3 Replies Latest reply on Nov 16, 2016 2:24 AM by lkokyong

    how to pull the users list from asset data source

    mariajohn14

      how to get the AD users & groups list from McAfee SIEM.

       

      Regards,

      John

        • 1. Re: how to pull the users list from asset data source
          roel

          Hi John,

           

          You would need the asset manager for that. This is not related to a data source, but related (to/gathered from) the ESM.

          There is a complete chapter devoted to this in the product guide.

           

          Regards,

          Roel

          • 2. Re: how to pull the users list from asset data source
            nitron00b

            Select a McAfee Receiver that is near a Domain Controller.

            Select Receiver Properties>Asset Sources>Add

            •      Type = Active Directory
            •       Name = Anything, maybe the domain
            •        Zone = None
            •        Priority = 5
            •       IP Address = One of your Domain Controllers (nslookup your domain)
            •       Port = Ask your AD guy likely 389
            •      UserName that will query AD
            •      Password
            •       Search Base = something like: DC=yourcompanydomain,DC=com

             

            Click Connect to test   Once run, computer assets will appear within Asset Manager.

             

            For Users you maybe wishing to resolve userID's to john doe(s).

                 Select System Properties

                 Select Data Enrichment

                 You'll need to likely do an LDAP query.

                 You setup similarly to adding an asset source, but map SAMAccountName to an Enrichment Field

                 There are some good tutorials on here, try looking up "Data Enrichment".

            • 3. Re: how to pull the users list from asset data source
              lkokyong

              Hi.

               

              Can we use port 636(LDAPS) for this?