User Details

The User Details page shows the data provided by Cisco Identity Intelligence for a user, including used devices, identity events for the user, and details about the user's identity and organization role. Administrators can manually update the User value and Add Labels to the user as well.

User details page in Cisco XDR, showing various identity and activity information.

Shows you a summary of the devices used by this user. If a user has multiple used devices, click View all to see a list of all of the devices. Click on a device to expand the device details drawer. For more information about what is displayed in the drawer, see View Summary of Device Details in Drawer. Cisco XDR provides correlation based on email address and may display used devices from additional integrated sources.

List of devices used by the user, with their last login dates.

Shows you a list of all the identity events from Cisco Identity Intelligence for this user. For more information, go to the Understanding Check failures topic in the Cisco Identity Intelligence Knowledge Base.

Identity events card, showing 'users-sharing-authenticators' and 'weak-mfa' events.

Shows you a summary of the activity details for this user, such as MFA status, location, and applications the user has been seen using.

User activity details showing MFA status as enabled, and used applications including Azure Portal and Microsoft Authentication Broker.

Shows you a summary of the identity details for this user, such as login names, emails, and the user ID.

User identity card, showing display name, login, email, and source.

Shows you a summary of the organization details for this user, such as department name, job title, and the groups assigned to the user in Cisco Identity Intelligence.

Organization role card, showing test user department, testuser job title, and Cisco-SBG group.