CIE integration

Fm12345 — Tue, 05 Nov 2024 15:15:55 GMT

In case of hybrid environment,Can we send data to CIE instance from both Azure AD as well as on-prem AD as it supports both.

Or it is enough if we send data only from on-prem AD alone.

Re: CIE integration

nar — Wed, 06 Nov 2024 10:52:04 GMT

Hi @Fm12345

Thanks for your query on LC!

It depends on the customer and their setup. If you are synching everything to Azure, I would expect that information to be there. I believe it's possible to only synch a portion of on prem AD to Azure, though, in which case on prem would be necessary to get everything.

The on-prem Cloud Identity Engine agent is what pulls OUs from AD, Also you will need to setup CIE on-prem in order to take advantage of most of the Identity Analytics (and ITD) detections.

There are two reasons you may opt for going the on-prem agent vs the cloud configuration:

You want to collect OU information on users and computers. Azure AD is flat, so while you will get group information, there's no concept of OUs.
The customer is only synching a subset of their directory to Azure AD and you want to be able to identify everything,

If you don't care about OUs, Identity Analytics (and ITD) detections etc,. then I'd just connect Azure AD.

If this response was helpful, please click "Accept as Solution" to acknowledge.

Regards,

topic Re: CIE integration in Cortex XDR Discussions

CIE integration

Re: CIE integration