FortiSIEM
FortiSIEM provides Security Information and Event Management (SIEM) and User and Entity Behavior Analytics (UEBA)
Andy_G
Staff
Staff
Article Id 192351

Description

Summary of Article

This article explains when the usage of "Excluded Shared Device IPs" would be needed

 

Additional Information

Scenario

If User A logs into a workstation, then we show User A associated with the workstation under Identity and Location.  If User A Logs in to Server R to pull mail, we will then also associate and attach User A with Server R.  This will repeat with other users as well.  Thus it will associate the following together:

Workstation 1 -- User A
Workstation 2 -- User B
Server R -- User A
Server R -- User B

Because there are multiple people who log into remote servers, Identity and Location does not need to display who is logging onto Server R all the time.
Hence we would Exclude the Share Device IP in order to minimize confusion as well as reduce performance cost to AO.

Version Application

ALL



 
Contributors