Settings

Click Settings in the top menu. The dropdown menu lists the available pages:

• Usage - View usage metrics and statistics.
• Activity - View activity logs for your organization.
• Alias Mapping - Manage custom labels for AIDR entity attributes.
• Users - Browse users synced from external identity providers.
• Memberships - Create and manage groups for users, applications, and models.

Select a page from the dropdown to open it. The selected page and other Settings pages appear as tabs in a second row at the top of the console.

Activity logs

On the Settings > Activity page, you can view activity logs for your AIDR account.

Overview

Organization activity logs include the following types of events:

• Membership changes and other organization-level updates
• User logins
• Collectors and Policies configuration changes
• Updates to AIDR service configuration

Each logged event contains:

• Time - Date and time of the event
• User - User who performed the action
• Action - Description of the action performed
• Target - ID of the affected resource
• Message - Short summary of the event
• Old - Previous value of the resource
• New - Updated value of the resource

Changed values in the Old and New fields are highlighted in yellow.

Filter activity logs by date range and attributes. The search bar refines results with:

• Completion suggestions for available attributes and their values
• Filter dialog (funnel icon)
• Date range control

Click the gear icon to select which columns are visible in the log table.

Sort the table by clicking column headers.

Search bar

By default, the log viewer displays events from the past two hours.

To customize your search:

• Click the funnel icon to open the filter dialog, enter your criteria, and click Search. The search syntax appears in the search bar, and matching results display in the table.
• Place your cursor in the search bar to view a dropdown of available search parameters. Start typing to filter the list and use autocompletion to build your query.
• Enter your query manually. For more information, see search syntax.

Date range

All searches must include a time range, with the default set to the most recent two hours.

The date range selector next to the search button provides several options:

• Quick selections - Select a relative range of 1, 7, or 30 days.
• Relative - Define a custom relative date range.
• Between - Search for log events between two specific dates.
• Before - Search for events that occurred before a specific date.
• After - Search for events that occurred after a specific date.

You can apply a time range filter directly from the log table. Add a time field to the table columns, then hover over its value in a table row. Click the plus icon (⊕) next to it to filter by that exact date or set it as a range boundary.

Event details

To view all fields for an event, click its row in the search results. The row expands to show every event field, including those not currently visible in the table.

If a field (such as Old or New) contains JSON data, it displays as an interactive JSON tree.

Alias Mappings

Alias mappings assign custom labels to AIDR entity attributes displayed on the Visibility and Findings pages.

Manage alias mappings in Settings

On the Settings > Alias Mapping page, click Create to add a new mapping with the following details:

• Field - Attribute to map, such as User, Application ID, or Provider
• Source Identifier - Original value of the selected attribute
• Alias - Custom label that displays instead of the original value

Click Save to create the mapping.

To edit or delete a mapping, click the menu icon in its row.

Manage alias mappings on Visibility and Findings pages

On the Visibility and Findings pages, you can add or edit alias mappings directly by hovering over an attribute value and clicking the pencil icon.

Aliased values are highlighted.

Users

The Settings > Users page displays user accounts synced from external identity providers via Falcon Identity Protection. This page is read-only and reflects the current state of your directory.

The page has subsections for each connected identity provider:

• Entra ID - Users synced from your Microsoft Entra ID directory.
• Active Directory - Users synced from your Active Directory domain.

For more information on Falcon Identity Protection, see Identity Protection Overview.

Search for a user

Enter a user email in the search field and click Search. The search requires an exact match on the email address.

View user details

Click a user row to open the user details popup with two tabs:

• Details - Displays the user's synced attributes from the identity provider.
• Groups - Lists the groups that the user belongs to in the identity provider.

Click outside the popup to close it.

Memberships

On the Settings > Memberships page, you can create and manage groups for users, applications, and models. Use these groups to simplify Access Rules - instead of listing individual identities in each rule, reference a named group.

