What query checkpoint wmic uses to get the username from event IDs4624/4625

[Blason_R]

Hi Guys,

Wondering if anyone knows what query checkpoint uses to query AD server over wmi to get the logged on usernames and then map it with log fields?

[PhoneBoy · Accepted solution]

If you're talking about ADQuery, we actually register to specific event types from the security logs and have them sent to the gateway.
More details: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

[Blason_R]

Thanks for update.