Skip to main content Link Menu Expand (external link) Document Search Copy Copied

ResourceName - ADUser

Table of contents
  1. Resource Data
  2. Example
    1. FPL Code
    2. Table Results

Resource Data

An example of what this resource includes:

"@ADUser": {
    "cn": "Smith, Jeffrey",
    "createdOn": "2011-03-24T20:12:32Z",
    "customer": "us_abcd",
    "department": "123 - Janitorial",
    "description": "",
    "displayName": "Smith, Jeffrey",
    "distinguishedName": "CN=Smith\\, Jeffrey,OU=HR Notification,OU=ABCD Disabled Users,OU=ABCD,DC=us,DC=abcd,DC=com",
    "givenName": "Jeffrey",
    "lastLogon": "",
    "lastLogonTime": "0001-01-01T00:00:00Z",
    "msDSPrincipalName": "ABCD\\smithj",
    "name": "Smith, Jeffrey",
    "objectSid": "S-1-5-21-1210911605-682387052-1167487308-18158",
    "pluginName": "",
    "propertyFlags": [
    "pwdLastSet": "0",
    "pwdLastSetTime": "1970-01-01T00:00:00Z",
    "sAMAccountName": "smithj",
    "sn": "Smith",
    "translation": {
      "agentID": "smithj",
      "asset": "Smith, Jeffrey",
      "ip": "",
      "source": "us_abcd",
      "username": ""
    "updatedOn": "2022-01-10T09:20:18Z",
    "userAccountControl": 514,
    "userPrincipalName": "",
    "whenChanged": "20220110092018.0Z",
    "whenCreated": "20110324201232.0Z"
  "@customer": "us_abcd",
  "@dayIndex": "20220829-21",
  "@key": "smithj",
  "@resource_type": "ADUser",
  "@source": "ldap",
  "@timestamp": 1661808676457,
  "@type": "resource"


FPL Code

An example of loading the resource:

function department()
    load resource ADUser
    let {department} = f("@ADUser")
    aggregate count_department=count() by department
    sort 10 count_department

stream department=department()

Table Results

Results of the above FPL code:

Page last updated: 2022 Oct 26