I configured McAfee Logon Collector 2.1 for McAfee DLP Monitor 9.2.2 (Only Monitor) It works, but I see real UserID not every DLP Monitor Incidents. For instance, I see UserID in incidents matched by email, but do not see, if incidents matched for http post. This case UserID is empty.
This situation does not suit my customer.
Is it possible to repair?
NDLP currently does not support Logon Collector 2.1, currently it only supports version 2.0. This will be supported in a future release.
The release notes for the last version of NDLP (9.3) have more detail. See the document at https://kc.mcafee.com/resources/sites/MCAFEE/content/live/PRODUCT_DOCUMENTATION/24000/PD24453/en_US/...
Hope this helps