Default Active Directory Attribute Mapping

When an Active Directory context table is onboarded, it processes a predetermined set of user attributes that are collected from a Microsoft Active Directory server. This set of attributes is mapped to a set of Exabeam target attributes that are compliant with a common user information model. This model defines a standardized user object for security content across Exabeam products.

The table below lists the predetermined set of source Active Directory attributes and the Exabeam target attributes to which they are mapped. The table is organized alphabetically by the Target Attributes column and contains the following notations:

* (asterisk) – Indicates attributes that are selected for display by default when onboarding an Active Directory context table. During onboarding, you can choose to display or not display any of the available predetermined attributes by toggling the visibility icon ().
(Calculated) – Indicates attributes that are calculated, either in format or in value. During onboarding, you can hover over the Calculated Attribute tag in the Source Attributes column to view a description of the attribute and its calculation.
(Primary Key) – Indicates the attribute that is designated as the key attribute for the context table. The key and its mapping cannot be changed.

Active Directory Source Attribute	Exabeam Target Attribute	Example	Description
userAccountCountrol	Access Status (Calculated)	`AccountActive`	A hexadecimal field that indicates the status of the user's account. Calculated by mapping the status of a user account to one of the following Exabeam status values: AccountExpired AccountDisabled AccountLockout PasswordExpired AccountActive
accountExpires	Account Expires	`2023-01-31T14:15:14Z4`	Date when the account expires, based on the password policy of the Active Directory server.
mailNickname	Alias	`jim.smith`	An email alias that represents a user in a Microsoft Exchange organization.
l	City Name	`Philadelphia`	A locality, such as a town or city, in a user's address.
CN	Common Name	`Jim Smith`	Common name attached to the user object.
co	Country	`US`	Country or region where the user is located.
department	Department*	`Engineering`	Name of the department in which the user works.
departmentNumber	Department Number	`1100`	A number used to identify a department within an organization.
directReports	Direct Reports (Calculated)	`John Doe:Chris Brown:Kelly Green`	List of users who report directly to a user. Listed users all have their `manager` attribute set to this user. Calculated by extracting a list of CN values from the DN strings of `Direct Report` attributes. Concatenated with colons (:).
displayName	Display Name*	`Jim Smith`	The name displayed in the address book for a user. This attribute is usually represented by a combination of first name, middle initial, and last name.
dn	Distinguished Name	`CN=admin,DC=acmecorp,DC=com`	The name that uniquely identifies a user object, in an organization structure, within the Active Directory. For a glossary of terms, see the Microsoft Documentation Reference
division	Division	`R&D`	A user division.
dn	Domain FQDN (Calculated)	`corp.acmecorp.com`	A fully qualified domain name. Calculated by extracting a list of DC values from the `Distinguished Name` attribute. The list is concatenated using periods (.) between values. This is a calculated field that cannot be mapped to a different source attribute.
proxyAddresses, mail	Email Addresses (Calculated)	Example in the UI: `[email protected]: [email protected]: [email protected]` Example in the Public API: `[“[email protected]", "[email protected]", "[email protected]"]` The above examples are based on a concatenated list from the `proxyAddress` and `email` attribute values listed below. Note which values were extracted and which were not. Attribute Values: `proxyAddress` Values: SMTP:[email protected] smtp: [email protected] isp:[email protected] `mail` Value: [email protected]	A string value that lists a set of email addresses associated with a user. Calculated by extracting values from the `proxyAddress` and `mail` attributes associated with a user. Note From `proxyAddress` attributes, only the values starting with `smtp` are considered (regardless of case). In the UI, the resulting list is concatenated using colons (:). It is a calculated field and not modifiable.
employeeID	Employee ID	`ISED0003`	Code that identifies an employee of a business.
employeeNumber	Employee Number	`67`	Number assigned to an employee, other than the Employee ID.
employeeType	Employee Type*	`Staff-US`	An employment category for an employee.
givenName	First Name	`Jim`	The given first name of an employee.
displayNamePrintable	Full Name	`James Smith`	The printable display name for a user. This attribute is usually represented by a combination of first name, middle initial, and last name.
memberOf	Group Name (Calculated)	`plt_team:Users:SI_GROUP`	Groups to which a user belongs (not including the user's primary group). Calculated by extracting a list of the CN values from the DN strings of the `Group Name` attribute. Concatenated with colons (:).
objectGUID	ID (Primary Key) (Calculated)	`05588ee9-ef82-4d86-bfae-2178e2545cb3`	The unique identifier for a user object. This field is the key attribute and cannot be remapped. Calculated based on the objectGUID attribute.
sn	Last Name	`Smith`	The user's surname (family name or last name).
manager	Manager (Calculated)	`John Waiters`	The manager to whom a user reports. The user's name will be listed in the `Direct Reports` attribute of the manager's user object. Calculated by extracting the CN value from the DN string of the `Manager` attribute.
mobile	Mobile Number	`+1 415 555 1212`	The mobile phone number for a user.
objectSid	Object Sid (Calculated)	`S-1-5-21-819955361-1664132107-1760188083-368909`	A unique security identifier for an object. Calculated based on a binary value that specifies a unique security identifier for the object.
dn	Organizational Unit (Calculated)	`Application Platform:Engineering`	Organizations to which a user belongs. Calculated by extracting a list of OU values from the DN attribute. Concatenated with colons (:). This is a calculated field that cannot be mapped to a different source attribute.
operatingSystem	Operating System	`Windows 10 Pro`	The user's operating system.
telephoneNumber	Phone Number	`+1 415 555 1212`	The primary work phone number for a user.
userPrincipalName	Primary Login* (Email Format)	`[email protected]`	An email-formatted identifier for a user, based on standard RFC 822.
sAMAccountName	Primary User Name	`jim.smith`	A primary user name, commonly used for login purposes. (Does not include the domain.)
thumbnailPhoto	Thumbnail Photo	`image`	Can be used to store a user's photo as binary data. Some applications use this photo as the user's avatar or account photo.
title	Title*	`Developer FE II`	A user's formal job title (not an occupation category).
whenChanged	When Changed	`2023-10-17T14:15:14Z`	The date that the user object was last changed.

* Attribute is selected for display by default.

Context ManagementContext Management Administration Guide

Table of ContentsTable of Contents

Default Active Directory Attribute Mapping

Note