Users

Shows you at-a-glance the overall health and status of the Cisco Identity Intelligence integration. If there is an issue, you can pivot to the Sources page to get more information on the error.

Note: Cisco XDR does not provide the health of sources integrated with Cisco Identity Intelligence. To see if there are any issues with Cisco Identity Intelligence integrations, go to your Cisco Identity Intelligence portal or Cisco Security Cloud Control.

Displays the total number of users, users with identity events, and users not using multi-factor authentication (MFA) in your organization.

Use the Search box to filter the users listed in the inventory table according to the text you enter.

Note: The search box is not case-sensitive.

For example:

• Enter “demo” and Cisco XDR filters through all the user information, including display name, login names, emails, and so on. If any of the user information contains the text you entered, that user will appear in the table.
• Enter a partial search, and the table will update in real-time as you type.

Boolean Operators

You can also use the Boolean operators AND, OR, and NOT. They can make each search more precise and save you time.

For example:

• Enter “demo OR Alice” in the search box and the table shows you users that have the word “demo” in their data and users that have the word “Alice” in their data. Entering “demo Alice” generates the same result.
• Enter “demo AND Alice” in the search box and the table shows you users that have both the words “demo” and “Alice” somewhere in their data.
• Enter “NOT demo” in the search box and the table shows you users that do not have the word “demo” in their information.

Another way to filter is to include the criteria in these search categories using the Filters drawer. Click Filters to open the drawer.

The Security section includes the following criteria:

• Identity events

  Check to include the criteria in your filter.

• MFA status
  

  Check Enabled or Disabled to include if users are using multi-factor authentication (MFA) or are not using multi-factor authentication (MFA).

• Trust level

  Check to include the criteria in your filter.

• Trust level last updated

  Select a start and end date to filter by the specified time range.

The Identity section includes the following criteria:

• Value

  You can select multiple user values and if the value is assigned by default or manually.

• Labels

  Select Must Include to include that label in your filter, or conversely Must Exclude.

• Sources

  Select Must Include to include that label in your filter, or conversely Must Exclude.

The Org role section includes the following criteria that you can check to include them in your filter:

• Company

• Department

• Groups

The Activity section includes the following criteria:

• Usage location

  Check to include the criteria in your filter.

• Status

  Check to include the criteria in your filter.

• Last logon

  Select a start and end date to filter by the specified time range.

• Last Active

  Select a start and end date to filter by the specified time range.

• Account created

  Select a start and end date to filter by the specified time range.

Checks Across Multiple Categories

A filter with checks across multiple categories results in a Boolean AND operation. For example, this filter results in the table showing only the users that meet all the specified conditions:

• Search

  have the text “qa” somewhere in their information

• MFA status

  is Enabled

• Sources

  must include Entra ID

Checks Within a Category

Multiple checks within the same category results in a Boolean OR operation in that category. For example, this filter results in the table showing all the users from Entra ID that have MFA enabled or disabled:

• Sources

  must include Entra ID

• MFA status

  is Enabled

• MFA status

  is Disabled

You can scroll the list of users using the scroll bar on the page or the up and down arrow keys on your keyboard. You can also edit the number of rows shown per page at the bottom of the table.

Note: If you have a large number of users, selecting the last page of the table will cause a loading error to occur. Use filters to reduce the number of users in the table to avoid the error.

Click the (Sort) icon next to the column headers to sort the table by that column in ascending or descending order.

To reorder the table columns, click and drag a column header to the desired position in the table.

Click the (Settings) icon to open the Select columns drawer and check the check boxes next to the columns you want displayed in the table.

To create a label:

1. Click Edit Labels to open the drawer.

2. Click Add Label.

3. Enter a name and select a color for the new label.

4. Click the (Add) icon.
   The new label will be added to the drawer with a (New) tag.

5. Click Apply Changes to confirm all actions in the drawer.

Use the Search Labels text box at the top of the drawer to locate specific labels within the list. The labels that match your search are displayed in the drawer.

To edit a label:

1. Click Edit Labels to open the drawer.

2. Click the (Ellipsis) icon to open the Options menu.

3. Choose Edit.

4. Update the label name or color.

5. Click Apply Changes to confirm all actions in the drawer.

To delete a label:

1. Click Edit Labels to open the drawer.

2. Click the (Ellipsis) icon to open the Options menu.

3. Choose Delete.
   The label will have a (Deleted) tag in the drawer.

4. Click Apply Changes.

5. Click Delete to confirm.

Note: Deleting a label will remove it from all assigned users.

To create a rule from search criteria:

1. Click Rules to open the drawer.

2. Click the Add Rule drop-down menu.

3. Choose Create Rule from Search. The Create Rule section opens with the criteria used in the Filters drawer.

4. Enter a name and description for the rule.

5. Edit the rule criteria if needed. For more information, see Filters.

6. Assign labels and a user value to apply to each user in the selected rule criteria.

7. Click Create.
   A success message is displayed, and the drawer refreshes with the rule added.

To create a rule from scratch:

1. Click Rules to open the drawer.

2. Click the Add Rule drop-down menu.

3. Choose Create Rule from Scratch. The Create Rule section opens.

4. Enter a name and description for the rule.

5. Add the rule criteria. For more information, see Filters.

6. Assign labels and a user value to apply to each device in the selected rule criteria.

7. Click Create.
   A success message is displayed, and the drawer refreshes with the rule added.

To edit existing rules:

1. Click Rules to open the drawer.

2. Click the (Ellipsis) icon to open the Options menu for the rule you want to edit.

3. Choose Edit.

4. Edit the rule.

5. Click Save when done.
   A success message is displayed, and the drawer refreshes.

To enable or disable a rule:

1. Click Rules to open the drawer.

2. Click the toggle for the rule you want to enable or disable.

3. Click Enable or Disable to confirm.
   A success message is displayed, and the drawer refreshes.

Note: Deleting rules is permanent and cannot be undone. All users affected by the deleted rule will revert to their default value and label.

To delete a rule:

1. Click Rules to open the drawer.

2. Click the (Ellipsis) icon to open the Options menu for the rule you want to delete.

3. Choose Delete.

4. Click Delete to confirm.
   A success message is displayed, and the drawer refreshes with the rule removed.

To update the labels for one or more users:

1. Check the check boxes next to the users you want to update.

2. Click the Update Labels drop-down menu in the bulk action bar and choose the new labels.
   

3. Click Add.

To update the labels for one or more users:

1. Check the check boxes next to the users you want to update.
   

2. Click the Update Labels drop-down menu in the bulk action bar and choose the labels you want to remove.

3. Click Remove.

Note: Rule assigned labels cannot be removed.