Different source user in Monitor tab

[Farzana]

Hello,

Can you please advise why sometimes 1 user can show up with a different credentials in the Monitor tab? Please direct me to a KB/Article to rectify the issue.

For example:

Source user:

abcd\joe
abcd.com.au\joe

This causes some applications are being denied because of the false user information is not in a appropriate security group.

Thanks in advance.

[MohamedSharief]

Hi @Farzana,

This is weird. Do you have User-ID agent and agentless both configured in your environment?

Regards,

Sharief

[anpandey]

Hi Farzana,

Does the setup involves multi domain forest and global catalog server ?

You can have a look at this article which talks about why we may see both netbios name as well as fqdn in user mapping.

Thanks,

Anirudh

[Farzana]

Which article Anirudh?

Please provide the link.

[ansharma · Accepted solution]

Hey Farzana,

Please have a look at the following KBs:

https://live.paloaltonetworks.com/t5/Learning-Articles/IP-to-User-Mappings-Have-Inconsistent-Domain-...

https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Configure-Group-Mapping-for-Users...

https://live.paloaltonetworks.com/t5/Configuration-Articles/Correct-Group-and-IP-to-User-Mapping-in-...

Regards,

Anurag