Firepower User Agent gives stale data

[pbarber]

Hi all,

Im trying to look at where accounts are been used but some results been returned are stale - ie shows traffic against my user when I know it was another user who has been logged onto the same device for longer than I have.

Can the agent be tweaked to show the correct user in this instance? And/or can it be tweaked to remove the AD-IP link once a user logs off a device?

Thankyou

Paul

[Marvin Rhoads]

Is there only a single DC in the domain? You need to have a user agent polling each DC that processes logon/logoff events.

If that's setup then the user logon data should be updated every few minutes.

Logoff events are hard to use definitively since many users don't actually logoff - they just lock the computer or let it sleep/hibernate.

As far as I know, you can't manually override the data reported by User Agent.