Check the Activity of a Specific User
You can view all alerts and indicators associated with a user in the User Profile view. In the events table, you can find the events that contributed to a specific indicator for a specific user. You can further investigate on events by clicking on a username that pivots to Investigate > Events. In the Events view, you can see the list of events that occurred on that day for the specific user. By default, the time range is set to one hour. You can change the time range.
To check the activities of a specific user
Log in to NetWitness Platform XDR. Go to Users > Alerts.
Under Filters, click Users.
Select a specific user.