cancel
Showing results for 
Search instead for 
Did you mean: 
Highlighted

MWG: How to rule trace a user using AD account as a filter

Jump to solution

Hi Everyone,

Does anyone know how can we perform a rule trace using AD account as a filter on MWG? Our customer has a unique setup which the user's access to command prompt is not allowed and such. Therefore we cannot obtain the IP address of the user. Is there any way to perform a trace in this kind of setup?

Hope to obtain your feedback with my query. Thanks!

1 Solution

Accepted Solutions
Tiz
Level 7
Report Inappropriate Content
Message 2 of 3

Re: MWG: How to rule trace a user using AD account as a filter

Jump to solution

Hi,

if the user needs to be authanticated at the MWG (e.g. LDAP, NTLM) then you can create a new rule with the criteria Authentication.Username and in the event section use Enable RuleEngine Tracing (see attached screenshot).

You will find the rule tracing files under Troubleshooting-> Rule tracing files.

With this method you will only get requests/responses logged which are already authenticated, but on the other hand you will find out the user's IP address and then start a new rule tracing with it.

And don't forget to disable the rule otherwise it won't stop tracing.

 

Hope this helps.

Cheers,

Mike

View solution in original post

2 Replies
Tiz
Level 7
Report Inappropriate Content
Message 2 of 3

Re: MWG: How to rule trace a user using AD account as a filter

Jump to solution

Hi,

if the user needs to be authanticated at the MWG (e.g. LDAP, NTLM) then you can create a new rule with the criteria Authentication.Username and in the event section use Enable RuleEngine Tracing (see attached screenshot).

You will find the rule tracing files under Troubleshooting-> Rule tracing files.

With this method you will only get requests/responses logged which are already authenticated, but on the other hand you will find out the user's IP address and then start a new rule tracing with it.

And don't forget to disable the rule otherwise it won't stop tracing.

 

Hope this helps.

Cheers,

Mike

View solution in original post

Reliable Contributor AaronT
Reliable Contributor
Report Inappropriate Content
Message 3 of 3

Re: MWG: How to rule trace a user using AD account as a filter

Jump to solution

Another option is to have the user hit a block page, and the block page show the IP of the user.  You could then use this in the trace (we do this to get the IP address of non-technical users)

Want to Ask a Question?
Many members like to perform a search first in case other customers have already asked and answered a similar question. However, to ask a question, first select a forum then click on Post a Topic. You must sign in or log in with your existing credentials.

McAfee Service Portal customers please use your existing username and password to log into the community.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community