> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/identity-threat-module-itdr/prevent-malicious-ldap-queries.md).

# Prevent malicious LDAP queries

Active Directory (AD) routinely processes millions of legitimate queries from users and services. Threat actors frequently exploit this open architecture during the reconnaissance phase of an attack to map the network, identify privileged users, and discover attack paths without triggering standard security alarms.

To accurately distinguish between legitimate administrative queries and malicious reconnaissance, ITDR analyzes the context of LDAP traffic in real time. Instead of viewing a single query in isolation, ITDR evaluates it in context to reveal malicious intent.

The module continuously evaluates traffic across four key behavioral dimensions:

1. Source of query: Analyzes whether the request originates from a known, trusted admin workstation or an anomalous, unverified endpoint.
2. Number of queries (volume): Monitors for massive spikes in read operations. Normal business logic usually involves looking up a few contacts, whereas reconnaissance tools query thousands of objects in seconds.
3. Contextual patterns: Flags activity if a user suddenly deviates from their standard historical behavior or performs lookups that do not align with their role.
4. Query attributes: Identifies specific search filters that are highly valuable to attackers but rarely used in typical operations (such as searches for `adminCount=1` or unconstrained delegation).

The module identifies and blocks the unique signatures of specific reconnaissance tools at the source. Rather than generating generic alerts, ITDR provides precise alerts, for example, "Attack detected via BloodHound".

### Key Benefits

Implementing this protection provides you with two primary advantages:

* Real-Time prevention: Stops attacks proactively during the reconnaissance phase. By blocking the LDAP queries, the system blinds the attacker and forces them to operate without a map of your environment.
* Enriched analytics: Every blocked query is fed back into the Cortex ITDR analytics engine. This data generates detailed issues within Cortex XDR, giving you actionable intelligence on exactly which tool was being used and who the attacker was targeting.

To enable LDAP protection, toggle the **LDAP protection** setting in the Identity profile of the agent. To  configure the Identity profile, see [Set up Identity Profiles](/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/identity-threat-module-itdr/get-started-with-itdr.md#set-up-identity-profiles).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/identity-threat-module-itdr/prevent-malicious-ldap-queries.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.