User Identity and Activity

A identity source is a user data management system that

  • collects active session data, user data, and user activity data from network users,

  • organizes this data into distinct workflows for individual user analysis, and

  • enables administrators to monitor and manage user behavior across the network.

Identity sources collect active session data, user data, and user activity data. The data is displayed in individual user-related workflows:

  • Active Sessions: This workflow displays all current user sessions on your network. A single user running several simultaneous active sessions would occupy several rows in this table. For more information about the types of user data displayed in this workflow, refer to Active sessions data.

  • Users: This workflow displays all users seen on your network. A single user occupies a single row in this table. For more information about the types of user data displayed in this workflow, refer to User data.

  • User Activity: This workflow displays all user activity seen on your network. A single user with more than one instance of user activity would occupy several rows in this table. For more information about the types of user activity displayed in this workflow, refer to User activity data.

User-related fields

User-related data is displayed in the active sessions, users, and user activity tables.


Note

Active sessions for Azure AD realm users are displayed only in the Active Sessions new UI layout and not in the legacy UI.

Table 1. Active sessions, users, and user activity field descriptions

Field

Description

Active Sessions Table

Users Table

User Activity Table

Active Session Count

The number of active sessions associated with the user.

No

Yes

No

Authentication Type

The type of authentication: No Authentication, Passive Authentication, Active Authentication, Guest Authentication, Failed Authentication, or VPN Authentication.

For more information about the supported identity sources for each Authentication Type, refer to the Cisco Secure Firewall Management Center Device Configuration Guide .

Yes

No

Yes

Available for Policy

A value of Yes means the user was retrieved from the user store (for example, Active Directory). )

A value of No means the Cloud-Delivered Firewall Management Center received a report of a login for that user but the user is not in the user store. One way this can happen is if a user in an excluded group logs in to the user store. You can exclude groups from being downloaded when you configure a realm.

Users not available for policy are recorded in the Cloud-Delivered Firewall Management Center but are not sent to managed devices.

No

Yes

No

Count

Note

 

The Count field is displayed only after you apply a constraint that creates two or more identical rows.

Depending on the table, the number of sessions, users, or activity events that match the information that appears in a particular row.

Yes

Yes

Yes

Current IP

(See also Current IP/Domain and IP address.)

The IP address associated with the host that the user is logged into.

This field is blank in the Users table if there are no active sessions for a user.

Yes

No

No

Department

The user’s department, as obtained by a realm. If there is no department explicitly associated with the user on your servers, the department is listed as whatever default group the server assigns. For example, on Active Directory, this is Users (ad). This field is blank if:

  • You have not configured a realm.

  • The Cloud-Delivered Firewall Management Center cannot correlate the user in the Cloud-Delivered Firewall Management Center database with an LDAP record (for example, for users added to the database via an AIM, Oracle, or SIP login).

Yes

Yes

No

Description

More information, if available, about the session, user, or user activity.

No

No

Yes

Device

For user activity detected by traffic-based detection or an active authentication identity source, the name of the device that identified the user.

For other types of user activity, the managing Cloud-Delivered Firewall Management Center.

Note

 

If you have configured your VPN in a high-availability deployment, the device name displayed against active VPN sessions can be the primary or secondary device that identified the user session.

Yes

No

Yes

Discovery Application

The application or protocol used to detect the user.

  • For user activity detected by traffic-based detection, one of the following: ldap, pop3, imap, oracle, sip, http, ftp, mdns, or aim.

    Note

     

    Users are not added to the database based on SMTP logins.

  • For all other user activity: ldap.

Yes

Yes

Yes

Current IP Domain / Domain

In the Active Sessions table, the multitenancy domain where the user activity was detected.

In the Users table, the multitenancy domain associated with the user's realm.

In the User Activity table, the multitenancy domain where the user activity was detected.

This field is only present if you have ever configured the Cloud-Delivered Firewall Management Center for multitenancy.

Yes

Yes

Yes

Email

The user’s email address. This field is blank if:

  • The user was added to the database via an AIM login.

  • The user was added to the database via an LDAP login and there is no email address associated with the user on your LDAP servers.

