no Netbios info seen in Connections Events

[Michael ONeil]

We don't see the hostname/netbios name in the Host profile.

We used to see it wneh we would clike the Computer icon for a Initiator IP.

Discovery policy is set to look for users, hosts and applications. I can see discovery events are refreshing.

[Aastha Bhardwaj]

Hi,

The NetBIOS name is populated during the network discovery process. It will only pick up
the NetBIOS name if the NetBIOS protocol is enabled.
FireSIGHT network discovery acts passively, observing all traffic passing the device. If
there are not Windows Share/Samba protocol traffic, no netbios name will be observed in
the packets.

Regards,

Aastha Bhardwaj

Rate if that helps!!!

[Michael ONeil]

Aastha,

Thank you for the reply. I guess if I want the client / hostname I should enable and configure the User Agent.

[Aastha Bhardwaj]

Hi,

Our Defense Center can only map Users based on the logon events it receives from you AD
Server(s) via the User Agent. If it doesn't see a logon event for a connection, then it
wont map that IP address. Yes so you would need a User agent for that.

Regards,

Aastha Bhardwaj