Users inventory

View as Markdown

When viewing the Users inventory, use these keywords to search and filter users. To search groups, see the groups inventory keywords.

Source

Use source:<name> to search or filter by the name of the source that reported the users.

source:ldap

Name fields

Use <name_field>:<text> to search or filter any of the name fields in the user attributes.

The name fields you can search this way:

  • name
  • display_name
  • first_name
  • last_name
name:j

display_name:"john doe"

first_name:john

last_name:doe

Description

Use description:<text> to search the description field.

description:shared

Groups

Use group_id:<uuid> to find users that belong to a group by the group’s ID. The group_id field is the group’s unique identifier, written as a UUID.

group_id:f8a26321-cbce-4fb5-a9ca-ffa809489dd5

Email

Use email:<address> to search for users by email address.

email:john@example.com

Phone

Use phone:<phone number> to search for users by phone number.

phone:888-555-1234

Title

Use title:<text> to search for users by title.

title:CISO

Location

Use location:<text> to search for users by location.

location:TX

Last logon

Use last_logon_at:<date> to search for users by last logon time. This field supports the date comparison operators.

last_logon_at:<1year

First seen

Use first_seen_at:<date> to search for users by when they were first seen in the organization. This field supports the date comparison operators.

first_seen_at:<1day

Last seen

Use last_seen_at:<date> to search for users by when they were last seen in the organization. This field supports the date comparison operators.

last_seen_at:>2years

Site name or ID

Use site:<term> to filter by site name or ID.

site:Primary

site:"Branch Office"

site:ad67d649-041b-439d-af59-f200053a8899

Organization name or ID

Use organization:<term> to filter by organization name or ID.

organization:runZero

organization:"Temporary Project"

organization:f1c3ef6d-cb41-4d55-8887-6ed3cfb3d42d
Updated