The Unknown section, under Identities, provides visibility into interactions with AI applications and assets where the user identity could not be determined. These entries typically represent activity from unmanaged, unauthenticated, or unrecognized sources, and may indicate potential gaps in identity visibility or control.
The table displays a list of unidentified entities interacting with AI services with the following details:
- Source IP – IP address of the unknown entity (primary identifier).
- Hostname – Hostname associated with the entity, if available.
- #d Apps – Number of AI applications accessed in selected time range.
- #d MCP Servers – Number of MCP servers interacted with in selected time range.
- #d Bytes – Volume of data exchanged with AI services in selected time range.
- First Seen – Timestamp indicating when the activity was first detected.
- Last Seen – Timestamp of the most recent activity.
Click any row to open the unknown identity detail panel.
