Subject: Identifying key entities
On this page
Orient stage · phase 2 of 7
Who is involved?
Subject is the who of the alert. Every entity that authenticated, executed, or acted on the systems the alert touched. Not just humans. Anyone or anything with an identity that the system trusted.
What Subject is for
Alert told the analyst what fired. Subject answers who acted. The answer is rarely a single person. It is often a chain of identities (a user, the laptop they were on, a service account the laptop authenticated against, a cloud role the service account assumed) and the relationships between them. Subject is how the investigation moves from event to actor.
How the sub-pages fit together
The sub-pages aren’t equivalent things to memorize. They’re different shapes of the same question. Four dimensions is the primary lens: apply it to every entity (Authentication, Authorization, Behavior, Relationships) to turn it into a structured profile. Entity types is the typology of what to apply it to (user accounts, endpoints, applications and services, network identifiers), with the first checks for each. Non-human identities takes the identities no person sits behind (service accounts, cloud roles, workload identities, OAuth apps, CI/CD tokens, AI agents) and shows how to find the owner and the baseline for each. Behavioral framework is the toolkit for the Behavior dimension: pattern recognition, baselines, anomalies. Insider analysis is the special case: what to do differently when the actor turns out to be an authorized user, framed against the Insider Threat Matrix. Read in that order and the chapter feels like one continuous skill, not a set of disconnected sub-skills.
What you will get from this chapter
By the end of Subject you should be able to:
Enumerate every entity connected to the alert: user accounts, endpoints, applications and services, and network identifiers, including every non-human identity in the chain.
Evaluate each entity across four dimensions (authentication, authorization, behavior, relationships) so the assessment is repeatable across alert types.
Compare current activity against historical baselines to separate normal-for-this-entity from anomalous.
Recognize insider patterns using the Insider Threat Matrix Insider Threat Matrix A public framework maintained at insiderthreatmatrix.org that catalogs insider techniques across motive, means, preparation, infringement, and anti-forensics. Useful as a shared vocabulary for describing insider risk and threat. and produce a Subject-level risk picture.
Subject at a glance
- Question
-
Who is involved?
Every identity that authenticated, executed, or acted, human or not, and how the identities connect. - Deliverable
- The Subject handoff: the entity map, baselines and deviations with their confidence, the relationship graph, and insider indicators, carried in the handoff document the transition to Scope lays out.
- Done when
- every identifier resolves to an entity with an owner, and the confidence of each hop is noted;
- every entity in the chain has a line per dimension (fine, not fine, or unknown), labeled per the shared confidence rubric;
- what could not be checked is written down as an open question for Uncover;
- first-pass scope parameters are recommended.
- Tripwire
- An escalation criterion confirmed during Subject (supported at High confidence) escalates now under the escalation tripwire. Subject keeps working as scoping support under IR’s clock. Suspicion refines Scope instead.
| Level | At this level, Subject is |
|---|---|
| Level 0 pattern close | Subject compresses into one item of the eligibility gate: not a privileged identity, and not automation holding deploy, signing, secrets, or repository-write rights, each proven from its source system. Unknown fails the gate. A privileged identity always fails it and routes the case to Level 2. |
| Level 1 standard triage | Subject and Scope run as one context sweep: who is this, and what can they reach? The ten-minute pass below is the Subject half. A second subject, a privileged account, or regulated data the activity plausibly touched moves the case to Level 2. |
| Level 2 full arc | The full chapter: every identity in the chain, human and non-human, profiled across the four dimensions, baselines read at every available scale, the insider check, and the complete handoff. |
Subject in ten minutes
In a full Level 2 investigation an experienced analyst typically spends 8 to 15 minutes on Subject and a new analyst 20 to 40: a diagnostic range, not a quota (see the time-per-phase table). The rest of the chapter describes far more work than that, so this is what “done enough” looks like on a routine case. Every step links to the page that develops it.
- Resolve the identifier to an owner and note the confidence of each hop (From identifier to identity).
- List the non-human identities in the chain: service accounts, cloud roles, OAuth apps, AI agents (Entity types, Non-human identities).
- Write one line per dimension: fine, not fine, or unknown (Four dimensions).
- Check the baseline at the highest available scale: the entity’s own history, then its peers, then its role’s expectations (Behavioral framework).
- Record what could not be checked. A gap is an open question, not a clean result.
