Feat: [ocsf#1122] - extend User, LDAP Person + cloud like AzureAd sup…

…port added

- wip - status: LDAP person added + AD profile

initial shape

dictionary.json

@@ -3036,6 +3036,41 @@
       "description": "The primary office location associated with the user. This could be any string and isn't a specific address. For example, <code>South East Virtual</code>.",
       "type": "string_t"
     },
+    "on_premises_distinguished_name": {
+      "caption": "On Premises Distinguished Name",
+      "description": "The distinguished name of the user in the on-premises Active Directory.",
+      "type": "string_t"
+    },
+    "on_premises_domain_name": {
+      "caption": "On Premises Domain Name",
+      "description": "The on-premises domain name of the user.",
+      "type": "string_t"
+    },
+    "on_premises_immutable_id": {
+      "caption": "On Premises Immutable ID",
+      "description": "The on-premises immutable identifier for the user.",
+      "type": "string_t"
+    },
+    "on_premises_last_sync_time": {
+      "caption": "On Premises Last Sync Time",
+      "description": "The last time at which the object was synced with the on-premises directory.",
+      "type": "timestamp_t"
+    },
+    "on_premises_sam_account_name": {
+      "caption": "On Premises SAM Account Name",
+      "description": "The on-premises Security Account Manager (SAM) account name of the user.",
+      "type": "string_t"
+    },
+    "on_premises_sync_enabled": {
+      "caption": "On Premises Sync Enabled",
+      "description": "Indicates whether the user account is enabled for synchronization.",
+      "type": "boolean_t"
+    },
+    "on_premises_user_principal_name": {
+      "caption": "On Premises User Principal Name",
+      "description": "The on-premises user principal name (UPN) of the user.",
+      "type": "string_t"
+    },
     "opcode": {
       "caption": "DNS Opcode",
       "description": "The DNS opcode specifies the type of the query message.",

profiles/active_directory.json

@@ -24,6 +24,27 @@
     "is_deleted": {
       "requirement": "recommended"
     },
+    "on_premises_distinguished_name": {
+      "requirement": "optional"
+    },
+    "on_premises_domain_name": {
+      "requirement": "optional"
+    },
+    "on_premises_immutable_id": {
+      "requirement": "optional"
+    },
+    "on_premises_last_sync_time": {
+      "requirement": "optional"
+    },
+    "on_premises_sam_account_name": {
+      "requirement": "optional"
+    },
+    "on_premises_sync_enabled": {
+      "requirement": "optional"
+    },
+    "on_premises_user_principal_name": {
+      "requirement": "optional"
+    },
     "is_recycled": {
       "requirement": "optional"
     },