LDAP integration

[smnschneider]

It would be useful to create a integration for getting data via LDAP (e.g. Active Directory)

There are a lot of security cases, where you need to get data from LDAP and compare those with your actual data.
It is also useful to track changes within groups or for specific user in more detail then getting it from Windows Event Logs.

So functions to get results for specific LDAP queries would be great.

[legoguy1000]

You're looking for a new input to query LDAP and index the results? Thats a interesting idea.

[smnschneider]

Yes that`s right. For the moment i use a Python script to query and ingest this data. A integration would help a lot here.

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[jamiehynds]

@smnschneider integrating with directory services to ingest user and asset information is certainly on our roadmap. We are planning a proof of concept with AzureAD in the short-term to identify any architecture gaps we may have to overcome in order to ingest this data.

FYI @taylor-swanson

[willemdh]

Any news about this? Plus, please support ldaps.. :)

[jamiehynds]

@willemdh we are making good progress with an 'AzureAD Entity Analytics' package which will ingest user metadata. We plan on adding support for device metadata in the future too.

The package is still being worked on, but you can view the PR here: #5638