Yes

Yes (as E-Mail)

No

End Port

If the user was reported by the TS Agent and their session is currently active, this field identifies the end value for the port range assigned to the user. This field is blank if the user's TS Agent session is inactive or if the user was reported by another identity source.

No

No

Yes

Endpoint Location

The IP address of the network device that used ISE to authenticate the user, as identified by ISE. If you do not configure ISE, this field is blank.

No

No

Yes

Endpoint Profile

The user's endpoint device type, as identified by Cisco ISE. If you do not configure ISE, this field is blank.

No

No

Yes

Event

The user activity event type.

No

No

Yes

First Name

The user’s first name, as obtained by a realm. This field is blank if:

  • You have not configured a realm.

  • The Cloud-Delivered Firewall Management Center cannot correlate the user in the Cloud-Delivered Firewall Management Center database with an LDAP record (for example, for users added to the database via an AIM, Oracle, or SIP login).

  • There is no first name associated with the user on your servers.

Yes

Yes

No

IP Address

For User Login user activity, the IP address or internal IP address involved in the login:

  • LDAP, POP3, IMAP, FTP, HTTP, MDNS, and AIM logins — the address of the user’s host

  • SMTP and Oracle logins — the address of the server

  • SIP logins — the address of the session originator

(See also Current IP and Current IP/Domain.)

An associated IP address does not mean the user is the current user for that IP address; when a non-authoritative user logs into a host, that login is recorded in the user and host history. If no authoritative user is associated with the host, a non-authoritative user can be the current user for the host. However, after an authoritative user logs into the host, only a login by another authoritative user changes the current user.

For other types of user activity, this field is blank.

No

No

Yes

Last Name

The user’s last name, as obtained by a realm. This field is blank if:

  • You have not configured a realm.

  • The Cloud-Delivered Firewall Management Center cannot correlate the user in the Cloud-Delivered Firewall Management Center database with an LDAP record (for example, for users added to the database via an AIM, Oracle, or SIP login).

  • There is no last name associated with the user on your servers.

Yes

Yes

No

Last Seen

The date and time that a session was last initiated (or user data was updated) for the user.

Yes

Yes

No

Login Time

The date and time that the session was initiated for the user.

Yes

No

No

Phone Number

The user’s telephone number, as obtained by a realm. This field is blank if:

  • You have not configured a realm.

  • The Cloud-Delivered Firewall Management Center cannot correlate the user in the Cloud-Delivered Firewall Management Center database with an LDAP record (for example, for users added to the database via an AIM, Oracle, or SIP login).

  • There is no telephone number associated with the user on your servers.

Yes (as Phone)

Yes

No

Realm

The identity realm associated with the user.

Yes

Yes

Yes

Security Group Tag

The Security Group Tag (SGT) attribute applied by Cisco TrustSec as the packet entered a trusted TrustSec network. If you do not configure ISE, this field is blank.

No

No

Yes

Session Duration

The duration of the user session, calculated from the Login Time and the current time.

Yes

No

No

Start Port

If the user was reported by the TS Agent and their session is currently active, this field identifies the start value for the port range assigned to the user. This field is blank if the user's TS Agent session is inactive or if the user was reported by another identity source.

No

No

Yes

Time

The time that the system detected the user activity.

No

No

Yes

User

At minimum, this field displays the user's realm and username. For example, Lobby\jsmith, where Lobby is the realm and jsmith is the username.

If a realm downloads additional user data from an LDAP server and the system associates it with a user, this field also displays the user's first name, last name, and type. For example, John Smith (Lobby\jsmith, LDAP), where John Smith is the user's name and LDAP is the type.

Note

 

Because traffic-based detection can record unsuccessful AIM logins, the Cloud-Delivered Firewall Management Center may store invalid AIM users (for example, if the username is misspelled by the user).

Yes

Yes

No

Username

The username associated with the user.

Yes

Yes

Yes

VPN Bytes In

For Remote Access VPN-reported user activity, the total number of bytes received from the remote peer or client by the Firewall Threat Defense.

