Identity Provider Profiles
Fetch and store user and device data from identity providers
Panther can retrieve and store user and device data from common identity providers that you've configured as log sources. This information is stored in Panther-managed Lookup Tables, meaning it can be referred to in detection logic and search queries.
Learn more about how to set up profiles for different identity providers on the pages below:
You can leverage the user and device data from your identity provider profiles in your detections. See the following example use cases:
- Detect when an action is performed by a terminated employee, which can indicate that off-boarding is incomplete.
- In a detection's configuration, adjust the alert severity level based on the job title of the event actor. For example, you might use an
INFOseverity level if some action is taken by a System Administrator, butHIGHif taken by a user with any other role. - Detect when the device an action is taken from is a phone and the actor is not a System Administrator.
Once a profile has been set up, you can see the data it's storing by querying from its table in the Data Lake.
- 1.In left-side navigation bar in your Panther Console, click Configure > Enrichment Providers.
- 2.Locate the Enrichment Provider you'd like to view the data of, and click its name.
- 3.In the upper-right corner, click View in Data Explorer.
- You will be redirected to Data Explorer, and a
SELECTquery will be pre-populated.
- 4.Below the SQL editor, click Run Query.
- You can view table data in the Results section, below the SQL editor.
Last modified 23d ago