datatype | UnixMillis | | Dataclass | Scalar | #### `xdm.target.identity.is_password_never_expire` | | | | ----------- | ---------------------------------------------------------- | | Description | Whether the password of the target identity never expires. | | Datatype | Boolean | | Dataclass | Scalar | #### `xdm.target.identity.has_admin_permissions` | | | | ----------- | -------------------------------------------------- | | Description | Does the identity have administrative permissions. | | Datatype | Boolean | | Dataclass | Scalar | #### `xdm.target.identity.can_impersonate` | | | | ----------- | ------------------------------------------------------------------------------------------------------------------------------------------ | | Description | Indicates whether the Azure Entra ID user can impersonate app registrations (This attribute is based on the actions assigned to the user). | | Datatype | Boolean | | Dataclass | Scalar | #### `xdm.target.identity.app_registrations_ids` | | | | ----------- | ---------------------------------------------------------------------------------------------------------------------------------------- | | Description | List of Azure app registrations ids that the user owns. | | Datatype | String | | Dataclass | Array | | Examples | \["mj87tufnb3736dbcnjedid84hfnsdhsaos0sksksks898sdgtegwtwqgafdatsdg","1wsdcgtyh76656yhjui980oi98ijnndhd74hjfdkjkk8jdnssksw3jsjhddsw35t"] | #### `xdm.target.identity.email` | | | | ----------- | -------------------------------------------------------- | | Description | The email address of the identity (auto-enriched field). | | Datatype | String | | Dataclass | Scalar | | Examples | | #### `xdm.target.identity.last_login` | | | | ----------- | ---------------------- | | Description | The time of last login | | Datatype | UnixMillis | | Dataclass | Scalar | #### `xdm.target.identity.last_used` | | | | ----------- | ---------------------- | | Description | The time of last login | | Datatype | UnixMillis | | Dataclass | Scalar | #### `xdm.target.identity.has_mfa` | | | | ----------- | ------------------------------ | | Description | Does the user have MFA enabled | | Datatype | Boolean | | Dataclass | Scalar | #### `xdm.target.identity.is_federated` | | | | ----------- | ---------------------------------- | | Description | Whether the identity is federated. | | Datatype | Boolean | | Dataclass | Scalar | #### `xdm.target.identity.is_guest` | | | | ----------- | ------------------------------ | | Description | Whether the identity is guest. | | Datatype | Boolean | | Dataclass | Scalar | #### `xdm.target.identity.access_to_services` | | | | ----------- | ---------------------------------------- | | Description | Which services this identity can access. | | Datatype | String | | Dataclass | Array | | Examples | S3, blob, GKE | #### `xdm.target.identity.number_of_roles` | | | | ----------- | ---------------------------------------- | | Description | Number of roles the identity can assume. | | Datatype | Number | | Dataclass | Scalar | #### `xdm.target.identity.number_of_policies` | | | | ----------- | --------------------------- | | Description | Number of attached policies | | Datatype | Number | | Dataclass | Scalar | #### `xdm.target.identity.number_of_bounded_identities` | | | | ----------- | -------------------------------------------------------- | | Description | How many identities can assume this role or bound to it. | | Datatype | Number | | Dataclass | Scalar | #### `xdm.target.identity.account_access` | | | | ----------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Description | The level of access that is granted to this identity. | | Datatype | [`XDM_CONST.IDENTITY_ACCOUNT_ACCESS`](/xsiam-data-model-schema/consts/identity-account-access.md) | | Dataclass | Array | | Examples | XDM\_CONST.IDENTITY\_ACCOUNT\_ACCESS\_SAME\_ACCOUNT, XDM\_CONST.IDENTITY\_ACCOUNT\_ACCESS\_INTERNAL\_KNOWN, XDM\_CONST.IDENTITY\_ACCOUNT\_ACCESS\_INTERNAL\_UNKNOWN, XDM\_CONST.IDENTITY\_ACCOUNT\_ACCESS\_THIRD\_PARTY\_VENDOR, XDM\_CONST.IDENTITY\_ACCOUNT\_ACCESS\_EXTERNAL\_UNKNOWN | #### `xdm.target.identity.managing_identities_count` | | | | ----------- | ----------------------------------------------- | | Description | Number of identities who can manage this asset. | | Datatype | Number | | Dataclass | Scalar | #### `xdm.target.identity.last_managed_time` | | | | ----------- | ------------------------------------- | | Description | The last time this asset was managed. | | Datatype | UnixMillis | | Dataclass | Scalar | #### `xdm.target.identity.sid` | | | | ----------- | ----------------------------------------------------- | | Description | The Security Identifier (SID) of the target identity. | | Datatype | String | | Dataclass | Scalar | #### `xdm.target.identity.guid` | | | | ----------- | --------------------------------------- | | Description | The unique GUID of the target identity. | | Datatype | String | | Dataclass | Scalar | #### `xdm.target.identity.netbios` | | | | ----------- | -------------------------------------- | | Description | The Legacy short domain/workgroup name | | Datatype | String | | Dataclass | Scalar | #### `xdm.target.identity.netbios_sam_account_name` | | | | ----------- | ----------------------------------------------- | | Description | The Logon name in netbios sam account name form | | Datatype | String | | Dataclass | Scalar | #### `xdm.target.identity.access_levels` | | | | ----------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Description | The level of access that is granted to this identity | | Datatype | [`XDM_CONST.IDENTITY_ACCESS_LEVEL`](/xsiam-data-model-schema/consts/identity-access-level.md) | | Dataclass | Array | | Examples | XDM\_CONST.IDENTITY\_ACCESS\_LEVEL\_READ, XDM\_CONST.IDENTITY\_ACCESS\_LEVEL\_WRITE, XDM\_CONST.IDENTITY\_ACCESS\_LEVEL\_LIST, XDM\_CONST.IDENTITY\_ACCESS\_LEVEL\_CONFIG, XDM\_CONST.IDENTITY\_ACCESS\_LEVEL\_ADMINISTRATIVE | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/target/identity.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.