UserID weird behaviour

[soporteseguridad]

Hi,

Our UserID is doing a weird behaviour. UserID is sending "probing" and weird connections to a lot of machines. We havent configured anything for these computers where userid is sending connections, why is the UseriID doing this???

I attached a screenshot with the diferent tries to random IP´s in my network.

We have disabled WMI probing and Netbios probing and these connections disappear.......why?? what this kind of connection do?

Thanks... 

[knarra1 · Accepted solution]

It is an expected behavior when WMI and netbios  probing is enabled . If a ip-user mapping doesn't exist in firewall or user-idagent and traffic is seen on firewall from that specific ip , user-id agent will try to get the resolve IP > user mapping through WMI/netbios probing Disabling wmi probing is recommended if the account used in user-id agent doesn't have permissions on the client machines to probe through WMI . Same is the case with netbios probe as well if the clients are not allowing remote netbios probe Following link has the document on User-id configuration tips https://live.paloaltonetworks.com/docs/DOC-1052