How to differentiate between an affected user and a compromised user?

[JM Gomez]

When using affected users you are selecting users who were impacted by the Incident.  We have been operating under the assumption that an affected user is the same a compromised user.  We have come across instances where the affected user was not compromised (i.e. recipient of phishing).  How can you properly identify and tag a compromised user so they can be differentiated from the affected users table.  We are trying to design this for reporting on compromised user accounts for a rolling 30 day period.

[Luke Kasper · Accepted solution]

Hey JM,

This is a great question!  There's actually a field in the system that may work for you already, though if not, it'd be trivial to get what you need.  On the Affected Users Related List as it's configured baseline, the only column you see is the User column.  When clicked, this takes you to the sys_user record, which is really not helpful.

If you re-order that list, and put a different field at the front, you'll see that the table actually being referenced in the Related list is sn_si_m2m_task_affected_user table, and by putting a different field first your link to the record now sends you there. Screenshot of one way:

When you go to that record, you'll notice there is a Phished field that is just a flag.  This might work for you!  If not, I'd say you would just want to add a field to that table that might cover the specifics you need.  Here's a screenshot of that record with the Phished field added to the form:

Hope this helps!

-Luke