Note

 

You can view the total number of bytes received once the user's VPN session is terminated. For ongoing VPN sessions, this is not a dynamic counter.

For other types of user activity, this field is blank.

Yes

No

Yes

VPN Bytes Out

For Remote Access VPN-reported user activity, the total number of bytes transmitted to the remote peer or client by the Firewall Threat Defense.

Note

 

You can view the total number of bytes transmitted once the user's VPN session is terminated. For ongoing VPN sessions, this is not a dynamic counter.

For other types of user activity, this field is blank.

No

No

Yes

VPN Client Application

For Remote Access VPN-reported user activity, the remote user's AnyConnect VPN module of Cisco Secure Client application.

For other types of user activity, this field is blank.

Yes

No

Yes

VPN Client Country

For Remote Access VPN-reported user activity, the country name as reported by the Secure Client VPN.

For other types of user activity, this field is blank.

No

No

Yes

VPN Client OS

For Remote Access VPN-reported user activity, the remote user's endpoint operating system as reported by the Secure Client VPN.

For other types of user activity, this field is blank.

Yes

No

Yes

VPN Client Public IP

For Remote Access VPN-reported user activity, the publicly routable IP address of the Secure Client VPN device.

For other types of user activity, this field is blank.

Yes

No

Yes

VPN Connection Duration

For Remote Access VPN-reported user activity, the total time (HH:MM:SS) that the session was active.

For other types of user activity, this field is blank.

No

No

Yes

VPN Connection Profile

For Remote Access VPN-reported user activity, the name of the connection profile (tunnel group) used by the VPN session. Connection profiles are part of a Remote Access VPN Policy.

For other types of user activity, this field is blank.

Yes

No

Yes

VPN Group Policy

For Remote Access VPN-reported user activity, the name of the group policy assigned to the client when the VPN session is established; either the statically-assigned group policy associated with the VPN Connection Profile, or the dynamically-assigned group policy if RADIUS is used for authentication. If assigned by the RADIUS server, this group policy overrides the static policy configured for the VPN Connection Profile. Group policies configure common attributes for groups of users in Remote Access VPN policies.

For other types of user activity, this field is blank.

Yes

No

Yes

VPN Session Type

For Remote Access VPN-reported user activity, the type of session: LAN-to-LAN or Remote.

For other types of user activity, this field is blank.

Yes

No

Yes

Active sessions data

The Integrations > Users > Active Sessions workflow displays select information about current user sessions.

When a user on your network runs several sessions simultaneously, the system can uniquely identify the sessions if:

  • they have unique IP Address values.

  • they have unique Start Port and End Port values, as provided by the Cisco Terminal Services (TS) Agent.

  • they have unique Current IP Domain values.

  • they were authenticated by different identity sources.

  • they were associated with different identity realms.

For more information about the user and user activity data stored by the system, refer to User data and User activity data.

View active session data

You can view a table of active sessions, and then manipulate the event view depending on the information you are looking for.

The page you see when you access users differs depending on the workflow you use. You can use the predefined workflow, which includes a table view of users that lists all detected users, and terminates in a user details page. The user details page provides information on every user that meets your constraints.

Procedure

Step 1

Choose Events & Logs > Users > Active Sessions.

Step 2

You have these options:

User data

This reference describes how user records are created and updated in the database and what identity-related information the system stores.

When an identity source reports a user login for a user who is not already in the database, the user is added to the database, unless you have specifically restricted that login type.

The system updates the users database when one of the following occurs:

  • A user on the Cloud-Delivered Firewall Management Center manually deletes a non-authoritative user from the Users table.

  • An identity source reports a logoff by that user.

  • A realm ends the user session as specified by the realm's User Session Timeout: Authenticated Users, User Session Timeout: Failed Authentication Users, or User Session Timeout: Guest Users setting.


Note

If you have ISE/ISE-PIC configured, you may see host data in the users table. Because host detection by ISE/ISE-PIC is not fully supported, you cannot perform user control using ISE-reported host data.

The type of user login that the system detected determines what information is stored about the new user.

