User Details

The User Details page shows the data provided by Cisco Identity Intelligence for a user, including used devices, identity events for the user, and details about the user's identity and organization role. Administrators can manually update the User value and Add Labels to the user as well.

User details page in Cisco XDR, showing various identity and activity information.

The Security section of the page displays the following information about the user:

Trust Level

Shows you the user's trust level, the date it was last updated, and the factors affecting trust provided by Identity Intelligence. Click the (Expand) icon to view the additional information that was used to determine the trust level. For more information, go to the User Trust Level topic in the Cisco Identity Intelligence Knowledge Base.

User Posture

Shows you the user's multi-factor authentication status and a list of all the identity events from Identity Intelligence for this user. For more information, go to the Understanding Check failures topic in the Cisco Identity Intelligence Knowledge Base.

Identity events card, showing 'users-sharing-authenticators' and 'weak-mfa' events.

The User Details section of the page displays the following information about the user:

Identity Details

Shows you a summary of the identity details for this user, such as login names, emails, and the user ID.

User identity card, showing display name, login, email, and source.

Devices

Shows you a summary of the devices used by this user. If a user has multiple used devices, click View all to see a list of all of the devices. Click on a device to expand the device details drawer. For more information about what is displayed in the drawer, see View Summary of Device Details in Drawer. Cisco XDR provides correlation based on email address and may display used devices from additional integrated sources.

List of devices used by the user, with their last login dates.

Activity Details

Shows you a summary of the activity details for this user, such as status, location, and when the account was created.

User activity details showing MFA status as enabled, and used applications including Azure Portal and Microsoft Authentication Broker.

Organization Role

Shows you a summary of the organization details for this user, such as department name, job title, and the groups assigned to the user in Cisco Identity Intelligence.

Organization role card, showing test user department, testuser job title, and Cisco-SBG group.'

Seen in Sources

Shows you the Cisco Identity Intelligence sources that provided the user data.

Click the source name to open a drawer that contains all the user data provided by that source.