title: Contextual Insights category: Intelligence tags: insights, ai, contextual, security-analysis, inactivity priority: Normal

Contextual Insights

Contextual Insights provide AI-powered analysis for every directory object in IdentityCenter. Rather than relying solely on static rules, the ContextualInsightService examines each object's attributes, relationships, and history to generate targeted, actionable findings.

How Contextual Insights Work

The ContextualInsightService processes each directory object through a series of specialized analyzers. Each analyzer evaluates a specific dimension of the object's security posture and produces findings that are compiled into a unified insight report.

Analysis Pipeline

1. Data Retrieval -- The service loads the object's full attribute set, group memberships, login timestamps, and related objects from the synced data store.
2. Analyzer Execution -- Each registered analyzer runs against the object and produces zero or more findings.
3. Prompt Construction -- The InsightPromptBuilder compiles the findings into a structured prompt, including security context such as UAC flags, delegation settings, SPNs, and privileged group memberships.
4. LLM Enrichment -- The prompt is sent to the configured LLM (Anthropic Claude), which produces a narrative analysis with prioritized recommendations.
5. Result Caching -- Results are cached to avoid redundant recalculation for recently analyzed objects.

Insight Types

Inactivity Detection

The ContextualInsightService computes DaysSinceLastLogin for all account types:

Inactivity thresholds flag accounts at three levels:

When an inactive account also holds privileged access (e.g., membership in Domain Admins), the severity is automatically escalated by one level.

Tip: Inactivity thresholds are configurable in the Intelligence settings. Adjust them based on your organization's policies and seasonal usage patterns.

Security Risk Analysis

The security risk analyzer examines Active Directory security attributes for misconfigurations and exposures:

Kerberoasting Risk Detail

When a user account has SPNs registered, the insight includes:

• The specific SPNs registered on the account
• Whether the account has a weak password policy
• Whether the account is a member of any privileged groups
• A recommendation to convert to a gMSA or remove unnecessary SPNs

Group Analysis

The GroupInsightData module analyzes group objects for structural and security issues:

Organizational Anomalies

This analyzer identifies data quality and structural issues in your directory:

UAC Flag Analysis

User Account Control (UAC) flags are examined for each account. The analyzer reports on both security-relevant and operational flags:

The InsightPromptBuilder

The InsightPromptBuilder constructs structured prompts that include full security context for LLM analysis. The prompt contains:

1. Object Identity -- Display name, sAMAccountName, UPN, DN, object type
2. Account Status -- Enabled/disabled, locked, password status, last login
3. Group Memberships -- Full list with privileged groups highlighted
4. UAC Flags -- All active flags with descriptions
5. Delegation Settings -- Constrained and unconstrained delegation details
6. SPNs -- All registered Service Principal Names
7. Analyzer Findings -- Pre-computed findings from each analyzer module
8. Peer Context -- How this object compares to its peer group

This structured context ensures the LLM produces accurate, environment-specific insights rather than generic security advice.

Viewing Insights

In Object Detail Pages

Every object detail page (Users, Computers, Groups, Contacts, OUs) includes an Insights panel that displays the contextual analysis. The panel shows:

• A risk summary with the composite risk score
• Prioritized findings with severity indicators
• Actionable recommendations

In ChatHub

Use the /insights command with an optional object name:

/insights                    -- Environment-wide insights summary
/insights john.smith         -- Insights for a specific user
/insights Domain Admins      -- Insights for a specific group
/insights SRV-DC-01          -- Insights for a specific computer

Or ask naturally: "What are the security risks for john.smith?"

See ChatHub Slash Commands Reference for the full command reference.

In the Intelligence Center

The Intelligence Center dashboard aggregates insights across your entire environment, surfacing:

• The highest-risk identities
• The most common security findings
• Trends in finding counts over time
• Remediation progress

The Analyzer Modules

Each analyzer implements a common interface and can be extended with custom analyzers for organization-specific detection logic.

Best Practices

1. Review Critical insights immediately -- Unconstrained delegation and pre-authentication disabled are exploitable attack vectors
2. Address inactivity systematically -- Use insights to feed your account cleanup process or lifecycle management policies
3. Use insights during access reviews -- Contextual insights displayed alongside review items help reviewers make informed decisions
4. Monitor trend direction -- A rising insight count may indicate a process gap; a declining count confirms remediation progress
5. Train the AI -- The more data the AI has about your environment, the more accurate its insights become. See AI Intelligence Training

Next Steps

• Risk Scoring -- Understand the scoring model behind risk assessments
• AI Intelligence Training -- Train the AI on your environment's patterns
• Intelligence Hub Overview -- Overview of the full analytics platform
• ChatHub Slash Commands Reference -- Query insights through chat
• Directory Browser -- View insights on object detail pages
• Object Write-Back -- Take action on insight recommendations