Skip to main content
Clusters group several like-minded Personas so analysts can reason about cohorts, not only individuals. Clustering supports continuous drift measurement from enrollment onward by giving each identity a stable peer context for comparison.

​
What are Clusters

TOTAL clusters Personas with a modified DBSCAN approach. Grouping emphasizes accuracy and ease of risk assessment, with highest weight on risk-sorted attributes so cohorts align with how security teams think about exposure and behavior similarity—not merely org chart proximity. Cluster membership enables drift from cluster (see Drift Insights) and metrics such as cluster switching volatility when identities move between behavioral cohorts over time.

​
Cluster View

From the Persona Directory, open the cluster grid to see all clusters as cards with counts, or open a specific cluster’s detail page for cohort-level attributes and members.
Cluster View
For the directory grid layout, see Persona Directory — Cluster View.

​
Shared Attributes

Cluster pages summarize Shared Attributes across members—typically organized into areas such as:
  • Job Function: role-aligned behavior and access congruence signals.
  • Routine: work rhythm, geo-temporal, and stability-related dimensions.
  • Reputation: continuity, enrollment trust, and peer-relative standing where modeled.
Exact fields reflect your deployment’s signal configuration.

​
Member Personas

Each cluster lists member identities with roles and links into individual Persona pages. Use this list to investigate outliers within a cohort or to compare a user to their cluster baseline in Persona Signals. Related: Personas overview, Persona Directory, Persona Signals.