Managing Identities

The Identities list page supports both bulk and individual actions. You can set a risk override, add to a peer group, or export identities—either for multiple identities at once or for a single identity. Individual identities also support additional actions: viewing details, editing, and removing.

Note: The Manage Entities permission is required to manage identities. For details, see Managing Roles.

Setting a Risk Override

You can apply a risk override multiplier to the selected identities. The override range is 0.1 to 2.0, where 1.0 is neutral. This action applies the same override value to all selected identities in a single operation.

To set a risk override:

  1. Navigate to ThreatStream Next Gen > Entity Management > Entities > Identities.

  2. Select one or more identities.

  3. Click Set Override in the toolbar.

  4. Set the override value and confirm.

See Entity Risk Score Override for more information on how risk scoring and overrides work.

Adding Identities to a Peer Group

You can assign the selected identities to one or more peer groups. Group membership determines which risk multipliers apply to the score for an identity.

To add identities to a peer group:

  1. Navigate to ThreatStream Next Gen > Entity Management > Entities > Identities.

  2. Select one or more identities.

  3. Click Add to Group in the toolbar.

  4. Search for and select the peer group, then confirm.

See Peer Groups for more information.

Exporting Identities

You can export selected identity records in CSV format.

To export identities:

  1. Navigate to ThreatStream Next Gen > Entity Management > Entities > Identities.

  2. Select one or more identities.

  3. Click Export in the toolbar.

    The downloading process starts immediately.

Taking Individual Identity Actions

Each identity row has an options menu (...) that provides actions for that specific identity without requiring a selection.

The options menu includes the following actions:

  • View Details—opens the Identity Detail side panel. See Viewing Identity Details for more information.

  • Set Override—applies a risk override multiplier to this identity. See Entity Risk Score Override for more information.

  • Add to Group—assigns this identity to a peer group. See Peer Groups for more information.

  • Export—downloads the identity record.

  • Edit—opens the identity form to modify its details.

  • Remove Identity—permanently removes the identity from the platform.