> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/target/user.md).

# xdm.target.user

The target user.

|           |               |
| --------- | ------------- |
| Datatype  | Compound.User |
| Dataclass | Compound      |

## Field groups

* [`xdm.target.user.idp`](/xsiam-data-model-schema/fields/target/user/idp.md)
* [`xdm.target.user.app_registration`](/xsiam-data-model-schema/fields/target/user/app-registration.md)
* [`xdm.target.user.group`](/xsiam-data-model-schema/fields/target/user/group.md)
* [`xdm.target.user.policy`](/xsiam-data-model-schema/fields/target/user/policy.md)
* [`xdm.target.user.secret`](/xsiam-data-model-schema/fields/target/user/secret.md)
* [`xdm.target.user.access_keys`](/xsiam-data-model-schema/fields/target/user/access-keys.md)
* [`xdm.target.user.access_statistics`](/xsiam-data-model-schema/fields/target/user/access-statistics.md)
* [`xdm.target.user.key_management`](/xsiam-data-model-schema/fields/target/user/key-management.md)

## Fields

#### `xdm.target.user.user_type`

|             |                                                                                                                  |
| ----------- | ---------------------------------------------------------------------------------------------------------------- |
| Description | The type of the target user.                                                                                     |
| Datatype    | [`XDM_CONST.USER_TYPE`](/xsiam-data-model-schema/consts/user-type.md)                                            |
| Dataclass   | Scalar                                                                                                           |
| Examples    | XDM\_CONST.USER\_TYPE\_REGULAR, XDM\_CONST.USER\_TYPE\_SERVICE\_ACCOUNT, XDM\_CONST.USER\_TYPE\_MACHINE\_ACCOUNT |

#### `xdm.target.user.identifier`

|             |                                                                                                 |
| ----------- | ----------------------------------------------------------------------------------------------- |
| Description | The ID of the user, such as GUID, SID or any other ID that uniquely identifies the target user. |
| Datatype    | String                                                                                          |
| Dataclass   | Scalar                                                                                          |

#### `xdm.target.user.username`

|             |                                                           |
| ----------- | --------------------------------------------------------- |
| Description | The user name used for identification of the target user. |
| Datatype    | String                                                    |
| Dataclass   | Scalar                                                    |

#### `xdm.target.user.first_name`

|             |                                    |
| ----------- | ---------------------------------- |
| Description | The first name of the target user. |
| Datatype    | String                             |
| Dataclass   | Scalar                             |

#### `xdm.target.user.last_name`

|             |                                   |
| ----------- | --------------------------------- |
| Description | The last name of the target user. |
| Datatype    | String                            |
| Dataclass   | Scalar                            |

#### `xdm.target.user.middle_name`

|             |                                     |
| ----------- | ----------------------------------- |
| Description | The middle name of the target user. |
| Datatype    | String                              |
| Dataclass   | Scalar                              |

#### `xdm.target.user.employee_id`

|             |                                     |
| ----------- | ----------------------------------- |
| Description | The employee ID of the target user. |
| Datatype    | String                              |
| Dataclass   | Scalar                              |

#### `xdm.target.user.badge_id`

|             |                                       |
| ----------- | ------------------------------------- |
| Description | The work badge ID of the target user. |
| Datatype    | String                                |
| Dataclass   | Scalar                                |

#### `xdm.target.user.ou`

|             |                                           |
| ----------- | ----------------------------------------- |
| Description | The organization unit of the target user. |
| Datatype    | String                                    |
| Dataclass   | Scalar                                    |

#### `xdm.target.user.title`

|             |                                    |
| ----------- | ---------------------------------- |
| Description | The work title of the target user. |
| Datatype    | String                             |
| Dataclass   | Scalar                             |
| Examples    | Sr Staff Engineer Software         |

#### `xdm.target.user.location`

|             |                                       |
| ----------- | ------------------------------------- |
| Description | The work location of the target user. |
| Datatype    | String                                |
| Dataclass   | Scalar                                |
| Examples    | Office - Israel - Tel Aviv            |

#### `xdm.target.user.employee_type`

|             |                                       |
| ----------- | ------------------------------------- |
| Description | The employee type of the target user. |
| Datatype    | String                                |
| Dataclass   | Scalar                                |
| Examples    | EMPLOYEE, CONTRACTOR                  |

#### `xdm.target.user.domain`

|             |                                              |
| ----------- | -------------------------------------------- |
| Description | The domain to which the target user belongs. |
| Datatype    | String                                       |
| Dataclass   | Scalar                                       |

