FSSO - logon filtering at DC agent level

[FrancoisBlanchon]

Dear community,

I am configuring DC agents to push logons information to Collector Agent (CA on dedicated server).

I am using this msi setup command line:

msiexec /i DCAgent_Setup_5.0.0302_x64.msi COLLECTORAGENTLIST="10.y0.xx.11;10.y0.xx.11" DONOTRESOLVE=1 IGNORELIST="mydomain\?*-s;mydomain\HEALTHMAILBOX?*" ENABLELOG=1

My question is about IGNORELIST parameter. It seems that my DC agents is still sending information about service accounts (mydomain\?*-s) that are supposed to be filtered.

This syntaxe is working well to filter at Collector Agent level, but I would prefer to filter as early as possible in FSSO process, so at DC agent level.

The msiexec command is accepted, collector agents list param is well used to setup DC agent but not ingnorelist param.

Thanks for any advices.

[Debbie_FTNT · Accepted solution]

Hi Francois,

the issue is that DC Agent can't handle wildcard characters in the ignore list. If you specify individual usernames, it can ignore them just fine.

You can also find the ignore list in the registry at "Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Fortinet\FSAE\DCAgent".

The Collector Agent, on the other hand, can handle wildcards in the ignore user list.

[Vincent_Cai]

I found the DC Agent keeps sending the service account(Collector Agent is running on) Logon  event to the collector agent.  I have DUO Authentication proxy and It was ignored already in the DC Agent Ignore List, but I could NOT add the 2nd service account to be ignored, it is NOT difficult, why it is NOT support until now Oct 2025? This issue exist for 3 years already.

[Vincent_Cai]

Add the noisy accounts to the Collector Agent “Ignore User List”, The Collector discards those logons before they hit the logon table, which is what protects memory/CPU, this is what I assumed; however, DUO Proxy agent logon events still saturate the collector agent and cause it to be very unstable.  After I add the duo proxy agent in the DC Agent Ignore user list, it works much better.  So sort of worry about the service account logon event impact to the collector agent ,even if it is in the ignore list in the collector agent already, just like the duo proxy agent,

[FrancoisBlanchon]

Hi Debbie,

Thanks a lot for this setup info. It should be able to handle wildcard chars, very usefull to save traffic and information amount to handle by CA!

Hope it will be improved in the future.

Regards,

[Vincent_Cai]

Agree, I noticed many Collector Agent service account logon events and I want to ingore it at the source, i.e. the DC itself ,but due to the Ignore user list limitation on the DC Agent, I can only filter one service account.  Hope it can be supported ASAP. The Collector Agent Ignore user list could NOT prevent the memory drain from the DUO Proxyagent and you have to ignore the DUO proxyagent at the DC Agent ignore user list. That is why I expect the DC agents can filter multiple service accounts.