McAfee MVISION Cloud and MVISION Cloud Connector can display valuable information from your log files to help identify and monitor unusual behavior. However, sometimes you need additional information from outside your log files. By cross-referencing your user information against fields in your Directory Server or from a CSV formatted file, MVISION Cloud can display this information as Custom Attributes.
Before you can map information from your Directory Server to your log data, you must allow Cloud Connector to connect to your Directory Server. After configuring Custom Attributes, you can map User Attributes to Custom Attributes.
Export Your CSV File
- Export a CSV formatted file from your Directory Server with the following information:
- A column of user names formatted exactly as they appear in your logs, case-sensitive. This will be used to match your custom attributes to log information, so an exact match is required.
- One to five columns of data to use for configuring custom attributes for Shadow IT. (There is no limit to the number of custom attributes allowed for Sanctioned IT, using the same file.) This information will be mapped to the user names in the document, so make sure that the columns all relate to one another accurately
- Specify a header in the Domain Setup page.
- Save the CSV file on the system where your Cloud Connector is installed.
Configure a Domain using a CSV File
- Open a web browser and enter the IP Address you set during installation into the address bar.
- Sign in using an email address and password with Cloud Connector permissions.
- Go to Enterprise Integration > Active Directory Integration.
- Click Add a Domain.
- For User Data Source, select CSV.
- To retrieve information from the CSV file, enter the following information:
- Name: The unique name for your integration. This is a user-defined name that will help you identify this integration and it must be unique.
- Directory: The file path of the target CSV file.
- File Name Pattern: The default is .* If this is not enough to identify the file, enter the full name or a pattern that uniquely identifies the CSV file.
- Delimiter: Comma is the default delimiter. If the file is not comma delineated, enter the delimiter used for your file.
- Quote: Double quotation marks are the default. If your file uses another format to specify quotation marks, enter the symbol.
- Header: If your file did not contain a header, or if you would like to edit the header without changing the file, you can create a comma-separated list of header names, as shown in the following screenshot. This field is optional.
- Click Test Connection.
IMPORTANT: The Save button will produce an error until at least one Shadow or Sanctioned setup is configured. Click x to dismiss it.