Skip to main content

User Exclusions

You can exclude Users that are frequently flagged as malicious but are intended for legitimate use. See Exclusions for more information.

VIPs

Very Important Persons (VIPs) are part of our directory integrations and allow us to automatically identify people of importance within your organization. These would commonly be people with special organizational or technological privileges such that when a detection is ingested in relation to them should get special handling.

VIP Automations

You can configure custom VIP identification rules underneath Assets > Users. Create a search query that identifies the VIPs you want and click “Create VIP Automation”. Any new or existing users matching that query will be automatically marked as a VIP.

Technical Users

Technical users are part of our directory integrations and allow us to automatically identify people that commonly perform technical operations within your organization. These would be people that interact with the command line, download tools, or do other IT/engineering tasks regularly. Understanding these users helps us decide when to escalate suspicious commands on their endpoints.

Technical User Automations

You can configure custom technical user identification rules underneath Assets > Users. Create a search query that identifies the users you want and click Actions > Create Technical User Automation. Any new or existing users matching that query will be automatically marked as technical.

Administrative Users

Administrative users are part of our directory integrations and allow us to automatically identify people that commonly perform administrative operations within your organization. These would be people that are considered System Administrators, Global Admins, or anyone else that has privileged access in your organization.Any user marked as an administrator will be automatically marked as technical.

Administrative User Automations

You can configure custom administrative user identification rules underneath Assets > Users. Create a search query that identifies the users you want and click Actions > Create Administrative User Automation. Any new or existing users matching that query will be automatically marked as administrative.

External Users

External users are part of our directory integrations and allow us to identify contractors, vendors, or other identities outside your core organization. Wirespeed uses this when verdicting detections—for example, logins from an external user on a privacy VPN may be auto-closed by default to reduce noise. To alert on those logins instead, disable that rule under Settings > Verdicts > Identity > Login.

External User Automations

You can configure custom external user identification rules underneath Assets > Users. Create a search query that identifies the users you want and click Actions > Create External User Automation. Any new or existing users matching that query will be automatically marked as external.

Remediation

More information on remediation can be found here.

Group Syncing

Wirespeed allows you to create automation rules, chat ops settings, and more based on the group a user is assigned to. However, group membership is not synced by default due to limitations in source systems. To sync all group memberships for a specific group select “Manage Group Sync” on the Users page, search for the correct group(s), select the 3-dots on their row and select Enable Sync. User–endpoint links are not set manually in Wirespeed; they come from synced directory and EDR/MDM data. See Endpoints — Related users if endpoints show no assigned users.

Billable users

Billable user counts prefer license data from Microsoft or Google Workspace when available; otherwise they fall back to enabled, managed directory users excluding NHI and External group members. See Billable Assets for how counts are calculated.