10-06-2022 06:30 AM
We have USER-ID Agent installed on 2 Domain Controllers, using a Service account to authenticate to the Domain referencing the Workstations (Laptops)
We use Rapid7 InsightIDR for our SEIM solution and USER-ID on a DC to authenticate/identify Workstation details.
The SEIM is flagging USER-ID traffic from a Workstation to another Workstation as 'authenticated to asset from unfamiliar source'
Can anyone advise;
If this is expected behavior or something that should not be happening. i.e.
OR just between DC and Workstation
How can I stop this from happening or is this by design?
Many thanks
10-09-2022 07:59 PM
Out of curiosity, how are you identifying this as actual User-ID traffic? I'm assuming what you're seeing is WMI traffic and associating this with user-id?
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
