View Domain in Logs

[Faulty_Male]

Currently I am running FSSO, when I run reports I see the USERNAME however I have the requirement to show DOMAIN/USERNAME as I may be authenticating from different domains (and have users with the same USERNAME).  Is there a way to show this in the reports?

[hzhao_FTNT]

Currently in our predefined dataset, user_src is defined as coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)), it will display either username or srcip(when username is not available). In your case, you have to customize template/chart/dataset in order to display both username and domain in one report.

[AtiT]

Hi,

I checked it in the lab and it seems that the domain is not logged. Only the fortigate user group is logged - see the logs for the user jblack:

If you have the fortigate user group naming unique for the domains then you can create your own dataset where you can rename the fortigate user group by the conditional expression:

CASE WHEN condition THEN result

 [WHEN ...]

 [ELSE result]

END

http://www.postgresql.org/docs/9.4/static/functions-conditional.html

[Faulty_Male]

Thanks for the responses guys.  I will test this out.