FEATURE REQUEST - Integrate NTA with Active Directory to obtain usernames for source destination of traffic

Integrate NTA with Active Directory to obtain usernames for source destination of traffic. This will help provide userwise usage reports.

jeff.stewart - This feature was added some time ago within User Device Tracker (UDT) module and has direct integration to NTA.

Example: http://oriondemo.solarwinds.com/Orion/TrafficAnalysis/NetflowEndpointDetails.aspx?NetObject=NE:wf-r4564.wifi.local;I:203…

Screen Shot 2017-02-16 at 10.30.04 AM.png

Find more posts tagged with

feature_request_nta

active-directory

users

netflow

traffic

nta

Status: None

Comments

shawn_b

I would also like to see this integration.

User Device Tracker does this integration.

If you have UDT installed you can see the hostname of the endpoint connected to the switch port. Then click on the hostname and see the most recent login on that device.

It isn't directly accessible from NTA screens, but I think there should be.

Jfrazier

While I see this as useful, in some countries you cannot tie a username to a person and then to traffic because it violates laws. Here in the US I have no problem with it, but having to support some environments outside of the US, it would cause us a problem. Thus I am going to remain neutral on the idea.

deverts

I agree with Jfrazier, so the functionality would be great if there was a way to enable and disable, either globally or on a per subnet basis.

Sohail.Bhamani

How about on a per netflow source interface? Or all of the options!

KMSigma.SWI

We have UDT and having the endpoint "clickable" to have the user information would be great. Save us a step.

marunderwood

We have shared computers and zero client devices. It would need to work for those too.

nickzourdos

It's wonderful having this feature for the wireless tool in NPM. Please add this to NTA!

darragh.delaney

Getting usernames seems to be important for most IT managers that I meet. We integrated our LANGuardian system with Orion so it gives you a flavour of what usernames would look like in NPM or NTA. You can see an example of this at our online demo below

demo2.netfort.com/Orion/SummaryView.aspx?viewid=1&AccountID=guest

andrew_watson

I don't know if this is possible but if nta or something in the engineering tools could pin point traffic to a file or individual data that would be the icing on the cake. I've had fights with users before where I can track high traffic usage or spikes to a clients PC but I can't provide the smoking gun to show that it was a file named "xx.doc" or oversize email was the cause of the network slowness and with out the evidence I've lost cases where users were complaining of slow wan links. I can only get as far as a traffic type eg smb or a ip and port to and from.

darragh.delaney

Hi Andrew,

We have developed something which can do this called LANGuardian. It uses network packets as a data source (SPAN\mirror port or promiscious mode on a vswitch). You can drilldown from network traffic to see what files were copied or what sites were accessed. If you click on the file share traffic at the link below (middle element) you can see it in action

demo2.netfort.com/Orion/SummaryView.aspx?viewid=1&AccountID=guest

Darragh

mcam

Rather than just AD - how about LDAP integration which would work with AD and every other directory out there as well

nickzourdos

Surprised/disappointed this is not on the latest "what we're working on" list.

Jfrazier

I would want the option to not use this feature if implemented.

We have European environments where this could put us afoul of certain laws.

nickzourdos

Understood, however the lack of support for this feature is forcing my company to look at other solutions. We can accomplish much more with various other technologies.

billyjbryant

Why not rely on DNS PTR Records (which should be generated in your Domain's DNS when a machine is joined to the domain). You can then track in AD what user is logged in to what machine. (or if you are like my company, each user has their own dedicated computer, thus the machine name contains their username and makes it easy to determine). This requires no solution to be programmed by Solarwinds and there are already built in tools in your AD environment to track this information.

nickzourdos

That may work for some organizations, but in education each student does not have a specific machine that they are assigned to. We need to be able to quickly identify which user was logged in and passing traffic to specific domains/hosts/etc.

KMSigma.SWI

This looks to be corrected now.

Here's an example from my environment (running Core 2015.1.2, NPM 11.5.2, NTA 4.1.1, IPAM 4.3, and UDT 3.2.2)

Thwack_NPM+NTA+UDT.png

I moved some of the resources around to bring the UDT-specific information to the First Column (second and third resource).

nickzourdos

I suppose this makes sense why it hasn't been integrated into NTA... of course this feature is supported under a different license. I'm starting to lose patience with SolarWinds' marketing strategy.