Subject: Identifying key entities
Stage 1 · piece 2 of 7
Who is involved?
Subject is the who of the alert. Every entity that authenticated, executed, or acted on the systems the alert touched. Not just humans. Anyone or anything with an identity that the system trusted.
What Subject is for
Alert told the analyst what fired. Subject answers who acted. The answer is rarely a single person. It is often a chain of identities (a user, the laptop they were on, a service account the laptop authenticated against, a cloud role the service account assumed) and the relationships between them. Subject is how the investigation moves from event to actor.
How the four sub-pages relate (they're not parallel pillars)
The four sub-pages below aren’t four equivalent things to memorize. They’re four different shapes of the same question. Four dimensions is the primary lens, apply it to every entity (Authentication, Authorization, Behavior, Relationships). Entity types is the typology of what to apply it to (humans, service accounts, machines, cloud roles). Behavioral framework is the toolkit for the Behavior dimension specifically, pattern recognition, baselines, anomalies. Insider analysis is the special case, what to do differently when the actor turns out to be an authorized user, framed against the Insider Threat Matrix. Read in that order and the chapter feels like one continuous skill, not four disconnected sub-skills.
What you will get from this chapter
By the end of Subject you should be able to:
Enumerate every entity connected to the alert: humans, service accounts, machines, cloud roles, network identifiers.
Evaluate each entity across four dimensions, authentication, authorization, behavior, relationships, so the assessment is repeatable across alert types.
Compare current activity against historical baselines to separate normal-for-this-entity from anomalous.
Recognize insider patterns using the Insider Threat Matrix A public framework maintained at insiderthreatmatrix.org that catalogs insider techniques across motive, means, preparation, infringement, and anti-forensics. Useful as a shared vocabulary for describing insider risk and threat. and produce a Subject-level risk picture.
Subjects are not just users
A common mistake when teaching Subject is to map " Entity Any discrete actor or object that evidence can attach to during an investigation: a user account, a host, a process, an IP address, a domain, a file. Triage decomposes an alert into its entities and asks what each one was doing; the same idea gives UEBA its E. " to ” User Account A unique identity or profile used to authenticate and authorize access to a system or resource. .” Modern environments have far more identities than people. Understanding what counts as a subject is the first skill of the phase.
👤 Human users
Standard users, administrators, contractors, executives, vendor logins. Each has a different risk profile based on access and job function.
🤖 Non-human identities
Service accounts, automation bots, deployment pipelines, scheduled tasks. Often have broader access than humans and outlive the people who created them.
☁️ Cloud and infrastructure
EC2 instances, Kubernetes pods, Lambda functions, cloud roles, federated identities. Each represents an identity boundary the SOC needs to track.
🔗 Network and trust
IP addresses, MAC addresses, certificates, API keys. Not identities in the traditional sense, but the markers that systems use to decide who is who.
The four sub-pages of Subject analysis
ASSURED splits Subject into four sub-pages. The first three structure how to think about an entity. The fourth handles a special case.
Four dimensions
Authentication, authorization, behavior, relationships. The lens that turns any entity into a structured profile.
Read →Entity types
User accounts, endpoints, applications, services, network identifiers. Each type has its own analysis pattern.
Read →Behavioral framework
Pattern recognition, baseline development, anomaly detection. The toolkit for separating normal from suspicious.
Read →Insider analysis
Risk vs. threat. Motive, means, preparation, infringement, anti-forensics. Plus the Insider Threat Matrix as a structured lens.
Read →Why Subject deserves its own phase
A pattern experienced analysts will recognize: many missed intrusions are not missed at Alert, they are missed at Subject. The detection engine often fires correctly, but the analyst stops at ” User The identity behind activity on a system: the account that authenticated, launched the process, or received the email. In triage the user field names an account, not necessarily a person; whether the legitimate owner was actually behind the activity is exactly the question stolen credentials raise. X did Y” without asking what kind of identity X is, what X normally does, or what other identities connect to X.
The user account named alice@example.com is an identity. So is the service account that alice’s CI/CD pipeline uses. So is the cloud role that pipeline assumes when it deploys to staging. All three can act with alice’s level of trust. Treating them as the same person is how Privilege Escalation Gaining access at a higher trust level than the actor originally held, by any means: exploiting a bug, abusing a misconfiguration, stealing credentials, impersonating a token, or socially engineering an elevation. gets missed.
Service accounts created five years ago, by engineers who have since left, often still have production access. They have no manager, no review cadence, and no normal user to compare against. Subject analysis is what surfaces these forgotten identities.
For any identity, the question “is this normal for this identity” is more informative than “is this normal in general.” A 03:00 login is unremarkable for a follow-the-sun support account and alarming for a finance executive. The same alert means different things depending on whose history it touches.
A compromised identity is rarely the destination. It is the starting point for Lateral Movement Adversary traversal from the initial-access host to other hosts inside the environment. Each hop expands the blast radius and adds new entities for Subject analysis. Often piggybacks on legitimate authentication, which is what makes it hard to detect. . Mapping which other identities and systems a compromised entity can reach is how the analyst sets the bounds of the investigation, which feeds directly into the Scope phase next.
Key Takeaway
Subject is not “look up the user in HR.” It is the structured assessment of every identity connected to the alert, across four dimensions, including the non-human and Infrastructure The systems, networks, and services that computing runs on. In triage the word points two directions: the organization's infrastructure is what alerts fire on, and attacker infrastructure is the set of C2 servers, domains, and staging hosts an adversary operates, which pivoting on indicators is meant to map. identities that systems trust as if they were people.
Next up
The four dimensions
The lens that turns any entity into a structured profile: authentication, authorization, behavior, relationships.
Read the four dimensions