User-ID Agent

[aveva_palo]

Is it possible to use the User-ID Agent to scan the logs from a machine configured as an Event Collector.  I have an event log called "Forwarded Events" which holds centralised logon/logoff events for another tool.  It would be good to leverage that information for Palo too.

Regards

Gary

[gswcowboy]

Hi Gary,

That sounds like an enhancement request for your local SE as here's what the agent is intended to do:

Pan-agent is a Windows application/service doing the following tasks:

• Get      Groups/Users from the configured domain controller and send to Pan Device
• Get      the IP-Username mapping for the configured domain and send to Pan Device

Ø  Read security logs from the configured domain controllers to analyze the domain user logon event

Ø  If enabled, probe the user IP detected from the security log reading to see if the user is sill logged on that IP

Ø  Enumerate the net sessions from the configured domain controllers to get the IP-Username mappings for the net session

• Forward      the NTLM message received from Pan Device to the domain controllers and      vice versa to support NTLM authentication

Thanks,

Renato

[James]

Hi Gary,

You may be able to script something and use our XML API into the user-ID agent.

Thanks

James

[kimalat]

how would i do that, any help would be apperciated