What are unknown identities?
Unknown identities appear in logs or directories but lack enough context for confident prioritization—uncertainty about role, ownership, or privilege, not simply an unmapped username.
What are unknown identities?
Short answer
Unknown identities are users or service accounts that appear in activity or directory sources but lack enough context for confident security decisions—uncertainty about role, ownership, or privilege, not simply an unmapped username.
Explanation
Authentication logs, cloud audit trails, and federation events may surface principals before anyone assigns meaning to them. Until context is enriched, analysts should treat these as decision gaps: activity may be real, but priority and blast radius are unreliable. Resolving unknown identities means improving context, not only closing directory tickets.
Guide: Unknown Identities (KID-CON-0095).