Gathering user's manager details with LDAP lookup plugin
Article ID: 258271
Updated On:
Products
Issue/Introduction
By default DLP does not know the manager's details of the user who triggered an incident. This information may be required in incident remediation process, or to sent automatic e-mail notifications whenever such event occurs. Provided that this information is configured in Active Directory it can be obtained via a LDAP Lookup plugin.
This article describes how to obtain the manager's First Name, Last Name, Phone Number and E-mail address. During the process new LDAP Lookup plugin will be created, however the provided information can also be used to modify/add gathering of the manger's details into an existing one.
Environment
15.7, 15.8, 16.0
Resolution
Prior to proceeding with the steps below create a Directory Connection in your Enforce Console as described in the document below. It will be necessary for the LDAP plugin to work. If done previously this can be skipped.
Configuring directory server connections
Once done proceed with the following steps to create the plugin:
1. In the Enforce Console navigate to System -> Incident Data -> Lookup Plugins
2. Create a new plugin by using the New Plugin drop down button and select "LDAP". Alternatively edit an existing LDAP lookup plugin by using the pencil button next to it.
3. If creating a new plugin provide the Name and select the Directory Connection that should be used. In the Attribute Mapping field paste the following:
attr.TempManager=:(|(mail=$sender-email$)(sAMAccountName=$file-owner$)(sAMAccountName=$endpoint-user-name$)):manager
attr.Manager\ Name=:(distinguishedName=$TempManager$):givenName
attr.Manager\ Surname=:(distinguishedName=$TempManager$):sn
attr.Manager\ Email=:(distinguishedName=$TempManager$):mail
attr.Manager\ Phone=:(distinguishedName=$TempManager$):telephoneNumber
The first line obtains the distinguishedName of the manager from the incident's user AD details and inserts it into TempManager variable which is used in the next lines to obtain it's attributes. LDAP name attribute is bound to DLP attribute "Manager Name", sn to "Manager Surname", mail to "Manager Email", telephoneNumber to "Manager Phone". The backslash character "\" escapes the space character from the name as configured in Attributes described later.
4. Save the changes
5. To accommodate the data from the plugin in incidents it is necessary to create custom attributes for the fields configured in the "Attribute Mapping" field. To do that navigate to System -> Incident Data -> Attributes and change the tab to "Custom Attributes".
6. Click Add in the top section of the Window and create the following attributes:
Manager Name
Manager Surname
Manager Email
When adding the Manager Email attribute make sure to select the "Is Email Address" box. This will enable to select this attribute as recipient in the Send E-mail Notification response rule. Do not do this for any other attribute which is not an e-mail address.
Manager Phone
7. As the last step it is necessary to ensure that the LDAP Lookup plugins created in early steps is enabled. Navigate to System -> Incident Data -> Lookup Plugins
8. Click on "Modify Plugin Chain" in the top section of the screen.
9. Make sure that "On" checkbox in the Dedicated Actions is marked next to the plugin.
10. Save your changes.
At this point the Plugin should be ready to work. You can either navigate to an existing incident and use the Lookup button, or wait for the next incident to come. By default lookup is performed automatically as the incident arrives to the Enforce server.
Additional Information
Any other Manager detail from AD can be obtained using the same method. Follow the same process and edit the lookup script with a new line to gather an AD attribute of interest and add a custom attribute to hold the data.
For a tutorial on LDAP Lookup plugins you can refer to the link below:
Feedback
