LDAP Query Extractor | Cortex XDR

chiki briki@ekkor13

•updated Sep 4, 2026•26•0•36

Extracts LDAP search queries from Microsoft-Windows-LDAP-Client Event ID 30 logs on endpoints. Accepts hostname, username, or IP as input. Shows initiating process with full command line, search filter, base DN, and requested attributes. Good for triaging LDAP enumeration alerts and identifying whether queries come from known AD tools or suspicious recon activity.