Cloud Identity Engine - CIE

A.Velusamy — Fri, 05 Jun 2026 18:18:59 GMT

Hi,

Is anyone using Cloud Identity Engine in XSIAM? How useful is it, and could you share your use case and experience?

Thanks

Re: Cloud Identity Engine - CIE

Vinothkumar_SBA — Mon, 08 Jun 2026 11:40:07 GMT

We are currently using Cloud Identity Engine (CIE) in our XSIAM environment, and it has been very useful. One of the main benefits is the additional identity context that becomes visible within incidents and alerts, which helps analysts investigate security events more efficiently.

We have integrated CIE with Active Directory, and it provides valuable visibility into user identities, group memberships, authentication activities, and associated assets. We have also developed correlation rules based on identity-related logs, which help us better understand user activity and improve detection coverage.

In addition to Active Directory, CIE supports integrations with cloud identity providers such as Microsoft Entra ID (Azure AD), Okta, and other identity sources. This enables XSIAM to correlate user activity across both on-premises and cloud environments, providing a more complete identity view.

The identity data collected through CIE is leveraged by XSIAM analytics and detection logic to identify suspicious and anomalous user behavior, such as:

Unusual authentication patterns
Privilege escalation activities
Excessive failed logins
Impossible travel scenarios
Abnormal access to sensitive resources
Suspicious account usage across multiple systems

Overall, we have found CIE to be valuable for:

Enhanced incident visibility and identity context
Active Directory, Entra ID, and Okta user activity monitoring
Identity-based correlation rules and detections
Improved user-to-asset mapping
Better detection of suspicious and anomalous behavior
Faster and more effective incident investigations
Improved identity threat detection and response (ITDR)
Better risk-based analysis and user-centric investigations
Centralized visibility across multiple identity providers

In our experience, enabling CIE significantly improves the quality of investigations by providing richer identity context and helping analysts quickly understand who is behind an activity, what systems they have access to, and whether the observed behavior is normal or potentially malicious.

Please help out other users and “Accept as Solution” if a post helps solve your problem !

Best Regards,
Vinothkumar.C

SBA Info Solutions pvt ltd - Chennai.

topic Re: Cloud Identity Engine - CIE in Cortex XSIAM Discussions

Cloud Identity Engine - CIE

Re: Cloud Identity Engine - CIE