Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
MonXbebe
New Contributor II

FortiSIEM User IP Mapping

Hello,

 

I'm wondering how the user ip mapping works in FortiSIEM. 

 

I observed an behavoiur where the logs do not contain any user, but FortiSIEM manages to map the ip adress to the user somehow. 

 

Is it possible to influence this behavior in any way? Is it generally possible to have an influence on the user ip mapping?

 

Best Regards

MonXbebe

1 REPLY 1
mnovelli
Staff
Staff

Hello @MonXbebe ,  generally User-IP mapping is used in Identity and Location Dashboard and it's obtained through a live correlation of several types of events (e.g. AD logon, DHCP)

You can modify the file /opt/phoenix/config/identityDef.xml file to add new events. You have to restart  phIdentityMaster and phIdentityWorker modules on all nodes after that change.

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors