topic Re: Different source user in Monitor tab in General Topics

Different source user in Monitor tab

Farzana — Tue, 30 May 2017 04:13:42 GMT

Hello,

Can you please advise why sometimes 1 user can show up with a different credentials in the Monitor tab? Please direct me to a KB/Article to rectify the issue.

For example:

Source user:

abcd\joe
abcd.com.au\joe

This causes some applications are being denied because of the false user information is not in a appropriate security group.

Thanks in advance.

Re: Different source user in Monitor tab

MohamedSharief — Tue, 30 May 2017 06:25:29 GMT

Hi @Farzana,

This is weird. Do you have User-ID agent and agentless both configured in your environment?

Regards,

Sharief

Re: Different source user in Monitor tab

anpandey — Tue, 30 May 2017 07:35:44 GMT

Hi Farzana,

Does the setup involves multi domain forest and global catalog server ?

You can have a look at this article which talks about why we may see both netbios name as well as fqdn in user mapping.

Thanks,

Anirudh

Re: Different source user in Monitor tab

Farzana — Tue, 30 May 2017 08:24:27 GMT

Which article Anirudh?

Please provide the link.

Re: Different source user in Monitor tab

ansharma — Tue, 30 May 2017 13:53:43 GMT

Hey Farzana,

Please have a look at the following KBs:

https://live.paloaltonetworks.com/t5/Learning-Articles/IP-to-User-Mappings-Have-Inconsistent-Domain-Prefix/ta-p/59351

https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Configure-Group-Mapping-for-Users-in-Multiple-Domains/ta-p/62089

https://live.paloaltonetworks.com/t5/Configuration-Articles/Correct-Group-and-IP-to-User-Mapping-in-Multi-domain-AD-Forest/ta-p/55505

Regards,

Anurag