Lookup for incidents fail to populate detail in the incident either automatic or manually.

Products

• Data Loss Prevention Endpoint Prevent

Issue/Introduction

We have some problems with the LDAP lookup plugin. 

I’ve checked directly on our LDAP and the user for which the lookup fail is there, with all the attributes we search for.

 

Environment

 

Component : Lookup Plugin

Cause

Misconfigured setup. 

Resolution

After configuring the Lookup you should only have the appropriate keys selected for the type of incident that you will be performing the lookup on. 

Remove the Lookup keys which are not in use and reloaded the lookup so not all keys are selected, only they ones you really need.

The Lookup Parameter Keys can be found in the Enforce console page System> Incident Data > Lookup Plugins -> Click on the Lookup Parameters button to open the page.   

This may be applicable for other Lookups too.