User details in XDR

[Shahwaz_Md]

Hi, 

We can see user details are not getting captured in the XDR endpoints details, how does logged-in user details are captured?

Thanks

[PiyushKohli]

Hi @Shahwaz_Md 

If you are referring to Users field in All Endpoints under this field you will see username of the user, if user is logged into the endpoint. If in case user is not logged in on the endpoint the entry in User field will be blank.

Hope this helps!

Thanks

[Shahwaz_Md]

even though users are logging in regularly the user field remains blank.

How does this exactly get captured - Is there a time frame or any other criteria.

[PiyushKohli]

Hi @Shahwaz_Md 

Yes since this data is related to telemetry and this change/update can occur when Cortex XDR receives a periodic status report from the agent (once an hour), a user performed a manual Check In, or a security event occurred.
You may also refer to below Agent-Initiated Communication for the same.
Ref: here

Thanks