what is destination user field in traffic and threat logs

[Roby_Sreejith]

I can see destination user field in traffic and threat logs getting poulated.

How this data is collected.

[reaper]

The same as source user, through user-IP mapping

If a user is identified by UserID (agent, captive portal ,....) a user-ip mapping is created on the firewall, anything coming from- or going to that IP can then be matched to the currently active user.

This could come in handy when for example a patch management system pushes updates out to your clients, you'll see which user was associated to the IP at the time the patch was sent out