Manage entities

Once entity risk scoring is running, you can refine which entities matter most and how they're grouped. These capabilities build on top of risk scoring: watchlist membership feeds the risk weighting, and entity resolution consolidates duplicate records and aggregates their scores.

• Watchlists: Define groups of important entities — such as executives or critical infrastructure hosts — and factor their membership into entity risk scoring.
• Entity resolution: Link multiple entity records that represent the same real-world identity and consolidate their risk scores into a single view.
• Privileged user monitoring: Track the activity of users with elevated permissions. Replaced by watchlists.