I currently get the users of IPs on wireless via RADIUS logs, as long as wireless does 802.1x EAP-PEAP authentication. The static side is different and the solution I currently use probably only sparsely exists outside of higher ed (requiring endpoint MAC registration by the end user, and then associating users to IPs using DHCP logs via that MAC).
On Mon, May 23, 2016 at 4:04 PM Casey Stella <ceste...@gmail.com> wrote: > Hi All, > > I'm interested in capturing user login events for use in user enrichment > (associating a user with a source IP address). To this end, I'd like to > capture user login events with the associated IP address. I had assumed > this information would be available as part of Active Directory event data, > but after discussion on https://issues.apache.org/jira/browse/METRON-161, > it appears that my assumptions do not seem to hold. > > Is there a source for this data that I should consider which might cover a > large percentage of the field? > -- Jon
