Identity-Derived Data
Identity-Derived data is augmented by LogRhythm’s Identity feature. If you have configured known identities and have the feature enabled, then these fields are populated with known identity data.
| Display Field | Description | Associated Data Sources |
|---|---|---|
| User Identity (Origin) | The identity that has the login in the User (Origin) field associated with it. | Only matches login Identifier fields |
| User Identity (Impacted) | The identity that has the User (Impacted) field associated with it. | Only matches login Identifier fields |
| Recipient Identity | Identity that has the Recipient's email address associated with it. | Only matches email Identifier fields |
| Sender Identity | Identity that has the Sender's email address associated with it. | Only matches email Identifier fields |