Identity-Derived data is augmented by LogRhythm’s Identity feature. If you have configured known identities and have the feature enabled, then these fields are populated with known identity data.
|
Display Field |
Description |
Associated Data Sources |
|---|---|---|
|
User Identity (Origin) |
The identity that has the login in the User (Origin) field associated with it. |
Only matches login Identifier fields |
|
User Identity (Impacted) |
The identity that has the User (Impacted) field associated with it. |
Only matches login Identifier fields |
|
Recipient Identity |
Identity that has the Recipient's email address associated with it. |
Only matches email Identifier fields |
|
Sender Identity |
Identity that has the Sender's email address associated with it. |
Only matches email Identifier fields |