Entity Management

Entities and Peer Groups are the foundation for understanding who and what is in your environment. It provides a centralized view of every identity and asset the platform monitors—the people, accounts, and systems that make up your organization’s security operations workflow. The platform pulls entity data from connected external systems, monitors entities for suspicious activity, and calculates a risk score for each one. Peer groups and risk score modifiers provide the organizational context that makes those scores meaningful.

Understanding Entities and Peer Groups

An entity is any identity or asset that the Anomali platform monitors and scores.

There are two entity types:

• Identities include human and non-human accounts in your organization: users, contractors, and service accounts. Each identity is displayed with attributes such as username, email address, the groups it belongs to, and its current risk score.
• Assets include the devices across your environment: computers, mobile devices, routers, servers, and other infrastructure. Each asset is displayed with attributes such as host name and MAC address.

Each entity has a risk score that reflects the detections triggered against it. The risk score is adjusted by any risk score modifiers applied to the entity or its peer groups. Each entity also has a detail view that shows the current score and its contributing factors, associated detections, related entities, and a history of attribute changes.

A peer group is a collection of entities that share a common role, function, or access level. Peer groups provide critical context for risk scoring by allowing a Risk Score Multiplier to be applied to a set of entities as a group. Groups can be imported from a connected identity provider such as Active Directory or Okta among several others, or created manually within the platform. A risk modifier between 0.1 and 2.0 is associated with each group, where 1.0 is neutral. Groups are hierarchical: a parent group can contain child groups, allowing a multiplier to be set at a broad level with more specific overrides applied below. An entity can belong to more than one group; when it does, its effective multiplier is the average across all groups it belongs to.

Entity Sources

Entity data is brought into the platform through Entity Sources, accessible from the Integrations Marketplace, or imported manually via CSV. See Entity Sources for details.

These sources perform an initial full sync of records from the source system and keep that data current through scheduled incremental syncs. The sources fall into two categories:

• Identity sources import user accounts and group memberships from identity providers. Supported sources include Microsoft Entra ID, Okta, AWS IAM, Google Cloud IAM, Google Workspace, SCIM 2.0.
• Asset sources import device and infrastructure records from vulnerability management and IT service management systems. Supported sources include ServiceNow CMDB, Qualys VMDR, Tenable, and Rapid7 InsightVM. Jira Assets is also supported as a combined source.

Configuring a Source

Sources are configured from the Entity Sources tab of the Integrations Marketplace. Each configuration requires:

• Credentials for the source system
• Field mappings from source attributes to Anomali fields
• A sync frequency (15 minutes to daily)

A Test Connection check validates the credentials before saving. Multiple independent configurations of the same connector type are supported—for example, two separate Okta tenants can each be configured independently.

Sync Behavior

On first activation, a source performs a full sync. Subsequent runs are incremental. Organization Administrators can trigger a sync on demand. If an entity is removed or disabled in the source system, its status is set to Disabled rather than deleted, preserving its detection history for investigation.

Risk Score Modifiers

Entities and Groups provides two configurable modifiers that allow users with the Manage Entities permission to adjust risk scoring to reflect their organizational context. Both modifiers accept values from 0.1 to 2.0 and default to 1.0, which applies no adjustment to the underlying score.

• Peer Group Risk Score Multiplier is configured at the group level. For entities that belong to more than one group, the multiplier is applied as a weighted average across all groups. Use this modifier to increase scoring sensitivity for groups such as privileged accounts, or to reduce it for groups where expected routine activity would otherwise produce frequent detections.
• Entity Risk Override is configured at the individual entity level and applied after all group multipliers have been calculated. Use this modifier when a specific entity requires a different sensitivity setting than the rest of its peer group—for example, a user account that has been temporarily granted elevated access.

Managing Entities and Groups

Entities and Groups is accessible from the main navigation bar of the Anomali Agentic SOC Operations. It provides two primary management areas:

• Entities displays a summary of entities by type and risk level, followed by a searchable and filterable list of all entity records. Users with the Manage Entities permission can create manual entity records, import entities from a CSV file, and open individual entity detail views. For details, see Managing Roles.
• Peer Groups displays all configured peer groups, including groups sourced from a connected identity provider and groups created manually in the platform. Users with the Manage Entities permission can create and manage groups, set the Risk Score Multiplier for each group, and view group membership and hierarchy. For details, see Managing Roles.