You want to find all events related to the user with the login ID of "ivan.helen@acme". Which filter do you enter into the UBA portal data explorer?

Question

Options

• Auser_id = 'ivan.helen@acme'
• Buser_name = 'ivan.helen@acme'
• Cevent_user = 'ivan.helen@acme'
• Dentity_name = 'ivan.helen@acme'

• A
  3% (1)
• B
  3% (1)
• C
  85% (29)
• D
  9% (3)

Explanation

In a UBA (User Behavior Analytics) portal, event_user is the standard field name used to identify the user associated with a logged event, making C the correct filter syntax for querying by login ID.

• A (user_id) is incorrect because user_id typically refers to an internal numeric or system-generated identifier, not a human-readable login string like an email.
• B (user_name) is a common field in general user directories but is not the event-level attribute used in the UBA data explorer's event log schema.
• D (entity_name) refers to a resource, device, or object involved in an event - not the actor (user) who performed it.

Memory tip: Think of it as "who triggered the event?" - the field follows that logic: event_user = the user tied to the event. If you see an email-format login ID in a UBA query, pair it with the field that starts with event_.

No community discussion yet for this question.