Enriching the username properties

[tmeksik]

Hi team

Is it possible to configure XDR to display extra attributes on a few places - namely:

* User information under "Key Assets & Artifacts" in each incident

* Displayed name on the user card

XDR chose to display the SAM account name (i.e. the <Domain name>\<username>) in those places. Basically I'd like to know if we can have the first name and last name displayed instead or have them displayed along side each other. For some of our clients, the Sam account names are some initials which mean nothing to them at a glance.

We have CIE sync'ed with the on-prem AD, meaning we should have all required telemetry to pull up such data.

Thanks!

[aspatil]

Hello,

Thank you for writing to Live community.

The given format is the official one which is mentioned in our article as well.

• Name—Unique ID of the user. The queries used for the widgets in this view are based on the normalized user name, in the format <company domain>\<user name>, and the email address.

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Investigate...

In case if you need First and Last name, Please feel free to open a TAC case and raise a feature request for the same.

Hope this helps!

Please mark the response as "Accept as Solution" if it answers your query.

Regards.