--- title: Entity Packs description: >- Sync your user directory into Cloud SIEM to add identity context to signals, risks, and investigations. breadcrumbs: Docs > Datadog Security > Cloud SIEM > Ingest and Enrich > Entity Packs --- > For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt). # Entity Packs {% callout %} # Important note for users on the following Datadog sites: app.ddog-gov.com {% alert level="warning" %} Entity Packs are not available for the US1-FED Datadog site. {% /alert %} {% /callout %} ## Overview{% #overview %} An Entity Pack is a type of [Cloud SIEM Content Pack](https://docs.datadoghq.com/security/cloud_siem/ingest_and_enrich/content_packs.md) that syncs your user directory into Cloud SIEM. - **Content Packs** bring in log-based security content such as detection rules and dashboards. - **Entity Packs** bring in the identity records behind that activity, so Cloud SIEM can tell you *who* a signal is about, not only *what* happened. When an Entity Pack is active, Cloud SIEM correlates directory users and their attributes with your logs and security signals. Each Entity Pack includes: - **Automated synchronization**: Cloud SIEM syncs users and their attributes from your identity provider so they remain up to date. - **[User Inventory](https://docs.datadoghq.com/security/cloud_siem/triage_and_investigate/user_inventory.md)**: Browse, search, and filter the users synced to Cloud SIEM. View a user's attributes including display name, principal ID, user type, and account status. Investigate all signals, risks, and logs associated with your users. - **User pill in Signals**: Identity context attached directly to a security signal, so you can see who the signal involves while you triage it. - **User risk roll-up in [Entity Risks](https://docs.datadoghq.com/security/cloud_siem/triage_and_investigate/entities_and_risk_scoring.md)**: Risk scores aggregated by user, so you can see a single user's total risk across signals instead of reading signals one at a time. {% alert level="info" %} Entity Packs sync user directory data, which includes personal data such as names and email addresses. Review your organization's privacy requirements before connecting a directory. {% /alert %} ## Available Entity Packs{% #available-entity-packs %} Cloud SIEM supports the following Entity Packs: | Entity Pack | Directory synced | Credential type | | ------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------- | ----------------------------- | | [Okta Identity](https://docs.datadoghq.com/security/cloud_siem/ingest_and_enrich/entity_packs/okta.md) | Okta users and their attributes | Okta domain and API token | | [Google Workspace Identity](https://docs.datadoghq.com/security/cloud_siem/ingest_and_enrich/entity_packs/google_workspace.md) | Google Workspace users and their attributes | Service account JSON key file | | [Microsoft Entra ID](https://docs.datadoghq.com/security/cloud_siem/ingest_and_enrich/entity_packs/microsoft_entra_id.md) | Microsoft Entra ID users and their attributes | Azure app registration | To find them in Datadog, go to **Cloud SIEM** > [**Content Packs**](https://app.datadoghq.com/security/siem/content-packs). Then, filter for entity packs, either by searching for `type:entityPack`, or clicking the **Entity Pack** filter. ## Prerequisites{% #prerequisites %} ### Permissions{% #permissions %} Entity Packs use the following permissions. A user with the [Datadog Admin Role](https://docs.datadoghq.com/account_management/rbac.md) can grant them to a user account. | Permission | What it allows | | ------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------- | | **SIEM Entities Notification** | Users with this permission can modify Entity Risk notifications. | | **SIEM Entities Read** | View synced users in the User Inventory, see the user pill on signals and in Entity Risks, and open an Entity Pack side panel. | | **SIEM Entities Admin** | Everything **SIEM Entities Read** allows, plus connect a user directory, add and remove credentials, and enable or disable synchronization. | | **Integrations Manage** | Required only for the Microsoft Entra ID Entity Pack, to configure the Azure subscription and resource collection. | Every user who works with identity context needs **SIEM Entities Read** or **SIEM Entities Admin**. If a user lacks one of these permissions: - The User Inventory is blank, even when an Entity Pack is active and syncing. - The user pill does not appear on signals or in Entity Risks. - Entity Pack side panels do not open from the Content Packs interface. {% alert level="info" %} Grant **SIEM Entities Read** to your analysts as part of rolling out an Entity Pack. Without that permission, even though the directory syncs successfully, analysts who lack that permission can't see the identity context it provides. If the User