Hi,  Thanks for the feedback.  Ok I get it but can you tell me "HOW" do I pull identity information from the Web.user field ?    Because one thing I don't understand is when you say "index search can display only what is in the index", it's wrong as in my example the search is index based BUT it also display user information FROM the asset & identity framework.  Proof is in the log (so in the index) there is no information like managedBy, company, ... The user's information integration is done automatically by the framework I supposed. ... View more

Hi,   Just here to add some information about your issue. I don't think this is a error in the documentation but it's just tricky 😊 Indeed it is mentioned : "The list must include all of the tags in the constraint searches for the data model and any additional tags that you commonly use in searches that reference the data model." The important words here are : "in the constraint searches for the data model", I don't know if you noticed but a datamodel have two properties : Events and Searches.   In your example you show the data model "event" and not the searches. If I take another datamodel like "Malware" we can see that here we have a searches which uses tags (malware and operation) ! I think the documentation wants to say that if you want to use SEARCHES of a datamodel then you need to add the tags in the whitelist. (hope this is understandable) Here is a screenshot that illustrate this example. In this example, if you don't had the "operation" tag in the whitelist_tag then the search will not work. Hope this is helpful, have a nice day Xavier ... View more