#### `xdm.target.user.full_domain_name`

|             |                                                        |
| ----------- | ------------------------------------------------------ |
| Description | The full domain name to which the target user belongs. |
| Datatype    | String                                                 |
| Dataclass   | Scalar                                                 |
| Examples    | example.onmicrosoft.com                                |

#### `xdm.target.user.clean_domain_name`

|             |                                                         |
| ----------- | ------------------------------------------------------- |
| Description | The clean domain name to which the target user belongs. |
| Datatype    | String                                                  |
| Dataclass   | Scalar                                                  |
| Examples    | example.com                                             |

#### `xdm.target.user.clean_trimmed_domain_name`

|             |                                                                 |
| ----------- | --------------------------------------------------------------- |
| Description | The clean trimmed domain name to which the target user belongs. |
| Datatype    | String                                                          |
| Dataclass   | Scalar                                                          |
| Examples    | example                                                         |

#### `xdm.target.user.is_password_changeable`

|             |                                                        |
| ----------- | ------------------------------------------------------ |
| Description | Whether the password of the target user is changeable. |
| Datatype    | Boolean                                                |
| Dataclass   | Scalar                                                 |

#### `xdm.target.user.is_password_expired`

|             |                                                      |
| ----------- | ---------------------------------------------------- |
| Description | Whether the password of the target user has expired. |
| Datatype    | Boolean                                              |
| Dataclass   | Scalar                                               |

#### `xdm.target.user.is_password_required`

|             |                                                      |
| ----------- | ---------------------------------------------------- |
| Description | Whether the password of the target user is required. |
| Datatype    | Boolean                                              |
| Dataclass   | Scalar                                               |

#### `xdm.target.user.is_disabled`

|             |                                      |
| ----------- | ------------------------------------ |
| Description | Whether the target user is disabled. |
| Datatype    | Boolean                              |
| Dataclass   | Scalar                               |

#### `xdm.target.user.groups`

|             |                                              |
| ----------- | -------------------------------------------- |
| Description | The groups to which the target user belongs. |
| Datatype    | String                                       |
| Dataclass   | Array                                        |

#### `xdm.target.user.roles`

|             |                                   |
| ----------- | --------------------------------- |
| Description | Current roles of the target user. |
| Datatype    | String                            |
| Dataclass   | Array                             |

#### `xdm.target.user.identity_type`

|             |                                                                                                                                                                                 |
| ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Description | The identity type of the target user (auto-enriched field).                                                                                                                     |
| Datatype    | [`XDM_CONST.IDENTITY_TYPE`](/xsiam-data-model-schema/consts/identity-type.md)                                                                                                   |
| Dataclass   | Scalar                                                                                                                                                                          |
| Examples    | XDM\_CONST.IDENTITY\_TYPE\_MACHINE, XDM\_CONST.IDENTITY\_TYPE\_USER, XDM\_CONST.IDENTITY\_TYPE\_BUILTIN, XDM\_CONST.IDENTITY\_TYPE\_VIRTUAL, XDM\_CONST.IDENTITY\_TYPE\_UNKNOWN |

#### `xdm.target.user.netbios_domain`

|             |                                                                                                                                                                                                         |
| ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Description | The subdomain of the target user's DNS domain name. See <https://docs.microsoft.com/en-us/exchange/disjoint-namespace-scenarios-exchange-2013-help#dns-and-netbios-domain-names> (auto-enriched field). |
| Datatype    | String                                                                                                                                                                                                  |
| Dataclass   | Scalar                                                                                                                                                                                                  |
| Examples    | mycompany                                                                                                                                                                                               |

#### `xdm.target.user.sam_account_name`

|             |                                                                                                                                                    |
| ----------- | -------------------------------------------------------------------------------------------------------------------------------------------------- |
| Description | The logon name of the target user. See <https://docs.microsoft.com/en-us/windows/win32/ad/naming-properties#samaccountname> (auto-enriched field). |
| Datatype    | String                                                                                                                                             |
| Dataclass   | Scalar                                                                                                                                             |
| Examples    | jondoe                                                                                                                                             |

#### `xdm.target.user.upn`

|             |                                                                                                                                                           |
| ----------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Description | The principal name of the target user. See <https://docs.microsoft.com/en-us/windows/win32/ad/naming-properties#userprincipalname> (auto-enriched field). |
| Datatype    | String                                                                                                                                                    |
| Dataclass   | Scalar                                                                                                                                                    |
| Examples    | <jon.doe@mycompany.com>                                                                                                                                   |

