Users inventory
When viewing the Users inventory, you can use the following keywords to search and filter users.
Source
The source reporting the users can be searched or filtered by name using the syntax source:<name>
.
source:ldap
Name fields
There are multiple name fields found in the user attributes that can be searched or filtered using the same syntax. Use the syntax <name_field>:<text>
to search a field for matches.
The following name fields can be searched this way:
name
display_name
first_name
last_name
name:j
display_name:"john doe"
first_name:john
last_name:doe
Description
Use the syntax description:<text>
to search the results in this field.
description:shared
Groups
The group_id
field is the unique identifier for a given group, written as a UUID. To search for users that are part of a group based on the group’s ID, use the syntax group_id:<uuid>
.
group_id:f8a26321-cbce-4fb5-a9ca-ffa809489dd5
Use the syntax email:<address>
to search for users by email address.
email:john@example.com
Phone
Use the syntax phone:<phone number>
to search for users by phone number.
phone:888-555-1234
Title
Use the syntax title:<text>
to search for users by title.
title:CISO
Location
Use the syntax location:<text>
to search for users by location.
location:TX
Last logon
Use the syntax last_logon_at:<date>
to search for users by last logon time. This field is compatible with the date comparison operators.
last_logon_at:<1year
First seen
Use the syntax first_seen_at:<date>
to search for users by when they were first seen in the organization. This field is compatible with the date comparison operators.
first_seen_at:<1day
Last seen
Use the syntax last_seen_at:<date>
to search for users by when they were last seen in the organization. This field is compatible with the date comparison operators.
last_seen_at:>2years
Site name or ID
Use the syntax site:<term>
to filter by site name or ID.
site:Primary
site:"Branch Office"
site:ad67d649-041b-439d-af59-f200053a8899
Organization name or ID
Use the syntax organization:<term>
to filter by organization name or ID.
organization:runZero
organization:"Temporary Project"
organization:f1c3ef6d-cb41-4d55-8887-6ed3cfb3d42d