Adding a tag to leavers in identity

[sysjohn]

Hello All,

Wondering if anyone can help? I am currently looking at RBA and adding a multiplier to any users that are leaving. At first glance, I was wondering whether to look at risk_object_endDate=*, but am now wondering how the lookup for identity works and if I can be clever and add a category "leaver" to the user (or risk_object_identity_tag that index=risk will pick up). From some research I think the identity lookup is being ran by many searches but mainly from ldapsearch. Does this mean it is picking up categories from LDAP? Not sure how to check what the lookup is running to fill it's contents.  Any help/guidance would be great!

Thank you,

J.

[ro_mc]

The good news is that you can definitely add your own fields. However, it may be best to make use of the existing fields as shown in the link below. I suggest this because ES has changed the fields for these lookups in the past, and changes to the default may complicate migrations or upgrades in the future.

https://docs.splunk.com/Documentation/ES/latest/Admin/Formatassetoridentitylist#Identity_lookup_head...

Fields that might meet your need include category, watchList & endDate (as you mentioned). You can then create your own identity list and optionally prioritise it to ensure that any risk ratings apply to the values you've entered rather than those obtained through other sources such as LDAP/AD.

If you're not worried about data migration, or if you're comfortable modifying a migration script to include your additional source field if necessary, you can follow the steps below to add or modify identity fields for the current version. Be aware that any existing lookups will need to have the additional field name and column added for existing entries to prevent errors from occurring when these lookups are queried.

https://docs.splunk.com/Documentation/ES/6.6.2/Admin/Identitysettings

Hope this helps.