to use DN instead of AD user logon name with rewrite rule..

[murat001]

hi all

i want to ask about identity rewrite rule.

in deployment, we are using ise 2.3 and we have integrated with AD and Stealthwatch pxGrid.

AD userlogon name info  consist from numbers . that's why, it seems this numbers on Stealtwatch as username. and we want to see  AD distinguished name as username on ISE live log.and we want to send this username info to Stealthwatch.

For example :    AD user logon name : 123456

                          first name : murat

                          last name : gok

                          distinguished name : murat gok

can i do this request with identity rewrite rule. ?

thanks in advance

murat

[hslai · Accepted solution]

No. The Identity Rewrite [in Active Directory > Advanced Settings] is transform the input usernames (based on the existing characters) into those suitable for looking them up in AD, but nowhere used to derive sAMAccountName -> display name.

If using the regular authentication (i.e. password-based), then the user identity is the username set by the DOT1X supplicants. If using certificate-base authentication, then the user identity is the certificate attribute selected by the certificate authentication profile used.

[murat001]

hi

thanks for info.

i asked the this subject  to lancopesupport , considering that it can be parse as username by lancope.

they said that it can do it by ISE identity rewrite.

but i think, it can do it by ISE PIC syslog sender service. we can do parsing according to submitted logs. because we are using custom syslog parsing template with regex. for user ip mapping.

do you have any suggestion in this subject?

thanks

[hslai]

Please ask StealthWatch support team to clarify how it can be done by ISE.

Although I've not done it myself, I've seen SMC fetching the full name via LDAP. See the section "Active Directory Configuration" in StealthWatch 6.8 Appliance Administration — Networking fun