USER, LDAP Person extension by useful fields + cloud profile added to support Azure AD - Githubissues

ocsf / ocsf-schema

OCSF Schema

Apache License 2.0

636 stars 137 forks source link

USER, LDAP Person extension by useful fields + cloud profile added to support Azure AD #1122

Open PavelJurka opened 5 months ago

PavelJurka commented 5 months ago

This issue is about adding a few useful fields to LDAP user, User object and adding a way how to map Azure ID to it.

USER:

bad_password_attempts
bad_password_time
created_time
expiration_time
last_login_time
lock_out_time
logon_count
logon_hours
modified_time,
password_last_set_time
password_never_expire
is_privileged,
status
status_id

LDAP Person:

allowed_to_act_on_behalf_of_other_identity
allowed_to_delegate_to
department
display_name
domain
employee_type
employee_type_id
expiration_time
force_change_password_next_sign_in
force_change_password_next_sign_in_with_mfa
parent_dn
proxy_addresses
last_known_parent
member_of"
member_of_guid"
member_of_transitive"
object_category
object_class
object_guid
primary_group_id
resultant_pso
is_service_account
unique_name
usn_changed
usn_created
user_principal_name
user_account_control
user_password_expiry_computed_time
visibility

Active directory profile:

is_privileged
classification
consistency_guid
creator_sid
email_addr"
forest
is_deleted
object_sid
on_premises_distinguished_name
on_premises_domain_name
on_premises_immutable_id
on_premises_last_sync_time
on_premises_sam_account_name
on_premises_sync_enabled
on_premises_user_principal_name
is_recycled
nt_security_descriptor
is_security_group
sam_account_type
service_principal_name
sam_account_name
sid_history
token_groups

mikeradka commented 4 months ago

Could you add some samples of raw data that you are seeking to normalize to OCSF so we can better understand your use case?