Forum Discussion
User contact info is blank when viewing Sentinel incident details via Lighthouse
Ok, I've found the solution. User contact details (amongst other things) are stored in the 'IdentityInfo' table which is created when you enable UEBA. Once UEBA is enabled, all AAD user details are synced into the ‘IdentityInfo’ table. This makes them accessible via Lighthouse in the LA workspace and doesn't require AAD reader rights. It's a pity info like office location, mobile phone and manager aren't visible in the incident details via Lighthouse but at least they are accessible in the logs.
Ok, I've found the solution. User contact details (amongst other things) are stored in the 'IdentityInfo' table which is created when you enable UEBA. Once UEBA is enabled, all AAD user details are synced into the ‘IdentityInfo’ table. This makes them accessible via Lighthouse in the LA workspace and doesn't require AAD reader rights. It's a pity info like office location, mobile phone and manager aren't visible in the incident details via Lighthouse but at least they are accessible in the logs.
- We have the same problem, but go to the Identity Table is not enough solution. All the info is there but maybe there are some problems between the UI and the backend info. We dont see any information (apart of S-ID and AAD Object ID ) on the UEBA page using lighthouse or not. We need to see more information on the User page, if not that feature is useless.