The page has three tabs: User, Application, and Model.

User groups

The User tab lists user groups organized by source. The Custom subsection contains groups that you create and manage in the AIDR console. Groups from external identity providers - Microsoft Entra ID and Active Directory - appear in their own subsections.

Custom groups

Custom groups are editable. You can create, rename, and manage members for custom groups directly in the AIDR console.

For more info, see Create a group and Manage group members.

External identity provider groups

The Entra ID and Active Directory subsections list groups synced from external identity providers via Falcon Identity Protection. These groups are read-only.

To search for an external group, enter the exact group ID in the search field and click Search.

To view group members, click View Members on the group row.

Application groups

The Application tab lists custom application groups that you create and manage in the AIDR console.

Model groups

The Model tab lists custom model groups that you create and manage in the AIDR console.

Create a group

To create a group:

1. Click the tab for the group type - User, Application, or Model.
2. Click Create Group.
3. Enter a Display Name for the group; for example, Patient Room Chatbot. AIDR generates a group key from the display name; for example, patient_room_chatbot.
4. Click Save.

The group appears in the list and becomes available in access rules.

Manage group members

To add or remove members from a group:

1. Click Manage Members on the group.
2. Add members by entering their identifiers:
   • For user groups: user IDs or names
   • For application groups: application IDs or names
   • For model groups: model IDs or names
3. Click Save to apply the changes.

When you enter a name that contains spaces, AIDR converts it to tuple identifier format by replacing spaces with underscores. For example:

• Jeffrey Goines becomes Jeffrey_Goines.
• Patient room Chatbot becomes Patient_room_Chatbot.
• GPT 5 becomes GPT_5.

Use groups in access rules

After you create groups and add members, you can reference them in policy access rules. Use the user.groups, app.groups, or model.groups attributes with the includes or excludes operators.

Custom groups

AIDR matches group members against the following request parameters:

• User groups - user_id and extra_info.user_name
• Application groups - app_id and extra_info.app_name
• Model groups - model and llm_provider

AIDR converts the request parameters to tuple identifier format before matching. For example:

• Jeffrey Goines matches Jeffrey_Goines saved in a custom user group.
• Patient room Chatbot matches Patient_room_Chatbot saved in an application group.
• GPT 5 matches GPT_5 saved in a model group.

For examples, see Group membership > Custom groups in Access Rules.

External identity provider groups

For Entra ID and Active Directory users synced through Falcon Identity Protection, AIDR resolves group membership by matching request user_id and extra_info.user_name values against the synced user's email, user principal name, and user ID, and uses the first match.

For examples, see Group membership > External identity provider groups in Access Rules.

Appendix

Search syntax

The Search feature supports a simple search grammar for finding specific events in the logs.

note:

The search queries are case sensitive.

Simple search

A search query accepts key-value pairs to target a specific field, or plain text to search across all fields. For example, accessed searches for the term accessed across all fields and returns events where a user read configuration.

Single field search

Use the format <field_name>:<value> for a single field search. The field name must exactly match the target field. The search performs a partial match on the field value.

For example: user:"nedry" searches for any event where the user field contains the word nedry.

To exclude specific values, add a minus (-) prefix to the search term. For example, -user:"nedry" returns all results where the user field does not include the word nedry.

tip:

You can use > or < operators to filter by date. For example, received_at<"2025-11-29".

Using multiple search terms

Join multiple search terms with the AND and OR operators. For example, to search for events where the user field contains nedry and the action contains accessed, use the following search string:

user:"nedry" AND action:"accessed"

Grouping search terms

Group search terms with parentheses. For example, to search for events where the user is "nedry" or "murphy" and the action is "accessed", use the following query:

(user:"nedry" OR user:"murphy") AND action:"accessed"

Escaping characters

To include a backslash \ or quotation mark " in your search criteria, escape it with a backslash. For example:

message:"Project \"Production\" accessed by dennis.nedry"