cancel
Showing results for 
Search instead for 
Did you mean: 
mariajohn14
Level 9

how to pull the users list from asset data source

how to get the AD users & groups list from McAfee SIEM.

Regards,

John

0 Kudos
3 Replies
roel
Level 7

Re: how to pull the users list from asset data source

Hi John,

You would need the asset manager for that. This is not related to a data source, but related (to/gathered from) the ESM.

There is a complete chapter devoted to this in the product guide.

Regards,

Roel

0 Kudos
nitron00b
Level 7

Re: how to pull the users list from asset data source

Select a McAfee Receiver that is near a Domain Controller.

Select Receiver Properties>Asset Sources>Add

  •      Type = Active Directory
  •       Name = Anything, maybe the domain
  •        Zone = None
  •        Priority = 5
  •       IP Address = One of your Domain Controllers (nslookup your domain)
  •       Port = Ask your AD guy likely 389
  •      UserName that will query AD
  •      Password
  •       Search Base = something like: DC=yourcompanydomain,DC=com

Click Connect to test   Once run, computer assets will appear within Asset Manager.

For Users you maybe wishing to resolve userID's to john doe(s).

     Select System Properties

     Select Data Enrichment

     You'll need to likely do an LDAP query.

     You setup similarly to adding an asset source, but map SAMAccountName to an Enrichment Field

     There are some good tutorials on here, try looking up "Data Enrichment".

0 Kudos
lkokyong
Level 7

Re: how to pull the users list from asset data source

Hi.

Can we use port 636(LDAPS) for this?

0 Kudos