We've been working with SecKit for the last few weeks with our identities. There are a lot of moving parts but specifically for the identities portion, after you have populated your "seckit_idm_windows_activedirectory_persons_lookup" there is a saved search that runs a macro every four hours to merge the various lookups: " seckit_idm_windows_ad_identities ". For each different lookup under "SecKit_SA_idm_windows" that macro will look across the "seckit_idm_windows_activedirectory_persons_lookup" and match up the various fields (e.g. identity, account, memberOf, etc.). For the "seckit_idm_windows_identities_nha lookup" it is going to search across the identities to attempt a match. However we found that the lookup definition didn't include "WILDCARD(identity)" even though the documentation says it should be a wildcard search. The "seckit_idm_windows_identities_accounts_lookup" does (using the "account" field in the lookup and WILDCARD(account)) and seems to be a better fit when searching across multi-valued identities. Alternatively you could modify the definition of the nha lookup in transforms.conf to include the "match_type= WILDCARD(identity)" as well. [seckit_idm_windows_identities_nha_default_lookup] filename = seckit_idm_windows_identities_nha_default.csv fields_list = identity,nha_category,nha_watchlist,nha_priority case_sensitive_match = false [seckit_idm_windows_identities_accounts_lookup] filename = seckit_idm_windows_identities_accounts.csv fields_list = account,account_category,account_priority,account_watchlist match_type = WILDCARD(account) case_sensitive_match = false ... View more