#### `xdm.target.user.scope`

|             |                                                                                                                                                                  |
| ----------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Description | The scope of the target user (auto-enriched field).                                                                                                              |
| Datatype    | [`XDM_CONST.SCOPE_TYPE`](/xsiam-data-model-schema/consts/scope-type.md)                                                                                          |
| Dataclass   | Scalar                                                                                                                                                           |
| Examples    | XDM\_CONST.SCOPE\_TYPE\_LOCAL, XDM\_CONST.SCOPE\_TYPE\_DOMAIN, XDM\_CONST.SCOPE\_TYPE\_AZURE, XDM\_CONST.SCOPE\_TYPE\_MICROSOFT, XDM\_CONST.SCOPE\_TYPE\_UNKNOWN |

#### `xdm.target.user.dn`

|             |                                            |
| ----------- | ------------------------------------------ |
| Description | The distinguished name of the target user. |
| Datatype    | String                                     |
| Dataclass   | Scalar                                     |

#### `xdm.target.user.service_principal_names`

|             |                                                                             |
| ----------- | --------------------------------------------------------------------------- |
| Description | An array of Service Principal Names (SPNs) associated with the target user. |
| Datatype    | String                                                                      |
| Dataclass   | Array                                                                       |

#### `xdm.target.user.os`

|             |                                                                      |
| ----------- | -------------------------------------------------------------------- |
| Description | The specific operating system of the target user, including version. |
| Datatype    | String                                                               |
| Dataclass   | Scalar                                                               |

#### `xdm.target.user.creation_time`

|             |                                      |
| ----------- | ------------------------------------ |
| Description | The creation time of the target user |
| Datatype    | UnixMillis                           |
| Dataclass   | Scalar                               |

#### `xdm.target.user.password_last_set`

|             |                                                            |
| ----------- | ---------------------------------------------------------- |
| Description | The time when password of the target user was last changed |
| Datatype    | UnixMillis                                                 |
| Dataclass   | Scalar                                                     |

#### `xdm.target.user.is_password_never_expire`

|             |                                                        |
| ----------- | ------------------------------------------------------ |
| Description | Whether the password of the target user never expires. |
| Datatype    | Boolean                                                |
| Dataclass   | Scalar                                                 |

#### `xdm.target.user.has_admin_permissions`

|             |                                                    |
| ----------- | -------------------------------------------------- |
| Description | Does the identity have administrative permissions. |
| Datatype    | Boolean                                            |
| Dataclass   | Scalar                                             |

#### `xdm.target.user.can_impersonate`

|             |                                                                                                                                            |
| ----------- | ------------------------------------------------------------------------------------------------------------------------------------------ |
| Description | Indicates whether the Azure Entra ID user can impersonate app registrations (This attribute is based on the actions assigned to the user). |
| Datatype    | Boolean                                                                                                                                    |
| Dataclass   | Scalar                                                                                                                                     |

#### `xdm.target.user.app_registrations_ids`

|             |                                                                                                                                          |
| ----------- | ---------------------------------------------------------------------------------------------------------------------------------------- |
| Description | List of Azure app registrations ids that the user owns.                                                                                  |
| Datatype    | String                                                                                                                                   |
| Dataclass   | Array                                                                                                                                    |
| Examples    | \["mj87tufnb3736dbcnjedid84hfnsdhsaos0sksksks898sdgtegwtwqgafdatsdg","1wsdcgtyh76656yhjui980oi98ijnndhd74hjfdkjkk8jdnssksw3jsjhddsw35t"] |

#### `xdm.target.user.email`

|             |                                                          |
| ----------- | -------------------------------------------------------- |
| Description | The email address of the identity (auto-enriched field). |
| Datatype    | String                                                   |
| Dataclass   | Scalar                                                   |
| Examples    | <jon.doe@mycompany.com>                                  |

#### `xdm.target.user.last_login`

|             |                        |
| ----------- | ---------------------- |
| Description | The time of last login |
| Datatype    | UnixMillis             |
| Dataclass   | Scalar                 |

#### `xdm.target.user.last_used`

|             |                        |
| ----------- | ---------------------- |
| Description | The time of last login |
| Datatype    | UnixMillis             |
| Dataclass   | Scalar                 |

#### `xdm.target.user.has_mfa`

|             |                                |
| ----------- | ------------------------------ |
| Description | Does the user have MFA enabled |
| Datatype    | Boolean                        |
| Dataclass   | Scalar                         |

#### `xdm.target.user.is_federated`

|             |                                    |
| ----------- | ---------------------------------- |
| Description | Whether the identity is federated. |
| Datatype    | Boolean                            |
| Dataclass   | Scalar                             |

