Video Screencast Help

Diiference between "User Custom Attributes" and "Custom Attributes"

Created: 19 Jun 2013 • Updated: 20 Jun 2013 | 5 comments
jjesse's picture
This issue has been solved. See solution.

Configuring DLP 12.0 and ran into a bit of a confusion.  In the past for attributes populated through LDAP or another script they were always created under System -> Incident Data -> Attributes and then the tab "Custom Attributes"

In DLP 12.0 there is that and also System -> Users - User Custom Attributes

If you look at the context sensitive help it says "You can create custom attributes to improve relevance while filtering and working with user risk summary reports. Useful custom attributes might include employment status, the name of the user's manager, the user's job function, and other information that might be stored in your enterprise resource planning system or additional user data source."

So is this where I put the attributes to be populated via LDAP?

Typically I populate First Name, Last Name, Department, Location and then they were populated by LDAP (AD)

Operating Systems:

Comments 5 CommentsJump to latest comment

yang_zhang's picture

Yes, you can put the attributes be populated via LDAP in Custom Attributes. There are no differences between DLP 11.x and DLP 12.0 on this function.

If a forum post solves your problem, please flag it as a solution. If you like an article, blog post or download vote it up.
jjesse's picture

This reads a bit like "at this time there is no difference" but the help text reads like there is going to be a difference at some point?

Jonathan Jesse Practice Principal ITS Partners

yang_zhang's picture

According to the release notes, there are no change about the Custom Attributes...smiley

If a forum post solves your problem, please flag it as a solution. If you like an article, blog post or download vote it up.
stephane.fichet's picture


 I think it is linked to future capabilities to do risk analysis on data leakage (i saw that on a roadmap). You will have capabilities to correlate endpoint incident and network incident , so may be the link will be done on these attributes.


jjesse's picture

From further research and digging into this, specifically take a look at Chapter 51 of DLP 12.0 Admin guide.  As mentioned the Custom User Attributes are for the User Risk Reporting feature that is new in DLP 12.0.  These need to be populated by a datasource (CSV or AD) and created seperatly from the Custom Attributes that are populated by the Lookup Plugin.

So if you want the attributes like First Name, Last Name, etc to show up in an incident you need to create the Custom Attributes under incident data and then create the Lookup plugin stuff just like normal.

Jonathan Jesse Practice Principal ITS Partners