topic Re: Uknown / Blank user in General Topics

Uknown / Blank user

djbisbey — Mon, 18 Oct 2010 12:45:34 GMT

Hi,

I want to view the traffic for all unknown users, but I am unsure how to create this...

I thought about using (user.src neq '') but that does not work I need something similar, essentially I want to view the 'from user' that has no data in (blank)

Any ideas?

Darren

Re: Uknown / Blank user

skrall — Mon, 18 Oct 2010 22:14:54 GMT

I think your best option is to create a rule that has "Source User = unknown", "Application = Web-browsing, SSL" since this is the most common traffic in most networks. Place this rule before your other web browsing rules. Then you can search by SecPolicy name. I chose Web-browsing and SSL as an example but you can do this with any traffic/applications that you want to monitor. You should apply the same profiles to the "User Unknown" that you have applied to your equivilent policies with "Known" users.

Steve Krall

Re: Uknown / Blank user

djbisbey — Tue, 19 Oct 2010 11:27:45 GMT

Hi,

good idea, but that really doesn't fit what I want, I have a rule to block 'unknown' users, I just wanted to use the monitor to see when they were on or attempting to be on.

So anyone else with ideas would be great.

Darren