How to represent linux group data in UDM?

[Kalia-66]

Hi! We’d like to ingest some UDM data about group creation events (specifically linux groups created on a host via a cmdline process or other similar means), and we were wondering if you guys have any recommendations for how best to represent this kind of group in the UDM? I initially wanted to use the Group entity ( link ), but upon closer inspection of the fields, it seems like that entity is more intended for organizational groups (eg. LDAP groups)? So, we were wondering if anyone has any suggestions for a good way to represent linux group data in UDM?