Buy or Renew
Buy or Renew
Duo Security forums now LIVE! Get answers to all your Duo Security questions. Learn more
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
cancel
Start a conversation

Who Me Too'd this topic

Sourcefire 6.0 / FireSIGHT MC 6.0 - Users Not Populating

Keith Joel
Level 1
Level 1

‎02-02-2016 11:10 AM - edited ‎03-12-2019 05:53 AM

Edit: moved to Sourcefire category.

---

Hi All,

Wondering if somebody can lead me in the right direction here, I have a customer running Sourcefire 6.0 with the FireSIGHT MC and am having an issue with the IP to User mapping.  Under Analysis > Users > Users I don't have any records.  I've gone in and setup the "realm" under itnegration which tests out ok, and setup the user download which pulls down the groups so I know the linkage for the "realm" is there.  The tasks show LDAP synch with 2 groups and 293 Users successful.  Identity Policy was setup with passive authentication and the User Agent on the active directory system is installed and tested successfully.  I noticed the following in the syslogs stored locally (changed hostname and users) and I'm wondering if it has something to do with it?

Feb 02 2016 12:31:36 HOSTNAME SF-IMS[30127]: [30170] SFDataCorrelator:UserIdentity [WARN] Unable to find realm for user user1, domain XX
Feb 02 2016 12:31:35 HOSTNAME SF-IMS[30127]: [30172] SFDataCorrelator:UserIdentity [WARN] Unable to find realm for user user2, domain XX

Any other information required let me know.

Thanks,

Keith

2 people had this problem
Labels:
0 Helpful
Who Me Too'd this topic