topic Hi Marvin, in Network Security

SourceFire AD agent and MACos users

Maher Shaban — Tue, 12 Mar 2019 13:22:12 GMT

Dears,

we have sourcefire AD agent installed on windows server 2016. all users are shown in the access logs except for user logged in from MACos devices.

is there any fix for such issue?

Thanks,

Maher

Are the MacOS users

Marvin Rhoads — Sun, 23 Apr 2017 10:15:45 GMT

Are the MacOS users authenticating to your domain? They need to be doing that and their login must create an audit event. That's what the agent retrieves from the server using WMI.

Hi Marvin,

Maher Shaban — Sun, 23 Apr 2017 10:33:04 GMT

Hi Marvin,

yes, they are all authenticating from the domain.

any advise,

Thanks,

I suspect they may not be

Marvin Rhoads — Sun, 23 Apr 2017 14:12:59 GMT

I suspect they may not be generating logon/logoff events in the Windows Security Event log.

On the Active Directory server, select Start > All Programs > Administrative Tools > Event Viewer. Then select Windows Logs > Security.

If you don't see the Mac OS logon event there, the User Agent won't either because that's where it reads to send them off to FirePOWER Management Center. In that case, you would need an alternative identity source like ISE. If you do see the events, it may be a bug and I would open a TAC case for that.

Hi Marvin,

Maher Shaban — Sun, 23 Apr 2017 14:13:00 GMT

Hi Marvin,

I found out that the logon and logoff requests on AD comes with the computer name, not the username.

thanks for helping.

Cheers,

You're welcome.

Marvin Rhoads — Sun, 23 Apr 2017 14:27:14 GMT

You're welcome.

That's good info - thanks for sharing your findings.

I wasn't aware of that behavior for Mac OS clients. I wonder if that can be changed?

Are you at least getting the computer name show up in your FMC for those Macs?

Hi Marvin,

Maher Shaban — Mon, 22 May 2017 09:02:12 GMT

Hi Marvin,

Actually, I found the user accounts events found on SFR user activity.

I don't know what is going on with Mac users exactly?

any advise?

Thanks,