---
title: "Users inventory"
---

When viewing the Users inventory, you can use the following keywords to ((search|search users)) and filter users.

## Source {#users-source}
The source reporting the users can be searched or filtered by name using the syntax `source:<name>`. 

```plaintext
source:ldap
```

## Name fields {#users-names}
There are multiple name fields found in the user attributes that can be searched or filtered using the same syntax. Use the syntax `<name_field>:<text>` to search a field for matches.

The following name fields can be searched this way:
- `name`
- `display_name`
- `first_name`
- `last_name`

```plaintext
name:j
```
```plaintext
display_name:"john doe"
```
```plaintext
first_name:john
```
```plaintext
last_name:doe
```

## Description {#users-description}
Use the syntax `description:<text>` to search the results in this field.

```plaintext
description:shared
```

## Groups {#users-groups}
The `group_id` field is the unique identifier for a given group, written as a UUID. To search for users that are part of a group based on the group's ID, use the syntax `group_id:<uuid>`. 
```plaintext
group_id:f8a26321-cbce-4fb5-a9ca-ffa809489dd5
```

## Email {#users-emailaddr}
Use the syntax `email:<address>` to search for users by email address.
```plaintext
email:john@example.com
```

## Phone {#users-phone}
Use the syntax `phone:<phone number>` to search for users by phone number.
```plaintext
phone:888-555-1234
```

## Title {#users-title}
Use the syntax `title:<text>` to search for users by title.
```plaintext
title:CISO
```

## Location {#users-location}
Use the syntax `location:<text>` to search for users by location.
```plaintext
location:TX
```

## Last logon {#users-lastLogon}
Use the syntax `last_logon_at:<date>` to search for users by last logon time. This field is compatible with the [date comparison operators](docs/search-query-syntax.md#time-and-date-values).
```plaintext
last_logon_at:<1year
```

## First seen {#users-firstSeen}
Use the syntax `first_seen_at:<date>` to search for users by when they were first seen in the organization. This field is compatible with the [date comparison operators](docs/search-query-syntax.md#time-and-date-values).
```plaintext
first_seen_at:<1day
```

## Last seen {#users-lastSeen}
Use the syntax `last_seen_at:<date>` to search for users by when they were last seen in the organization. This field is compatible with the [date comparison operators](docs/search-query-syntax.md#time-and-date-values).
```plaintext
last_seen_at:>2years
```

## Site name or ID {#users-site}
Use the syntax `site:<term>` to filter by site name or ID.
```plaintext
site:Primary
```
```plaintext
site:"Branch Office"
```
```plaintext
site:ad67d649-041b-439d-af59-f200053a8899
```

## Organization name or ID {#users-organization}

Use the syntax `organization:<term>` to filter by organization name or ID.
```plaintext
organization:runZero
```
```plaintext
organization:"Temporary Project"
```
```plaintext
organization:f1c3ef6d-cb41-4d55-8887-6ed3cfb3d42d
```