Skip to main content
Skip table of contents


TrueIdentities in the Web Console represent a collection of identifiers, such as logins and email addresses, that comprise a single identity. For example, the identity Sarah Smith might have two associated logins (sarah.smith and sarah.smith.sup) and one email address ( associated. With Identities, the following series of logs are united under the TrueIdentity Sarah Smith:

First Log DateUser (Origin)User (Origin) IdentityClassificationCommon EventPriority
7/22/2017 21:33sarah.smithSarah SmithAccess GrantedAccount Added to Group13
7/22/2017 21:07sarah.smith_supSarah SmithAccess FailureAccess Object Failure21
7/22/2017 21:05sarah.smithSarah SmithAccess GrantedAccount Added to Group10
7/22/2017 20:58s.smith@gmail.comSarah SmithAuthentication FailureUser Logon Failure: Bad Password19

To manage existing TrueIdentites, and create new TrueIdentities, see the TrueIdentity Sync Client User Guide.

If you have a multi-tenant environment, go to C:\Program Files\LogRhythm\LogRhythm Mediator Server\config, and set the EnableIdentityEntitySegregation parameter in the scmedsvr.ini to True. When configuring Active Directory (AD) synchronization, select the root entity of your Data Processor and Agent hosts that contains the logs and log sources you would like to monitor with CloudAI.

For more information, see the setting information in the Data Processor section of the SIEM Help. and the UEBACAI documentation.

To access the TrueIdentity page, on the top navigation bar, click the Administration icon, and select TrueIdentity.

JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.