When any of the five turns up something that does not fit, that is the lead, and the deeper pages are where to follow it.
Subjects are not just users
A common mistake in Subject analysis is to map " entity Entity Any discrete actor or object that evidence can attach to during an investigation: a user account, a host, a process, an IP address, a domain, a file. Triage decomposes an alert into its entities and asks what each one was doing; the same idea gives UEBA its E. " to ” user account User Account The identity record a system authenticates and authorizes: a username with credentials, group memberships and attributes. One person usually holds several (workstation, cloud, admin, SaaS), and an account can be used by someone other than its owner. Subject analysis treats the account and the person as separate questions. .” Modern environments have far more identities than people. Understanding what counts as a subject is the first skill of the phase. The four types below are the same four the Entity types page develops.
User accounts
Standard users, administrators, contractors, vendor logins, federated and guest identities, and the service accounts that sign in like them. Service accounts are non-human identities: they often hold broader access than people and outlive the people who created them.
Endpoints
Workstations, servers, mobile devices, VMs (EC2, Azure VMs, GCE), Kubernetes pods. The host is the place where activity actually happens, and each one is an identity boundary the SOC needs to track.
Applications and services
Deployment pipelines, automation bots, serverless functions, OAuth apps, AI agents, and the cloud roles and managed identities they run as. Non-human identities with predictable but consequential behavior.
Network identifiers
IP addresses, MAC addresses, domains. Not identities themselves, but the markers systems use to decide who is who. Certificates and API keys are credentials that belong to the identities above.
Why Subject deserves its own phase
A pattern experienced analysts will recognize: many missed intrusions are missed at Subject. The detection engine fired correctly and the alert was understood, but the analyst stopped at ” user User The identity behind activity on a system: the account that authenticated, launched the process, or received the email. In triage the user field names an account, not necessarily a person; whether the legitimate owner was actually behind the activity is exactly the question stolen credentials raise. X did Y” without asking what kind of identity X is, what X normally does, or what other identities connect to X.
Identity is not the same as person
The user account named alice@example.com is an identity. So is the service account that alice’s CI/CD pipeline uses. So is the cloud role that pipeline assumes when it deploys to staging. Each can hold more trust than alice herself: if alice can trigger the pipeline, she effectively wields the pipeline’s role. Collapsing all three into “alice” is how privilege escalation Privilege Escalation The ATT&CK tactic for gaining higher permissions: on the endpoint, standard user to admin to SYSTEM; in the directory or cloud, a regular account to domain admin or a privileged cloud role. paths get missed.
Identities outlive people
Service accounts created five years ago, by engineers who have since left, often still have production access. They have no manager, no review cadence, and no normal user to compare against. Subject analysis is what surfaces these forgotten identities.
Behavior is the strongest signal
For any identity, the question “is this normal for this identity” is more informative than “is this normal in general.” A 03:00 login is unremarkable for a night-shift on-call engineer and alarming for a finance executive based in the same office. The same alert means different things depending on whose history it touches.
Relationships reveal scope
A compromised identity is rarely the destination. It is the starting point for lateral movement Lateral Movement Moving from the initial foothold to other hosts, identities or tenants to find sensitive data or reach higher-value targets (ATT&CK tactic TA0008). It usually rides legitimate remote-access protocols (RDP, SMB, WinRM, SSH) with stolen credentials, or replays a stolen session into a cloud or SaaS tenant, so the signal is an account authenticating where it does not normally go. Each hop widens the blast radius, and confirmed lateral movement is an escalation criterion. . Mapping which other identities and systems a compromised entity can reach is how the analyst sets the bounds of the investigation, which feeds directly into the Scope phase next.
Key takeaway
Subject is not “look up the user in HR.” It is the structured assessment of every identity connected to the alert, across four dimensions, including the non-human and infrastructure Infrastructure The systems, networks, and services that computing runs on. In triage the word points two directions: the organization's infrastructure is what alerts fire on, and attacker infrastructure is the set of C2 servers, domains, and staging hosts an adversary operates, which pivoting on indicators is meant to map. identities that systems trust as if they were people.
Next up
The four dimensions
The lens that turns any entity into a structured profile: authentication, authorization, behavior, relationships.
Read the four dimensionsTechnical details verified . Product names, defaults and retention change; check your own tenant.