I need to find all the users in a OU in Active Directory, currently I run | ldapsearch domain=internal.local basedn=,OU=Finance,OU=Users,DC=internal,DC=local" scope="sub" search="(objectClass=user)" that gets me all the users in the OU. I also export all the users event from safend to a table using
index=safend source=Safend_DataEventsView sourcetype=dbx2 | sort by -_time | convert timeformat="%d/%m/%Y %I:%M:%S %p" ctime(_time) | replace 0 with Read, 1 with Write | eval megabytes=((FileSize/1024)/1024) | eval "File Size"= megabytes + " MB" | table _time, User, FileName, FileExtension, ClientHost, DeviceDescription, FileOperation, "File Size" , IPAddresses, PolicyName, ClientVersion | rename _time as Time, DeviceDescription as "Device Description", FileName as "File Name", FileExtension as "File Extension", ClientHost as "From PC", FileOperation as "File Operation", PolicyName as "Policy Name", IPAddresses as "IP Address", ClientVersion as "Client Version"
I need to find a way I can first find the users using the ldapsearch and then generate a table using the above command.
When I run the LDAP command in a sub search no data is shown to run the second command find.
↧