CrowdStrike / falcon-orchestrator

CrowdStrike Falcon Orchestrator provides automated workflow and response capabilities
GNU Affero General Public License v3.0
185 stars 60 forks source link

User AD Metadata not included in email alerts but is stored in DB and viewable in the UI #27

Open mr-burnse opened 7 years ago

mr-burnse commented 7 years ago

When the AD Lookup processing rule is enabled a query against LDAP will only be performed if either the username does not exist in the orchestrator DB already or if the "days active" threshold has been exceeded. This is to reduce making an LDAP query for an account over and over when the metadata has already been resolved/stored. When this occurs (there is a local copy and no LDAP query) the metadata is not being pulled from the local DB and inserted into the email template.