cancel
Showing results for 
Search instead for 
Did you mean: 
Highlighted
hon
Level 9
Report Inappropriate Content
Message 1 of 4

domain value in mwg policy

Could someone suggest me for this. I waana get the domain arrtibute inthe mwg policy. what policy artibute that i have to use. for example i want to allow client authen with full user " domain\user"

and want to user domain\user in mwg rule. can i do that caz mwg only see the user not domain

3 Replies

Re: domain value in mwg policy

Add a rule like this right after your authentication rule.

Name:
Prepend Realm\ to Username


Comment:
Puts the domain name in front of the user name


Rule Criteria:
Authentication.IsAuthenticated equals true AND
Authentication.Realm does not equal ""


Action:
Continue


Events:
Set Authentication.UserName = Authentication.Realm
+ "\"
+ Authentication.UserName

This will put domain into the logs:

Capture.png

It can also be used for rules like:

Authentication.UserName is in list Exception #1: Users or Groups

Capture1.png

hon
Level 9
Report Inappropriate Content
Message 3 of 4

Re: domain value in mwg policy

dear eelsasser,

Your policy help me a lot thank for that but do you have problem with web reporter caz after i use this rule web reporter cannot parse the log .

Re: domain value in mwg policy

I'd have to see the entire log definition. There is probably a missing quote or the column headers have become mis-aligned.

The log should definitely import if the field is in the identical place.

More McAfee Tools to Help You
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • Visit: Business Service Portal
  • More: Search Knowledge Articles
  • ePolicy Orchestrator Support

    • Download the new ePolicy Orchestrator (ePO) Support Center Extension which simplifies ePO management and provides support resources directly in the console. Learn more about ePO Support Center