topic Re: User details in XDR in Cortex XDR Discussions

User details in XDR

Shahwaz_Md — Fri, 07 Jul 2023 03:57:34 GMT

Hi,

We can see user details are not getting captured in the XDR endpoints details, how does logged-in user details are captured?

Thanks

Re: User details in XDR

PiyushKohli — Fri, 07 Jul 2023 05:12:36 GMT

Hi @Shahwaz_Md

If you are referring to Users field in All Endpoints under this field you will see username of the user, if user is logged into the endpoint. If in case user is not logged in on the endpoint the entry in User field will be blank.

Hope this helps!

Thanks

Re: User details in XDR

Shahwaz_Md — Fri, 07 Jul 2023 05:14:21 GMT

even though users are logging in regularly the user field remains blank.

How does this exactly get captured - Is there a time frame or any other criteria.

Re: User details in XDR

PiyushKohli — Fri, 07 Jul 2023 07:14:42 GMT

Hi @Shahwaz_Md

Yes since this data is related to telemetry and this change/update can occur when Cortex XDR receives a periodic status report from the agent (once an hour), a user performed a manual Check In, or a security event occurred.
You may also refer to below Agent-Initiated Communication for the same.
Ref: here

Thanks