Identity Browser - Novell SENTINEL 6.1 SP2 - 02-2010 User Manual

Label
InitUserFullName
InitUserIdentity
TargetUserDepartment
TargetUserFullName
TargetUserIdentity
NOTE: To find a match, the event fields and map key fields must match exactly. This may require
modifications to existing Collectors to "identity enable" them to parse or concatenate data to make
these fields match the data from the Identity Vault.
Once added to the event by the mapping service, these fields are used by correlation rules,
remediation actions, and reports in the Identity Tracking Solution Pack. In addition to using the
content included in the Solution Pack, users can also perform the following actions:
Create correlation rules based on identity in addition to account name. This allows you to look

for similar events from a single user, which provides a more comprehensive view than looking
at events from a single account
Create reports that show identity, including all accounts associated with a user

 Use the Identity Browser to get more information about a user and their activity
NOTE: For other identity systems, similar integration can be achieved by writing an identity
synchronization collector that uses the Identity API.

18.2 Identity Browser

Identity Browser in Sentinel allows you to search and view user profiles of the identities in the
Sentinel database that have been synchronized from the identity management system. In addition to
information from the identity management system, the Identity Browser also shows recent activity
for the user that has been collected using the Sentinel Collectors.
434 Sentinel 6.1 User Guide
Populated by which Column
from IdentityAccount Map
Full Name
Identity GUID
Department
Full Name
Identity GUID
Map Key Field : Event Label
Account Name : InitUserName
Authority : InitUserDomain
Customer Name : MSSPCustomerName
Account Name : InitUserName
Authority : InitUserDomain
Customer Name : MSSPCustomerName
Account Name : TargetUserName
Authority : TargetUserDomain
Customer Name : MSSPCustomerName
Account Name : TargetUserName
Authority : TargetUserDomain
Customer Name : MSSPCustomerName
Account Name : TargetUserName
Authority : TargetUserDomain
Customer Name : MSSPCustomerName