tie_search_ad_objects
Search Active Directory objects by name or DN substring, optionally filtered by directory and object class, to locate relevant security objects.
Instructions
Find Active Directory objects whose name or DN contains query.
IMPORTANT: /api/ad-objects has no server-side search. It returns the last
known state of every object, cursor-paginated (~1000 per page, roughly
2 MB each on a small forest). Filtering here is therefore CLIENT-SIDE, and
only objects within the scanned prefix can match — raise max_scanned to
widen the sweep, and read scanned/truncated in the result before
concluding that something does not exist.
For deviance investigation prefer tie_deviances / tie_deviances_by_checker, which are filtered server-side.
Args:
query: Substring to look for, case-insensitive. Matched against objectId
and the naming attributes (cn, name, displayName, sAMAccountName,
distinguishedName, userPrincipalName) — not against bulk blobs like
ntSecurityDescriptor, which would produce meaningless hits.
directory_id: Restrict to one directory (see resource="directories").
object_class: Substring of the objectClass attribute, e.g. "user",
"computer", "group", "organizationalUnit". Note this is the LDAP
objectClass; the object's own type field is the data source
(LDAP or SYSVOL), not the object category.
max_results: Stop after this many matches (default 50).
max_scanned: Cap on objects fetched while searching (default 5000).
timestamp: Optional ISO 8601 UTC point in time; defaults to now.
verbose: If False (default), oversized attribute values are dropped.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| query | Yes | ||
| verbose | No | ||
| timestamp | No | ||
| max_results | No | ||
| max_scanned | No | ||
| directory_id | No | ||
| object_class | No |