Application log shows different usernames

[ED]

Hi,

This is a screenshot from an Application log which shows me two different usernames.

Marked with orange and number 1 have the same username. Marked with blue is a different username. Why is destination user name different from the User field?

[Norbert_Bohusch]

Destination Username is the one associated to destination IP.

[ED]

Associated in which way? Can you explain more please. 

[Norbert_Bohusch]

By identity awareness depending on your configuration. I assume ADquery or IDC.

[ED]

I understand that. But if user a access a MS-SQL database, why is a different user b shown on destination username?

[Norbert_Bohusch · Accepted solution]

Because user b logged in to the database server (on the windows system) and the IP of the server was associated with this user.

A session from user a only shows this information as this information was not deleted (has not timed out).

[ED]

Thanks for explaining. Since this was a correlated log showing user a accessing a database I don't see the point in this log of having the information about user b that is associated with that server. Do you?

[Norbert_Bohusch]

I wouldn't need this information, but better have an information I don't need, than omitting it 🙂

Btw. if you don't need identity awareness on your servers (as source), you could exclude the server networks generally from IDC or ADquery.

[Sean_OConnor]

While I usually see omitting data as a bad thing, in this case I was misled by the wording "Destination User Name". In my experience, some logs look like user a is a compromised account that's trying to access the system at the IP that user b is associated to. I'll be updating my team and any others that ask about that feature. Maybe a name change on those fields can be considered? Also "Dst User Dn"