> For the complete documentation index, see [llms.txt](https://docs.stoik.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.stoik.io/mdr/management/users.md). # Users table The `MDR` > `Monitored Assets` > `Users` page on Stoïk Protect lists all Active Directory users monitored by the MDR service. Each user is assessed for identity-related risks such as weak or aged passwords, stale accounts, and more.

All values displayed in this table are retrieved directly from CrowdStrike. Stoïk displays them as-is and does not calculate or modify them. ## Columns Each row in the table displays the following information:

Column	Description
Status	Whether the user account is Active or Inactive. Inactive users are archived accounts no longer in use.
Name	The display name of the user in Active Directory.
Risk	A risk score severity level: Normal, Medium, or High, based on the combined risk factors detected for this user. Users with a risk score greater than 7.5 are considered high risk, indicating a high probability of compromise.
Attributes	Special flags assigned to the user by security analysts. See Attributes.
Risk factors	The specific identity risks detected on this user. See Risk factors.

You can search for a specific user by name using the search bar at the top of the table. ## Attributes Attributes are special flags used by security analysts to track specific users or set traps for attackers. They appear as icons in the Attributes column.

Attribute	Meaning
Marked	Users singled out by security analysts for easy identification throughout the console. This flag remains active for 48 hours by default.
Watched	Users requiring special attention, such as those who have resigned, are under notice, or are suspected of being motivated to cause organizational harm.
Honey Token	Deceptive accounts used to lure attackers. Any activity or change related to a Honey Token account triggers a dedicated detection indicating malicious network activity.

## Risk factors Risk factors are specific identity vulnerabilities detected on a user account. Each factor appears as a badge in the Risk factors column. The more risk factors a user has, the higher their overall risk score will be.

Risk factor	Meaning
Insufficient password rotation	The user's password is set to never expire, providing attackers an unlimited timeframe to conduct brute-force attacks. It is recommended to enforce a policy requiring users to change passwords periodically.
Aged password	The user's password has not been changed for an extended period of time.
Exposed password	The user's password has been found in a known data breach or in Group Policy Preference objects, making it potentially visible to unauthorized users.
Password brute force	A brute force attack has been detected against this user's account.
Shared user	Applied to a user who logs in from multiple locations simultaneously or in a suspicious pattern.
Golden ticket	A Kerberos Golden Ticket attack has been detected, which could allow an attacker to impersonate this user indefinitely.
Stale account	An account that has been dormant or inactive for more than three months. Stale users are risky because they are rarely monitored by the owner, allowing malicious activity to go unnoticed. It is recommended to periodically review stale users and delete or disable accounts no longer in use.
Weak password	The user's password has been identified as weak or vulnerable to dictionary attacks. It is recommended to mandate the use of strong, complex passwords.

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.stoik.io/mdr/management/users.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.