Identity Source

Login Type

User Data Stored

ISE/ISE-PIC

Active Directory

LDAP

RADIUS

RSA

  • username

  • current IP address

  • Security Group Tag (SGT) — not supported with ISE-PIC

  • endpoint profile/device type — not supported with ISE-PIC

  • endpoint location/location IP — not supported with ISE-PIC

  • type (LDAP)

TS Agent

Active Directory

  • username

  • current IP address

  • start port

  • end port

  • type (LDAP)

captive portal

Active Directory

LDAP

  • username

  • current IP address

  • type (LDAP)

traffic-based detection

LDAP

AIM


Oracle

SIP

HTTP

FTP

MDNS

  • username

  • current IP address

  • type (AD)

POP3

IMAP

  • username

  • current IP address

  • email address

  • type ( pop3 or imap )


Note

No data about Microsoft Azure Active Directory users is displayed in this table.

If you configure a realm to automatically download users, the Cloud-Delivered Firewall Management Center queries the servers based on the interval you specified. It may take five to ten minutes for the Cloud-Delivered Firewall Management Center database to update with user metadata after the system detects a new user login. The Cloud-Delivered Firewall Management Center obtains the following information and metadata about each user:

  • username

  • first and last names

  • email address

  • department

  • telephone number

  • current IP address

  • Security Group Tag (SGT), if available

  • endpoint profile, if available

  • endpoint location, if available

  • start port, if available

  • end port, if available

The number of users the Cloud-Delivered Firewall Management Center can store in its database depends on your Cloud-Delivered Firewall Management Center model. When a non-authoritative user login is detected on a host, that login is recorded in the user and host history. If no authoritative user is associated with the host, a non-authoritative user can be the current user for the host. However, after an authoritative user login is detected for that host, only another authoritative user login changes the current user.

Note that traffic-based detection of AIM, Oracle, and SIP logins create duplicate user records because they are not associated with any of the user metadata that the system obtains from LDAP servers. To prevent overuse of user count because of duplicate user records from these protocols, configure traffic-based detection to ignore those protocols.

You can search, view, and delete users from the database; you can also purge all users from the database.

For information about general user-related event troubleshooting, refer to Cisco Secure Firewall Management Center Device Configuration Guide.

View user data

You can view a table of users, and then manipulate the event view depending on the information you are looking for.

The page you see when you access users differs depending on the workflow you use. You can use the predefined workflow, which includes a table view of users that lists all detected users, and terminates in a user details page. The user details page provides information on every user that meets your constraints.

Procedure

Step 1

Choose Events & Logs > Users > User Details.

Step 2

Choose from the following options:

  • Perform basic workflow actions.
  • Learn more about the contents of the columns in the table; refer to User-related fields.

User activity data

A user activity data record is a security event type that

  • logs the appearance and login of users on a network,

  • enables correlation between user actions and other network events such as intrusions, and

  • supports automated remediation and alerting through customizable rules.

The system generates events that communicate the details of user activity on your network. When the system detects user activity, the user activity data is logged to the database. You can view, search, and delete user activity; you can also purge all user activity from the database.

The system logs a user activity event when a user is seen on your network for the first time. Subsequent appearances by that user do not log new user activity events. However, if the user's IP address changes, the system logs a new user activity event.

The system also correlates user activity with other types of events. For example, intrusion events can tell you the users who were logged into the source and destination hosts at the time of the event. This correlation can tell you who was logged into the host that was targeted by an attack, or who initiated an internal attack or portscan.

You can also use user activity in correlation rules. Based on the type of user activity as well as other criteria that you specify, you can build correlation rules that, when used in a correlation policy, launch remediations and alert responses when network traffic meets your criteria.


Note

If you have ISE/ISE-PIC configured, you may see host data in the users table. Because host detection by ISE/ISE-PIC is not fully supported, you cannot perform user control using ISE-reported host data.

Descriptions of the four types of user activity data follow.

New User Identity

This type of event is generated when the system detects a login by an unknown user that is not in the database.

The system logs a user activity event when a user is seen on your network for the first time. Subsequent appearances by that user do not log new user activity events. However, if the user's IP address changes, the system logs a new user activity event.

