434 Sentinel 6.1 User Guidenovdocx (en) 7 January 2010NOTE: To find a match, the event fields and map key fields must match exactly. This may requiremodifications to existing Collectors to “identity enable” them to parse or concatenate data to makethese fields match the data from the Identity Vault.Once added to the event by the mapping service, these fields are used by correlation rules,remediation actions, and reports in the Identity Tracking Solution Pack. In addition to using thecontent included in the Solution Pack, users can also perform the following actions: Create correlation rules based on identity in addition to account name. This allows you to lookfor similar events from a single user, which provides a more comprehensive view than lookingat events from a single account Create reports that show identity, including all accounts associated with a user Use the Identity Browser to get more information about a user and their activityNOTE: For other identity systems, similar integration can be achieved by writing an identitysynchronization collector that uses the Identity API.18.2 Identity BrowserIdentity Browser in Sentinel allows you to search and view user profiles of the identities in theSentinel database that have been synchronized from the identity management system. In addition toinformation from the identity management system, the Identity Browser also shows recent activityfor the user that has been collected using the Sentinel Collectors.InitUserFullName Full Name Account Name : InitUserNameAuthority : InitUserDomainCustomer Name : MSSPCustomerNameInitUserIdentity Identity GUID Account Name : InitUserNameAuthority : InitUserDomainCustomer Name : MSSPCustomerNameTargetUserDepartment Department Account Name : TargetUserNameAuthority : TargetUserDomainCustomer Name : MSSPCustomerNameTargetUserFullName Full Name Account Name : TargetUserNameAuthority : TargetUserDomainCustomer Name : MSSPCustomerNameTargetUserIdentity Identity GUID Account Name : TargetUserNameAuthority : TargetUserDomainCustomer Name : MSSPCustomerNameLabel Populated by which Columnfrom IdentityAccount Map Map Key Field : Event Label
