After analyzing an active offense where many source systems were observed connecting to a specific destination via local-to-local LDAP traffic, an ^lyst discovered that the targeted system is a legitimate LDAP server within the organization.
x avoid confusion in future analyses, how can this type of traffic to the target system be flagged as expected and be excluded from further offense ation?
