LDAP
| eventName | Description | Sample | Rule |
|---|---|---|---|
| bind_ | An LDAP bind (authentication) succeeded. | N | N |
| bind_ | An LDAP bind (authentication) failed. | N | N |
| search_ | An LDAP directory search completed successfully. | N | N |
| search_ | An LDAP directory search failed. | N | N |
| unbind | An LDAP client terminated its connection (unbind). | N | N |
search_success: Search Success
#Description
An LDAP directory search completed successfully.
References #
any: LDAP (any event)
#Scope grouping: This repository-authored catalog entry represents a broad attribution scope, not a distinct emitted event or operation. Any sample below is a representative record from that scope; attached rules, if any, are listed separately.
Description
Source-only rules that filter on applicationName 'ldap' without specifying an eventName attribute here.