LDAP lists is another type of enriching logs for LDAP information. Lists match LDAP information of specific group/users and writes exact LDAP values to desired logs.
LDAP/AD lists are managed under Settings > Alerts & Incidents > Buckets. When you add a new list, the Add List page opens with the Definition, Data and Modifier sections.
In the example above, the department information of the users registered on Ldap is retrieved and the Source.DepartmentName column is opened to all logs. Thus, the logs are enriched with this information from Ldap.
In Definition;
Description: In terms of definition, you need to specify a name for the list. Only letters, numbers, spaces and the characters _ . - / are accepted.
Type: LDAP/AL
Group: Select the group of the list: Behaviour, Intelligence, Asset or Other.
Severity: The part you are going to specify is what importance it has. The options are Emergency, Critical, Warning and Information.
Context: You can tag the object, which enters this list, as Suspicious, Attacker, Victim or Vulnerability for future events. Select Not Set to leave it empty.
Tags: You can add tags to the list. Tags can also be used to filter the lists on the Buckets page. (Click for directing Tag Feature)
Roles: You can select the roles associated with the list.
In Data;
Connection: Select the LDAP connection that the list will use to receive additional column information from your LDAP server. Connections are defined as Ldap devices under Settings > Integrations > Responses. You can also use the Add New Connection button in the drop-down list to go to that page.
Search Domain: Enter the base DN to search in, for example DC=TEKNIK,DC=LOCAL.
Query: Enter the LDAP filter that selects the objects to read, for example objectClass=user.
Key Field: Enter the LDAP attribute that identifies each entry, for example sAMAccountName. Its values are stored in lowercase and are matched with the log field you select in the Modifier section.
Collect Fields: Enter the LDAP attribute whose value will be written to the logs, for example displayName or department.
Update Period: The interval, in seconds, at which the LDAP query runs and the list is refreshed. The default value is 60 seconds.
Purge Period: The number of seconds an entry retrieved from LDAP is kept in the list. Entries that are not refreshed within this period are removed. The default value is 3600 seconds.
In Modifier;
Match Conditions: Optionally, add conditions that a log must meet before the list is applied.
Key Field: Select the log field to match with the list (for example the user name field of the log), optionally select other buckets to search in, then enter the field to create and its value (for example Source.DepartmentName) and click Add. In the example above, the user names in the logs are matched with the LDAP entries and the Source.DepartmentName column is filled with the department of the user.
Then you use the Save button to save settings.