Cloud Identity Engine - CIE

[A.Velusamy]

Hi,

Is anyone using Cloud Identity Engine in XSIAM? How useful is it, and could you share your use case and experience?

Thanks

[Vinothkumar_SBA]

Hi @A.Velusamy 

We are currently using Cloud Identity Engine (CIE) in our XSIAM environment, and it has been very useful. One of the main benefits is the additional identity context that becomes visible within incidents and alerts, which helps analysts investigate security events more efficiently.

We have integrated CIE with Active Directory, and it provides valuable visibility into user identities, group memberships, authentication activities, and associated assets. We have also developed correlation rules based on identity-related logs, which help us better understand user activity and improve detection coverage.

In addition to Active Directory, CIE supports integrations with cloud identity providers such as Microsoft Entra ID (Azure AD), Okta, and other identity sources. This enables XSIAM to correlate user activity across both on-premises and cloud environments, providing a more complete identity view.

The identity data collected through CIE is leveraged by XSIAM analytics and detection logic to identify suspicious and anomalous user behavior, such as:

• Unusual authentication patterns
• Privilege escalation activities
• Excessive failed logins
• Impossible travel scenarios
• Abnormal access to sensitive resources
• Suspicious account usage across multiple systems

Overall, we have found CIE to be valuable for:

• Enhanced incident visibility and identity context
• Active Directory, Entra ID, and Okta user activity monitoring
• Identity-based correlation rules and detections
• Improved user-to-asset mapping
• Better detection of suspicious and anomalous behavior
• Faster and more effective incident investigations
• Improved identity threat detection and response (ITDR)
• Better risk-based analysis and user-centric investigations
• Centralized visibility across multiple identity providers

In our experience, enabling CIE significantly improves the quality of investigations by providing richer identity context and helping analysts quickly understand who is behind an activity, what systems they have access to, and whether the observed behavior is normal or potentially malicious.

Please help out other users and “Accept as Solution” if a post helps solve your problem !

Read more about how and why to accept solutions.

Best Regards,
Vinothkumar.C

SBA Info Solutions pvt ltd - Chennai.