Identities | Insights

What is the Identities page?

The Identities page provides a view into all accounts and identities associated with your connected applications and services.

This page displays accounts ranked by Privilege. Privilege is further broken down into Highest, High, Moderate, Low, None, and Undetermined, based on each identity's administration and access capabilities

ℹ️

You can export the Identities page as a .csv using the Download button.

How is it useful?

The Identities page allows you to view an individual user's potential levels of access and risk and quickly assess mediation based on security recommendations.

An identity's privilege can represent direct administration access or indirect or "shadow" access. Shadow administrators might have role or group permissions elevating their privilege, or otherwise possess powerful entitlements or objects potentially outside the scope of their role.

The Identities page

1. Controls: Use these to quickly filter and search for specific identities.

Controls list

• Name: Type in the Search box to start a search or, optionally, select a filter.

• Email:Type in the Search box to start a search or, optionally, select a filter.

• Type: The list varies and depends on what Insights discovers in the configured environments.

• True Privilege: Enter or select a True Privilege value. True Privilege is the full scope of access an account could potentially gain.

• Has Detections: Select yesor no.

• Has Recommendations:Select yesor no.

• Dormant: The number of days an account has been dormant. Dormant accounts are active accounts that have not been used in 60 or more days.

1. Identities by True Privilege : Shows the total count of identities that have high and highest True Privilege, with the percentage amount of both.
2. Top 5 Identities with the most accounts
3. Identity count tiles

• Risky privileged identities
• Identities with dormant accounts
• Identities with escalations
• Identities with multiple providers

5. Identities grid

Column names

• Name: The name of the identity.

• EmailThe primary email address used by the identity.

• True Privilege: The full scope of privilege the identity could attain: Highest, High, Moderate, Low, None, and Undetermined

• Accounts: The count of accounts held by that identity.

• Key Entitlements:The count of entitlements the identity has access to.

• Detections: The count of detections associated with the identity.

• Recommendations: The count of recommendations associated with the identity.

Search and filter identities

Use the drop-downs under Controls for quick filtering.

To apply an advanced filter to the Identities grid.

1. Select the Applied filters icon from the menu in the top right of the grid. This menu only appears on hover.

2. Select View dashboard filters.

3. Select Add filter.

4. Select a filter from the list. You can also search for a filter.

5. Select the filter again to edit the conditions and values.

6. Select APPLY.

Open identity details

Click any user on the Identities page to open a side panel.

• Overview: View the identity's organizational details and open the True Privilege graph.
• Accounts All the accounts Insights uncovers that are associated with the identity. This tab shows the account source, or connected product or service, as well as the related account name.
• Detections allows you to see what critical resolutions are available to mediate risk.
• Recommendations shows research-backed suggestions for resolving any potential risk vectors with associated accounts.
• Entitlements: The high and highest entitlements the linked accounts hold.
• PathsVisualize the Paths to Privilege the identity could take.

True Privilege

The Identities grid and Identity Details page has a True Privilege column and tag. True Privilege represents the level of access, either direct or indirect, to key entitlements or other high privileged accounts. Access can be gained from misconfigurations or permission inheritance.

True Privilege graph

Open the identity's details by selecting it in the grid. After the side panel opens, click True Privilege Graph.

Switch between graph views by selecting Toggle orientation and Return to original graph. Toggle orientation shows the graph vertically, while the default or "original" view is vertical.

The graph is composed of nodes. Click any node to open a side panel with detailed information.

• Identities: The starting point for the graph, represented by a thumbprint.
• Accounts: The accounts the identity is linked to, represented by a profile.
• Entitlements: The high and highest entitlements the linked accounts hold.
• Escalations: Linked from entitlements via an orange line. Includes users, groups, containers, organizations, computers, policies, and more.

ℹ️

For more information, see Detections and Recommendations.