Can you help with an Issue merging identities from two lookup tables in Enterprise Security?

[ehowardl3]

I have identity information I am pulling from two different sources in two different lookup tables. One lookup table has most of the identity columns populated, except for the "nick" column. The other lookup table has only the "email" and "nick" columns populated.

My expectation was that when the identity merge happens, I would only have one identity per email, and that identity would have all of the identity columns populated, including the "nick" field.

What actually happens is I get two separate identities per email address, with each identity only containing the information from its respective lookup table.

Is this expected behavior?

Thanks,
Eric

[starcher · Accepted solution]

That is expected. Unfortunately... ES does not expect you to have duplicate identities in multiple tables. It doesn't "merge" identities well. It really merges sources. It expects you to have a row per identity. You should use your second lookup to fixup the first before feeding the combined result to ES.

The identity and asset system in ES is in need of updating to handle things like you describe gracefully. So for now it is better you do the touch up before feeding it to ES.

[ehowardl3]

Thanks, for the response, that's what I was afraid of...