How work Active directory connector

Comments

2 comments

  • Official comment
    Matt

    Hi informatique, thank you for the detailed information. 

    For DNS enrichment, the packet engine uses six different techniques to map IP addresses with hostnames.

    In order of priority (highest priority appears first and takes precedence):

    1. OPNsense alias definitions
    2. Active Directory / LDAP
    3. In-flight Reverse DNS query
    4. Cached DNS request/responses
    5. LLMNR
    6. MDNS

    So, in case you do not have any OPNsense alias definitions for that IP addresses, AD supplied hostnames should take precedence. 

    For the "Top Egress Users" graph, normally if another user logged in after you logged out of the maintenance user, that should appear in the reports. 

    Send a PR if you think we should have a look. A team member will follow up shortly. 

    Comment actions Permalink
  • informatique
    it is indeed the name of the alias which is actually raised
    0
    Comment actions Permalink

Please sign in to leave a comment.