topic Re: Enriching the username properties in Cortex XDR Discussions

Enriching the username properties

tmeksik — Tue, 31 Oct 2023 22:48:45 GMT

Hi team

Is it possible to configure XDR to display extra attributes on a few places - namely:

* User information under "Key Assets & Artifacts" in each incident

* Displayed name on the user card

XDR chose to display the SAM account name (i.e. the <Domain name>\<username>) in those places. Basically I'd like to know if we can have the first name and last name displayed instead or have them displayed along side each other. For some of our clients, the Sam account names are some initials which mean nothing to them at a glance.

We have CIE sync'ed with the on-prem AD, meaning we should have all required telemetry to pull up such data.

Thanks!

Re: Enriching the username properties

aspatil — Wed, 01 Nov 2023 08:07:35 GMT

Hello,

Thank you for writing to Live community.

The given format is the official one which is mentioned in our article as well.

Name—Unique ID of the user. The queries used for the widgets in this view are based on the normalized user name, in the format <company domain>\<user name>, and the email address.

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Investigate-a-User

In case if you need First and Last name, Please feel free to open a TAC case and raise a feature request for the same.

Hope this helps!

Please mark the response as "Accept as Solution" if it answers your query.

Regards.