# Trying to create rules on elastic siem to map AD user information on another index **URL:** \ **Category:** Elastic Security\ **Created:** [February 15, 2022, 10:28am UTC](https://discuss.elastic.co/t/trying-to-create-rules-on-elastic-siem-to-map-ad-user-information-on-another-index/297230 "2022-02-15T10:28:37Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![sriramdas89](https://avatars.discourse-cdn.com/v4/letter/s/cc9497/32.png) [@sriramdas89](https://discuss.elastic.co/u/sriramdas89)\ **Post date:** [February 15, 2022, 10:28am UTC](https://discuss.elastic.co/t/trying-to-create-rules-on-elastic-siem-to-map-ad-user-information-on-another-index/297230/1 "2022-02-15T10:28:37Z")
Hello All, I am importing event code 6273 from our NPS server and we have a rule set to alert us for the below condition. hosted on index: ds-logs-system.security-default.xxxxx 5 Failed logins with in a span for 5 minutes throw in an alert. Here we have employee code that we use as user name so the siem signals field has the code number. We used a python script to export Active directory attributes to a CSV and created an index with those details to the index below. called aduser-xxxx We want to populate the first name and last name present in the aduser-xxx index to the siem signals index. Can we do that? Please advise. Thanks. Sriram ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 15, 2022, 10:29am UTC](https://discuss.elastic.co/t/trying-to-create-rules-on-elastic-siem-to-map-ad-user-information-on-another-index/297230/2 "2022-03-15T10:29:12Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.