Users inventory

When viewing the Users inventory, you can use the following keywords to search and filter users.

Source

The source reporting the users can be searched or filtered by name using the syntax source:<name>.

source:ldap

Name fields

There are multiple name fields found in the user attributes that can be searched or filtered using the same syntax. Use the syntax <name_field>:<text> to search a field for matches.

The following name fields can be searched this way:

• name
• display_name
• first_name
• last_name

name:j

display_name:"john doe"

first_name:john

last_name:doe

Description

Use the syntax description:<text> to search the results in this field.

description:shared

Groups

The group_id field is the unique identifier for a given group, written as a UUID. To search for users that are part of a group based on the group’s ID, use the syntax group_id:<uuid>.

group_id:f8a26321-cbce-4fb5-a9ca-ffa809489dd5

Email

Use the syntax email:<address> to search for users by email address.

email:john@example.com

Phone

Use the syntax phone:<phone number> to search for users by phone number.

phone:888-555-1234

Title

Use the syntax title:<text> to search for users by title.

title:CISO

Location

Use the syntax location:<text> to search for users by location.

location:TX

Last logon

Use the syntax last_logon_at:<date> to search for users by last logon time. This field is compatible with the date comparison operators.

last_logon_at:<1year

First seen

Use the syntax first_seen_at:<date> to search for users by when they were first seen in the organization. This field is compatible with the date comparison operators.

first_seen_at:<1day

Last seen

Use the syntax last_seen_at:<date> to search for users by when they were last seen in the organization. This field is compatible with the date comparison operators.

last_seen_at:>2years

Site name or ID

Use the syntax site:<term> to filter by site name or ID.

site:Primary

site:"Branch Office"

site:ad67d649-041b-439d-af59-f200053a8899

Organization name or ID

Use the syntax organization:<term> to filter by organization name or ID.

organization:runZero

organization:"Temporary Project"

organization:f1c3ef6d-cb41-4d55-8887-6ed3cfb3d42d