MWG: How to rule trace a user using AD account as a filter

[David01]

Hi Everyone,

Does anyone know how can we perform a rule trace using AD account as a filter on MWG? Our customer has a unique setup which the user's access to command prompt is not allowed and such. Therefore we cannot obtain the IP address of the user. Is there any way to perform a trace in this kind of setup?

Hope to obtain your feedback with my query. Thanks!

[Tiz · Accepted solution]

Hi,

if the user needs to be authanticated at the MWG (e.g. LDAP, NTLM) then you can create a new rule with the criteria Authentication.Username and in the event section use Enable RuleEngine Tracing (see attached screenshot).

You will find the rule tracing files under Troubleshooting-> Rule tracing files.

With this method you will only get requests/responses logged which are already authenticated, but on the other hand you will find out the user's IP address and then start a new rule tracing with it.

And don't forget to disable the rule otherwise it won't stop tracing.

Hope this helps.

Cheers,

Mike

[AaronT]

Another option is to have the user hit a block page, and the block page show the IP of the user.  You could then use this in the trace (we do this to get the IP address of non-technical users)