Identity timeline

What you will do: answer "what did this identity do, where and when" with one query that spans sources, and keep it as a search or a monitor.

An identity timeline is a correlation: every event that names the account, from every source, connected into sessions with a start, an end, a duration and the hosts involved. The platform builds it with TRIX on a normalized account field. Audity's own reports build on the same objects; the wiki does not yet document Audity's screens, so this page shows the mechanics available today.

Sources that carry identity

Give the account column the same field type on every source ({text:Account Name, ftype=accountname}, as the shipped Active Directory App does, or the name your convention uses) so ftype.accountname means the same thing everywhere; see Parse. In the TRIX queries below account stands for the column that carries the account on every source: the wiki documents column names as correlation keys, not ftype. references.

Steps: the timeline

1. Pick the identity and the window in Search: account name = <user> OR user = <user> in app.Identity over the period under review; the Augmented Search pane lists the sources that matched.
2. Correlate into sessions:

* in app.Identity
| trix trix.uniqueIds.fields = (account)
       startRule = (Event Description contains logged on OR message contains session opened)
       endRule = (Event Description contains logged off OR message contains session closed)
       cep.name = (account) cep.groups = (event)
| list cep.id as session, cep.starttime as start in date format, cep.endtime as end in date format, cep.time as duration in time format, cep.eventscount as events, cep.fullstate as state, cep.hosts as hosts
| order by start desc

3. Read the states: CLOSE is a complete session; OPEN has no end event yet; TIME CLOSE or VOLUME CLOSE hit a limit you set; a start without an end after the expected time is the finding.
4. Narrow to what matters: | where cep.groups = 4625 (failed logons), | where cep.hosts contains <server>, | where duration > 28800000 (sessions over eight hours), or the Linux failed-login shape trix trix.uniqueIds.fields = (user+pid) endRule = (message contains Connection closed by invalid user OR Disconnecting invalid user OR Disconnected from invalid) cep.name = User | where cep.endEvent = true.
5. Keep it: save the search with a severity so it becomes a predefined problem in Analytics, or Save Monitor (name, schedule, email), then set its risk level and add alerts — email, Slack, Microsoft Teams, PagerDuty, REST, script, Syslog, Kafka — under Monitors; see Monitoring.
6. Show it: a Transactions widget on an App dashboard, with a User Input for the account; see Dashboards.

Reading the timeline

• One line per session, not per event: open the events behind a session only when its state, duration or host list is unexpected.
• cep.hosts across sources is the cross-source view: a directory logon followed by application access on a host the account never used.
• The platform's own audit log belongs in the same App, so administrator actions in XPLG appear on the same timeline as the systems they touch.

Licensing

The Audity models — Entity Behavior and Cross-source Correlation — meter XMC (XPLG Model Credits) per GB of the LogX Base tier; the evaluation license allows 100 identities. See Models and credits.

Next: Compliance evidence

Source: XPLG wiki, pages 1718583297, 1720057914, 1715994628, 1594132942, 3161751578, 3161718811, 1599570818, 1602192064, 1594131765, 2054684673, 1594130366, 1594130361, 2736095240, 1599143999, 1919418369, 1594130611, 1594133710, 1642397903, 1594132836, 1597539357 (https://xpolog.atlassian.net/wiki/spaces/XPOL/pages/1718583297); dock price book. Pending confirmation from XPLG engineering: the supported identity sources and Audity's own reports.