cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Re: Create Watchlist populated with members of Active Directory Group

Hi
thanks! do you know if there is a place that is kind of an internal knowledge for this type of queries to use? more examples?
riccip
Level 7
Report Inappropriate Content
Message 12 of 14

Re: Create Watchlist populated with members of Active Directory Group

Has Anyone Got this working I get "Received malformed data (ER1010)" with all the example given???

forgot to mention tried the username@domain.com what worked for me was domain\username

and I now get

ERROR

invalid attribute description

now to find out why.... Anyone know what the attribute description that can be used in the SIEM?

jp
Level 9
Report Inappropriate Content
Message 13 of 14

Re: Create Watchlist populated with members of Active Directory Group

We have got this working with a simple LDAP query. You need to setup a dynamic watchlist and then enter the relevant LDAP query into the query field. 

 

Alternatively, I also have another watchlist which I populate differently. I make the LDAP query from a Linux server, then enrich the data on that Linux box. Finally, the Linux box makes an API call to ESM to populate the watchlist. This happens nightly so the watchlist is always current. 

Re: Create Watchlist populated with members of Active Directory Group

In the Watchlist window, how to incorporate the queries ? what is the type? Do you have any examples.
You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community