UserID weird behaviour

soporteseguridad — Fri, 18 Oct 2013 12:42:09 GMT

Hi,

Our UserID is doing a weird behaviour. UserID is sending "probing" and weird connections to a lot of machines. We havent configured anything for these computers where userid is sending connections, why is the UseriID doing this???

I attached a screenshot with the diferent tries to random IP´s in my network.

We have disabled WMI probing and Netbios probing and these connections disappear.......why?? what this kind of connection do?

Thanks...

Re: UserID weird behaviour

knarra1 — Fri, 18 Oct 2013 16:54:18 GMT

It is an expected behavior when WMI and netbios probing is enabled . If a ip-user mapping doesn't exist in firewall or user-idagent and traffic is seen on firewall from that specific ip , user-id agent will try to get the resolve IP > user mapping through WMI/netbios probing Disabling wmi probing is recommended if the account used in user-id agent doesn't have permissions on the client machines to probe through WMI . Same is the case with netbios probe as well if the clients are not allowing remote netbios probe Following link has the document on User-id configuration tips https://live.paloaltonetworks.com/docs/DOC-1052

topic UserID weird behaviour in General Topics

UserID weird behaviour

Re: UserID weird behaviour