Data Loss Prevention

Configuring DLP 12.0 and ran into a bit of a confusion.  In the past for attributes populated through LDAP or another script they were always created under System -> Incident Data -> Attributes and then the tab "Custom Attributes"

In DLP 12.0 there is that and also System -> Users - User Custom Attributes

If you look at the context sensitive help it says "You can create custom attributes to improve relevance while filtering and working with user risk summary reports. Useful custom attributes might include employment status, the name of the user's manager, the user's job function, and other information that might be stored in your enterprise resource planning system or additional user data source."

So is this where I put the attributes to be populated via LDAP?

Typically I populate First Name, Last Name, Department, Location and then they were populated by LDAP (AD)

Yes, you can put the attributes be populated via LDAP in Custom Attributes. There are no differences between DLP 11.x and DLP 12.0 on this function.

This reads a bit like "at this time there is no difference" but the help text reads like there is going to be a difference at some point?

According to the release notes, there are no change about the Custom Attributes...

Hi

 I think it is linked to future capabilities to do risk analysis on data leakage (i saw that on a roadmap). You will have capabilities to correlate endpoint incident and network incident , so may be the link will be done on these attributes.

 regards

From further research and digging into this, specifically take a look at Chapter 51 of DLP 12.0 Admin guide.  As mentioned the Custom User Attributes are for the User Risk Reporting feature that is new in DLP 12.0.  These need to be populated by a datasource (CSV or AD) and created seperatly from the Custom Attributes that are populated by the Lookup Plugin.

So if you want the attributes like First Name, Last Name, etc to show up in an incident you need to create the Custom Attributes under incident data and then create the Lookup plugin stuff just like normal.