Identity Provider Profiles
Fetch and store user and device data from identity providers
Last updated
Was this helpful?
Fetch and store user and device data from identity providers
Last updated
Was this helpful?
Panther can retrieve and store user and device data from common identity providers that you've configured as log sources. This information is stored in Panther-managed Lookup Tables, meaning it can be referred to in detection logic and search queries.
Learn more about how to set up profiles for different identity providers on the pages below:
Once a profile has been set up, you can see the data it's storing by querying from its table in the Data Lake.
In left-side navigation bar in your Panther Console, click Configure > Enrichment Providers.
Locate the Enrichment Provider you'd like to view the data of, and click its name.
In the upper-right corner, click View in Data Explorer.
You will be redirected to Data Explorer, and a SELECT query will be pre-populated.
Below the SQL editor, click Run Query.
You can view table data in the Results section, below the SQL editor.