User Login

This type of event is generated when any of the following occur:

  • Captive portal performs a successful or failed user authentication.

  • Traffic-based detection detects a successful or failed user login.


Note

SMTP logins detected by traffic-based detection are not recorded unless there is already a user with a matching email address in the database.

When a non-authoritative user logs into a host, that login is recorded in the user and host history. If no authoritative user is associated with the host, a non-authoritative user can be the current user for the host. However, after an authoritative user logs into the host, only a login by another authoritative user changes the current user.

If you are using captive portal or traffic-based detection, note the following about failed user login and failed user authentication data:

  • Failed logins reported by traffic-based detection (LDAP, IMAP, FTP, and POP3 traffic) are displayed in the table view of user activity, but not in the table view of users. If a known user failed to log in, the system identifies them by their username. If an unknown user failed to log in, the system uses Failed Authentication as their username.

  • Failed authentications reported by captive portal are displayed in both the table view of user activity and the table view of users. If a known user failed to authenticate, the system identifies them by their username. If an unknown user failed to authenticate, the system identifies them by the username they entered.

Delete User Identity

This type of event is generated when you manually delete a user from the database.

User Identity Dropped: User Limit Reached

This type of event is generated when the system detects a user that is not in the database, but cannot add the user because you have reached the maximum number of users in the database as determined by your Cloud-Delivered Firewall Management Center model.

After you reach the user limit, in most cases the system stops adding new users to the database. To add new users, you must either manually delete old or inactive users from the database, or purge all users from the database.

However, the system favors authoritative users. If you have reached the limit and the system detects a login for a previously undetected authoritative user, the system deletes the non-authoritative user who has remained inactive for the longest time, and replaces it with the new authoritative user.

User Indications of Compromise Events

The following user IOC changes are logged in the user activity database:

  • When indications of compromise are resolved.

  • When indication of compromise rules are enabled or disabled for users.

For information about general user-related event troubleshooting, refer to the Cisco Secure Firewall Management Center Device Configuration Guide.

View user activity data

You can view a table of user activity, and then manipulate the event view depending on the information you are looking for. The page you see when you access user activity differs depending on the workflow you use. You can use the predefined workflow, which includes the table view of user activity and terminates in a user details page, which contains user details for every user that meets your constraints.

Procedure

Step 1

Choose Events & Logs > Users > User Activity.

Step 2

You have the following options:

  • Perform basic workflow actions.
  • Learn more about the contents of the columns in the table; refer to User-related fields.

User profile and host history

A user profile is a web interface display that

  • provides detailed information about a specific user through the User pop-up window (titled "User Identity" in the web interface)

  • shows the same user data as you would see in the table view of users, and

  • includes host history that provides a graphic representation of the last twenty-four hours of the user's activity.

User profile access points

You can learn more about a specific user by viewing the User pop-up window. The page that appears, called the "User Profile" in this document, is titled "User Identity" in the web interface.

You can display the window from:

  • any event view that associates user data with other kinds of events

  • the table view of active sessions

  • the table view of users

User information also appears in the terminating page for users workflows.

The user data you see is the same as you would see in the table view of users.

Host history section

The host history provides a graphic representation of the last twenty-four hours of the user’s activity. A list of IP addresses of the hosts that the user logged into and logged off of approximates login and logout times with bar graphs. A typical user might log on to and off of multiple hosts in the course of a day. For example, periodic automated logins to a mail server would display as multiple short sessions, while longer logins (such as during working hours) display longer sessions.

If you use traffic-based detection or captive portal to capture failed logins, the host history also includes hosts where the user failed to log in.

The data used to generate the host history is stored in the user history database, which by default stores 10 million user login events. If you do not see any data in the host history for a particular user, either that user is inactive, or you may need to increase the database limit.

View user details and host history

User details and host history provide valuable insights for security analysis and incident investigation.

Procedure

You have two options:

  • In any event view that lists users, click user that appears next to a user identity User icon, or, for users associated with an indication of compromise, Red User icon.

  • In any users workflow, click the Users terminating page.