Technical Tip: Understanding automatic User-Node mapping in FortiDLP

Description

This article describes the reason why the FortiDLP agent has differing version components since 12.3.2.

Scope

FortiDLP Agent, Directory source

Overview

Each user imported from a directory service, such as Entra ID, Google Workspace, or LDAP, is assigned one or more URIs by the FortiDLP Console. These URIs uniquely identify the user and allow their activity to be attributed to them. FortiDLP supports multiple URI schemes, and the sync source determines which of these are applied to a given user.

Recommendation:

Enable 'Sync username mapping' so that an additional username URI is created for each imported user. This improves the likelihood of matching login events to the correct user.

How User URIs Are Used:

FortiDLP uses user URIs to reference different types of identifiers, which allows events to be correlated with a user.

When a synced user logs in to a machine that has the FortiDLP Agent installed, using either their username or email address, the following occurs:

1. The Agent records a login event and sends it to the FortiDLP Console.

2. The Console compares the identifiers in the event data against the URIs of imported users.

3. If at least one of the user's URIs matches the event data, the Console automatically associates the managed node with that user.

Example: Automatic User-Node Mapping

Alice Gammaland is imported from an LDAP directory and is associated with the following user URIs:

{
  "useruris": [
    "mail://alice.gammaland@ldapsynctool.com",
    "sid://S-1-5-21-2086148873-3030998639-626213932-1112@domain",
    "username://alice.gammaland@domain"
  ]
}

Alice then logs in with her username, 'alice.gammaland', on a machine where the FortiDLP Agent is installed. The Agent sends a login event to the FortiDLP Console containing identifying information such as the login username (username) and the user ID (sid).

The Console matches this information against Alice's user URIs listed above. From this single event, the Console automatically associates the managed node with Alice.