{
  "rules": [
    {
      "description": "Links user entities that share the same email address, compared case-insensitively, across identity providers. Several `local` users with that email (one per user name per host) are linked too. Unlinked users in the same identity provider that share an address are left unlinked. Disable if shared mailboxes or role accounts produce false links.",
      "enabled": true,
      "id": "email_exact_match",
      "kind": "same_field",
      "managed": true
    },
    {
      "description": "Links user entities that share the same SID (`user.id`), including several `local` Windows or CrowdStrike endpoint users on different hosts. Windows domain accounts seen on several hosts are linked even before the Active Directory user is ingested; Active Directory entity analytics is needed only to link or retarget to that AD user once it arrives. A SID names one account, so duplicates in any namespace are the same account (identifier drift), not a collision. Excludes well-known SIDs such as LocalSystem and Linux numeric UIDs. Needs Windows or CrowdStrike endpoint events (which create `local` user entities). Disable if well-known SID exclusions are not enough for your environment.",
      "enabled": true,
      "id": "windows_sid_bridge",
      "kind": "same_field",
      "managed": true
    },
    {
      "description": "Links Microsoft Defender (`m365_defender`) identities to Entra ID by GUID-shaped `user.id`. Needs Defender identity events and Entra entity analytics. Disable if Defender SID IAM events leak through the GUID gate.",
      "enabled": true,
      "id": "entra_guid_bridge",
      "kind": "same_field",
      "managed": true
    },
    {
      "description": "Links leftover CrowdStrike-namespace user entities to Active Directory by SID (`user.id`). A SID names one account, so duplicates in any namespace are the same account (identifier drift), not a collision. Excludes well-known SIDs such as LocalSystem and Linux numeric UIDs. CrowdStrike FDR events now create `local` entities, which the Windows SID bridge covers. Disabled by default because the crowdstrike namespace no longer receives entities; enable if leftover CrowdStrike-namespace users should still link.",
      "enabled": false,
      "id": "crowdstrike_sid_bridge",
      "kind": "same_field",
      "managed": true
    },
    {
      "description": "Links Microsoft 365 audit actors (`user.id` UPN) to Entra users (`user.name` UPN), compared case-insensitively. Needs o365 audit events that create user entities (`event.kind: asset`) and Entra entity analytics. Disabled by default because those events currently do not create entities; enable if your environment emits them as asset events.",
      "enabled": false,
      "id": "upn_cross_field_bridge",
      "kind": "cross_field",
      "managed": true
    },
    {
      "description": "Related user alias resolution across identity providers",
      "enabled": false,
      "id": "related_user_alias_resolution",
      "kind": "related_user_alias_resolution",
      "managed": true
    }
  ]
}