Where does Forticlient pull user information from?

Using EMS and selecting an endpoint I can view the user information, and that it pulls LDAP from what I assume is an event ID of the 462X types as those contain user security group information.... Or doing a poll of the LDAP of some kind as it's getting OU info.

It displays the users "logon name" however it doesn't seem to pull in the additional information.

We have pretty much the standard AD user attributes all filled in (Meaning if you queried the "email" or UPN field it would contain the relevant information.)

However this information is not displayed on the user field within EMS.

It's not a breaker rather in one domain the user login is an ID... Which we then still need to look up to put a face to an ID... Would be nice just to see such relevant information upfront.

Thanks