By connecting to the Ldap / AD server via Logsign, we can enrich the all logs with user attributes as automatically from Ldap / AD Server (such as Department Names, Display Names, Mobile Phones).
In addition, we can add other retained attributes for the user activities. For example the number of times a bad password login attempt has been made.
First of all, an LDAP connection must be defined in Logsign for this process. LDAP connections are added as an LDAP device under Settings › Integrations › Responses (LDAP card, Configure tab, + Device); the Add New Connection button in the bucket form opens the same page. You can seek help from integration articles for this procedure.
Then we can create an LDAP list from Settings › Alerts & Incidents › Buckets in the Logsign Unified SecOps Platform interface. Click + Bucket and, in the Add List form, select LDAP/AL as the Type (this is the LDAP/AD list type; the option is currently labeled LDAP/AL in the interface).
We select our LDAP connection in the Connection field, then fill in Search Domain (for example DC=TEKNIK,DC=LOCAL), Query (for example objectClass=user) and Key Field. Key Field is the LDAP attribute whose value is matched against the log column, for example sAMAccountName.
The Collect Fields field should be written as “badPwdCount”, if we get the count of Bad Pass Usage for the users. Update Period and Purge Period (in seconds, default 60 and 3600) are also required: the first sets how often the list is refreshed from LDAP, the second how long a collected value is kept in the list.
In the Modifier section, Match Conditions is optional; use it if the modification should apply only to logs that match certain conditions. Then we select the log column that holds the user name as the Key Field, for example Source.UserName, so the user name in each log is looked up in the list by the LDAP Key Field attribute (the match is not case sensitive). The Key Field list shows the columns of the field set used on your system. The Select bucket (optional: search in different buckets) box can be left empty. In the field and value boxes below it we write Destination.PwdCount and $value, then click Add. The row appears in the table with the Key Field, Modify Field, Value and Buckets columns. For every matching log, the badPwdCount value from LDAP is written to the Destination.PwdCount column.