While validating the data sources in a new IntroSpect installation, you have confirmed that the network tap data is correct and there are AMON log sources for both firewall and DNS. When you lock in the Entity360, you see the usernames from Active Directory.
However, when you look under E360 > activity > for any user accounts there is no information under "Activity Card" and "Authentication" for any user. When you filter the Entity360 for IP address and look at the Activity screen you do see activity on the "Activity Card".
Could this be a reason why you do not see the information but do not see activity? (The log broker could be configured incorrectly and not sending authentication logs to IntroSpect.)
A. Yes
B. No
|
Download Printable PDF. VALID exam to help you PASS. |
 |