cancel
Showing results for 
Search instead for 
Did you mean: 

MWG: How to rule trace a user using AD account as a filter

Jump to solution

Hi Everyone,

Does anyone know how can we perform a rule trace using AD account as a filter on MWG? Our customer has a unique setup which the user's access to command prompt is not allowed and such. Therefore we cannot obtain the IP address of the user. Is there any way to perform a trace in this kind of setup?

Hope to obtain your feedback with my query. Thanks!

1 Solution

Accepted Solutions
Tiz
Level 7
Report Inappropriate Content
Message 2 of 3

Re: MWG: How to rule trace a user using AD account as a filter

Jump to solution

Hi,

if the user needs to be authanticated at the MWG (e.g. LDAP, NTLM) then you can create a new rule with the criteria Authentication.Username and in the event section use Enable RuleEngine Tracing (see attached screenshot).

You will find the rule tracing files under Troubleshooting-> Rule tracing files.

With this method you will only get requests/responses logged which are already authenticated, but on the other hand you will find out the user's IP address and then start a new rule tracing with it.

And don't forget to disable the rule otherwise it won't stop tracing.

 

Hope this helps.

Cheers,

Mike

View solution in original post

2 Replies
Tiz
Level 7
Report Inappropriate Content
Message 2 of 3

Re: MWG: How to rule trace a user using AD account as a filter

Jump to solution

Hi,

if the user needs to be authanticated at the MWG (e.g. LDAP, NTLM) then you can create a new rule with the criteria Authentication.Username and in the event section use Enable RuleEngine Tracing (see attached screenshot).

You will find the rule tracing files under Troubleshooting-> Rule tracing files.

With this method you will only get requests/responses logged which are already authenticated, but on the other hand you will find out the user's IP address and then start a new rule tracing with it.

And don't forget to disable the rule otherwise it won't stop tracing.

 

Hope this helps.

Cheers,

Mike

View solution in original post

Reliable Contributor AaronT
Reliable Contributor
Report Inappropriate Content
Message 3 of 3

Re: MWG: How to rule trace a user using AD account as a filter

Jump to solution

Another option is to have the user hit a block page, and the block page show the IP of the user.  You could then use this in the trace (we do this to get the IP address of non-technical users)

More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator
  • Community Help Hub

      New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

    • Find Forum FAQs
    • Learn How to Earn Badges
    • Ask for Help
    Go to Community Help

    Join the Community

      Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

    • Get helpful solutions from McAfee experts.
    • Stay connected to product conversations that matter to you.
    • Participate in product groups led by McAfee employees.
    Join the Community
    Join the Community