Question

If multiple user attributions are set, how do they interact? 

Answer

User attribution is the process to identify a USER ID and the user role. Once Traceable identifies the USER ID and user role, it is easier to associate them with the user action. User attribution is also required to attribute the user requests across multiple user sessions. Correctly configured user attribution helps in identifying the threat actor activities. For more information around user attribution, check out our docs.

When multiple user attributions are set, the first rule matched will be how the user is defined.