Inventory is empty, check permissions before you troubleshoot synchronization. {% /alert %} ### Identity provider access{% #identity-provider-access %} To set up an Entity Pack, you also need administrative access to the identity provider you want to connect, sufficient to create the credential the Entity Pack requires. Each Entity Pack uses a different credential type: - Okta Identity requires an Okta domain and an API token. - Google Workspace Identity requires a Google service account JSON key file, your domain, and a Workspace admin email address. - Microsoft Entra ID requires an Azure app registration. You can create one with the provided Quickstart script or with Terraform, or connect an app registration that already has the required permissions. For the exact provider-side permissions and scopes each credential needs, see the setup page for that Entity Pack. ### Log integrations{% #log-integrations %} An Entity Pack does not require the matching log integration or Content Pack, and the matching Content Pack does not require the Entity Pack. You can sync your Okta user directory with the Okta Identity Entity Pack without sending any Okta logs to Datadog. The two still work best together: the Entity Pack supplies the identity context, and the log-based Content Pack supplies the activity that Cloud SIEM attaches that context to. Configure both to get identity context on signals generated from a provider's logs. ## Entity Pack states{% #entity-pack-states %} Like other Content Packs, each Entity Pack appears as a tile in the Content Packs interface and has two states. Opening a tile's side panel requires the **SIEM Entities Read** or **SIEM Entities Admin** permission. ### Available{% #available %} An Entity Pack you have not connected yet is marked **Available**. Its side panel shows what the Entity Pack provides after you enable it, and lets you connect your user directory. Click **Add Credentials** (or **Add Account** for Microsoft Entra ID) to begin setup. Connecting a directory requires the **SIEM Entities Admin** permission. ### Active{% #active %} After you connect a credential and Datadog validates it, the Entity Pack is marked **Active**. Its side panel shows the health of the Entity Pack: - **Credentials**: Each connected account, with its domain, validation status, enabled or disabled state, last update time, sync status, last sync time, and last sync duration. You can add additional accounts, or enable and disable synchronization for an individual account. - **Key Metrics**: An interactive dashboard showing users synced, users by credential, sync history by credential, and sync duration by credential. - **Entities**: The users synced by this Entity Pack, with display name, principal ID, user type (for example, `human` or `service_account`), and account status. Click **View in User Inventory** to see the full inventory. Use the **Key Metrics** and **Credentials** sections to confirm that a sync is current and that the credential is still valid. ## Set up an Entity Pack{% #set-up-an-entity-pack %} Setup steps differ by identity provider. Follow the guide for the directory you are connecting: - [Okta Identity Entity Pack](https://docs.datadoghq.com/security/cloud_siem/ingest_and_enrich/entity_packs/okta.md) - [Google Workspace Identity Entity Pack](https://docs.datadoghq.com/security/cloud_siem/ingest_and_enrich/entity_packs/google_workspace.md) - [Microsoft Entra ID Entity Pack](https://docs.datadoghq.com/security/cloud_siem/ingest_and_enrich/entity_packs/microsoft_entra_id.md) Each guide walks through creating the credential in your identity provider, adding it in Datadog, and testing the connection. ## Further reading{% #further-reading %} Additional helpful documentation, links, and articles: - [Set up the Okta Identity Entity Pack](https://docs.datadoghq.com/security/cloud_siem/ingest_and_enrich/entity_packs/okta.md) - [Set up the Google Workspace Identity Entity Pack](https://docs.datadoghq.com/security/cloud_siem/ingest_and_enrich/entity_packs/google_workspace.md) - [Set up the Microsoft Entra ID Entity Pack](https://docs.datadoghq.com/security/cloud_siem/ingest_and_enrich/entity_packs/microsoft_entra_id.md) - [Browse synced users in the User Inventory](https://docs.datadoghq.com/security/cloud_siem/triage_and_investigate/user_inventory.md) - [Explore entities and risk scoring with Entity Risks](https://docs.datadoghq.com/security/cloud_siem/triage_and_investigate/entities_and_risk_scoring.md) - [Learn more about Cloud SIEM Content Packs](https://docs.datadoghq.com/security/cloud_siem/ingest_and_enrich/content_packs.md) - [Learn more about the Investigator](https://docs.datadoghq.com/security/cloud_siem/triage_and_investigate/investigator.md) - [Review Datadog role permissions](https://docs.datadoghq.com/account_management/rbac/permissions.md)