Give this a shot (running on a member server with real-time reporting):
1. Create a user in AD for use with the agent
On ALL DC's:
2. Give that user rights to the things outlined in this guide (http://www.cisco.com/c/en/us/support/docs/security/firesight-management-center/118637-configure-firesight-00.html)
3. Open the GPO editor:
a) To open this navigate to Administrative Tools and click ‘Group Policy Management’
b) Expand the forest, domains, select your domain, and right click the ‘Default Domain Policy’ and click Edit. If they have a different domain policy applied to their DC’s you will have to edit that policy instead of this default.
c) Navigate to Default Domain Policy> Computer Configuration> Policies> Windows Settings> Advanced Audit Policy Configuration
d) Enable Audit Logoff. Enable Audit Logon. Enable for both Success and failure.
e) Navigate to Windows Settings > Security Settings > Local Policies> User Rights Assignment > Manage Audit and Security Logs and make sure the Sourcefire Agent user/group is added here.
After all of these changes are made you may need to issue a ‘GPUPDATE’ on the domain controllers to push these settings.
If windows firewall enabled on the User Agent machine. The following ports need to be opened:
a. TCP 135 to all domain controllers
b. TCP 3306 to the FireSIGHT management console.
To determine that everything is working, make sure that users populate in the Firesight console under Analysis > Users>Users
Hope this helps...
