Forum Discussion

edhealea's avatar
edhealea
Copper Contributor
May 01, 2020

Security principal reconnaissance (LDAP) (external ID 2038)

If downloading the details for this type of alert, shouldn't there be a list ofsuspected users attached within the download?
edhealea's avatar
edhealea
Copper Contributor
May 05, 2020
Which part of the alert do you want? The download details or actual alert in the console?
Or Tsemah's avatar
Or Tsemah
Former Employee
May 06, 2020
We are tracking a potential issue that should be addressed in the latest update to the service which is currently being deployed, please check again once you have version 2.113
  • edhealea's avatar
    edhealea
    Copper Contributor
    May 06, 2020
    We are currently on Version 2.113.7964.14687. Will the update only affect new alerts or any alert still open? I rechecked today on the alert in question and we are not seeing any change to the download details.
    • Or Tsemah's avatar
      Or Tsemah
      Former Employee
      May 06, 2020

      edhealea Unfortunately, the hotfix does not apply to previous alerts, can you verify that you can download the details for a new alert?

      • edhealea's avatar
        edhealea
        Copper Contributor
        May 26, 2020

        Or Tsemah 
        We had a new alert come through and the download details did not contain any list of actors.
        The tabs in the download are Summary, Source Computer, Domain Controllers, Event Activities and Related Entities.