Identities

Attribution model

Ultra attributes all activity to the most specific identity available:

Assurance	When it applies	Indicator
Authenticated	The event carries a known user.	Green dot
Device-attributed	No direct user, but the event comes from a device with a known owner. The owner is credited.	Amber dot, “Device-attributed” badge
Unattributed	Only agent name is available. No known user or device.	Gray dot

The Identities list

Open Identities in the Hub sidebar. Identities are sorted by most recently active, and unattributed agents appear in the same list as rows you can’t open.

Column	Description
Identity	Name, email, or agent. Filter by name or email.
Relationship	Member, or Non-member for identities outside the organization.
Role	The member’s organization role. The export includes this column, which the Secure Configuration Guide uses to count Owner accounts.
Assurance	Authenticated, Device-attributed, Unattributed, or No activity.
Last active	Most recent event, or “Never”.
Connectors	All-time count of connectors the identity has used.
Unique tools	All-time count of distinct tools the identity has invoked.
Agents	All-time count of agents the identity has used.
Devices	All-time count of devices the identity owns or has used.
Blocks · 30d	Guardrail and governance denials over the last 30 days.
Anomalies · 30d	Anomaly findings over the last 30 days.

Filter by Identity, Relationship, Role, Assurance, or Last active, and sort by any column. Export the complete list, or selected rows, as CSV or JSON.

Identity detail

Click a row to view all details for the identity:

Tab	Shows
Overview	Count tiles, a requests-by-time-of-day heatmap for the last 30 days (UTC), and recent audit events
Connectors	Connectors this identity has used
Tools	Tools this identity has invoked
Agents	Agents this identity has used
Devices	Devices this identity owns or has used
Requests	This identity’s request history
Blocks	Guardrail and governance denials
Anomalies	Anomaly findings that named this identity

Anomaly attribution is approximate. Findings that named the identity by display name or email instead of its ID may not appear. Treat the Anomalies tab as a strong hint rather than an exhaustive count.

Who can see Identities

Owners, Admins, Members, and Viewers see the full list, the detail pages, and export. If a user can see the audit log, they can see who generated each event.

Members whose access comes only from a team see the list for the workspaces where they can view the audit log, without anomaly counts, detail pages, or export.

Membership changes show on the next page load. Past activity stays attributed to the original identity after a member is removed, so audit history is preserved.

Getting Started

Ultra Hub

Observability

Concepts

Attribution model

The Identities list

Identity detail

Who can see Identities

Audit Log

RBAC

​Attribution model

​The Identities list

​Identity detail

​Who can see Identities

​Related

Audit Log

RBAC

Attribution model

The Identities list

Identity detail

Who can see Identities

Related