#### `xdm.target.user.is_guest`

|             |                                |
| ----------- | ------------------------------ |
| Description | Whether the identity is guest. |
| Datatype    | Boolean                        |
| Dataclass   | Scalar                         |

#### `xdm.target.user.access_to_services`

|             |                                          |
| ----------- | ---------------------------------------- |
| Description | Which services this identity can access. |
| Datatype    | String                                   |
| Dataclass   | Array                                    |
| Examples    | S3, blob, GKE                            |

#### `xdm.target.user.number_of_roles`

|             |                                          |
| ----------- | ---------------------------------------- |
| Description | Number of roles the identity can assume. |
| Datatype    | Number                                   |
| Dataclass   | Scalar                                   |

#### `xdm.target.user.number_of_policies`

|             |                             |
| ----------- | --------------------------- |
| Description | Number of attached policies |
| Datatype    | Number                      |
| Dataclass   | Scalar                      |

#### `xdm.target.user.number_of_bounded_identities`

|             |                                                          |
| ----------- | -------------------------------------------------------- |
| Description | How many identities can assume this role or bound to it. |
| Datatype    | Number                                                   |
| Dataclass   | Scalar                                                   |

#### `xdm.target.user.account_access`

|             |                                                                                                                                                                                                                                                                                          |
| ----------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Description | The level of access that is granted to this identity.                                                                                                                                                                                                                                    |
| Datatype    | [`XDM_CONST.IDENTITY_ACCOUNT_ACCESS`](/xsiam-data-model-schema/consts/identity-account-access.md)                                                                                                                                                                                        |
| Dataclass   | Array                                                                                                                                                                                                                                                                                    |
| Examples    | XDM\_CONST.IDENTITY\_ACCOUNT\_ACCESS\_SAME\_ACCOUNT, XDM\_CONST.IDENTITY\_ACCOUNT\_ACCESS\_INTERNAL\_KNOWN, XDM\_CONST.IDENTITY\_ACCOUNT\_ACCESS\_INTERNAL\_UNKNOWN, XDM\_CONST.IDENTITY\_ACCOUNT\_ACCESS\_THIRD\_PARTY\_VENDOR, XDM\_CONST.IDENTITY\_ACCOUNT\_ACCESS\_EXTERNAL\_UNKNOWN |

#### `xdm.target.user.managing_identities_count`

|             |                                                 |
| ----------- | ----------------------------------------------- |
| Description | Number of identities who can manage this asset. |
| Datatype    | Number                                          |
| Dataclass   | Scalar                                          |

#### `xdm.target.user.last_managed_time`

|             |                                       |
| ----------- | ------------------------------------- |
| Description | The last time this asset was managed. |
| Datatype    | UnixMillis                            |
| Dataclass   | Scalar                                |

#### `xdm.target.user.sid`

|             |                                                   |
| ----------- | ------------------------------------------------- |
| Description | The Security Identifier (SID) of the target user. |
| Datatype    | String                                            |
| Dataclass   | Scalar                                            |

#### `xdm.target.user.guid`

|             |                                     |
| ----------- | ----------------------------------- |
| Description | The unique GUID of the target user. |
| Datatype    | String                              |
| Dataclass   | Scalar                              |

#### `xdm.target.user.netbios`

|             |                                        |
| ----------- | -------------------------------------- |
| Description | The Legacy short domain/workgroup name |
| Datatype    | String                                 |
| Dataclass   | Scalar                                 |

#### `xdm.target.user.netbios_sam_account_name`

|             |                                                 |
| ----------- | ----------------------------------------------- |
| Description | The Logon name in netbios sam account name form |
| Datatype    | String                                          |
| Dataclass   | Scalar                                          |

#### `xdm.target.user.access_levels`

|             |                                                                                                                                                                                                                               |
| ----------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Description | The level of access that is granted to this identity                                                                                                                                                                          |
| Datatype    | [`XDM_CONST.IDENTITY_ACCESS_LEVEL`](/xsiam-data-model-schema/consts/identity-access-level.md)                                                                                                                                 |
| Dataclass   | Array                                                                                                                                                                                                                         |
| Examples    | XDM\_CONST.IDENTITY\_ACCESS\_LEVEL\_READ, XDM\_CONST.IDENTITY\_ACCESS\_LEVEL\_WRITE, XDM\_CONST.IDENTITY\_ACCESS\_LEVEL\_LIST, XDM\_CONST.IDENTITY\_ACCESS\_LEVEL\_CONFIG, XDM\_CONST.IDENTITY\_ACCESS\_LEVEL\_ADMINISTRATIVE |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/fields/target/user.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.