User ID agent going to non- AD servers

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

User ID agent going to non- AD servers

L1 Bithead

Hi,

We have a userid_agent installed on our server, our security team noticed the excessive session denies between the userid agent server going to other non-AD servers in our azure firewall, can anyone help me confirm if this traffic from our userid agent server going to non-AD servers are legit traffics? 

 

Daryl_Cruz_1-1706767342887.png

 

 

1 REPLY 1

Cyber Elite
Cyber Elite

@Daryl_Cruz,

I'd recommend monitoring through Resource Monitor to see what is actually connecting to what on the host, that's the only way to verify what actual process is sending what traffic. Nothing is really shocking from a port aspect outside of it not hitting expected/configured endpoints, however if you weren't the one to configure this agent I'd verify that it's actually been configured properly. AD isn't the only monitorable server for user-ID, it's possible someone added additional nodes that you aren't planning to see.

Additionally I'd take some time to ensure that you have client probing all disabled; that would also account for a large amount of this traffic hitting unexpected nodes. 

  • 209 Views
  • 1 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!