cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

874
Views
0
Helpful
3
Replies
Michael ONeil
Beginner

no Netbios info seen in Connections Events

We don't see the hostname/netbios name in the Host profile.

We used to see it wneh we would clike the Computer icon for a Initiator IP.

Discovery policy is set to look for users, hosts and applications. I can see discovery events are refreshing.

3 REPLIES 3
Aastha Bhardwaj
Cisco Employee

Hi,

The NetBIOS name is populated during the network discovery process. It will only pick up
the NetBIOS name if the NetBIOS protocol is enabled.
FireSIGHT network discovery acts passively, observing all traffic passing the device. If
there are not Windows Share/Samba protocol traffic, no netbios name will be observed in
the packets.

Regards,

Aastha Bhardwaj

Rate if that helps!!!

Aastha,

Thank you for the reply. I guess if I want the client / hostname I should enable and configure the User Agent.

Hi,

Our Defense Center can only map Users based on the logon events it receives from you AD
Server(s) via the User Agent. If it doesn't see a logon event for a connection, then it
wont map that IP address. Yes so you would need a User agent for that.

Regards,

Aastha Bhardwaj

Content for Community-Ad