Adding identity information for additional context looking up usernames

[Anonymous]

When I'm going through logs there are usernames from Active Directory and I'm wondering if there is a best practice/procedure for adding the First Name/Last Name as additional context so I don't have to do an additional lookup manually to map the username to a person.

[DaveGlover · Accepted solution]

The easiest way to do this is to set up an extract from AD which includes AD attributes such as first anem, last name, department, location or any other enrichment that you would like to add.  Then use this data as a feed in Netwitness.  Best practice would be to automate this process on a nightly basis.