View TS Agent Data

View Information About the TS Agent

Use the following procedure to view the current user sessions on the network and the port ranges assigned to each session. The data is read-only.

Procedure

Step 1

On the server where you installed the TS Agent, start the TS Agent interface as described in Start the TS Agent Configuration Interface.

Step 2

Click the Monitor tab. The following columns are displayed:

  • Session ID: Number that identifies the user's session. A user can have more than one session at a time.
  • Username: Username associated with the session.
  • Domain: Active Directory domain in which the user logged in.
  • Port Range: Port range assigned to the user.
  • Login Date: Date the user logged in.
Step 3

The following table shows the actions you can perform:

Item

Description

Click column heading

Sort data in the table by that column.

Enter a portion of a username or a complete username in the Filter by Username search field.

Click to refresh sessions displayed on this tab page.

View TS Agent User, User Session, and TCP/UDP Connection Data on the Firepower Management Center

Use the following procedure to view data reported by the TS Agent. For more information about the Firepower Management Center tables, see the Firepower Management Center Configuration Guide.

Procedure

Step 1

Log in to the Firepower Management Center where you configured the realms targeting the users your server is monitoring.

Step 2

To view users in the Users table, choose Analysis > Users > Users. The Firepower Management Center populates the Current IP, End Port, and Start Port columns if a TS Agent user's session is currently active.

Step 3

To view user sessions in the User Activity table, choose Analysis > Users > User Activity. The Firepower Management Center populates the Current IP, End Port, and Start Port columns if the TS Agent reported the user session.

Step 4

To view TCP/UDP connections in the Connection Events table, choose Analysis > Connections > Events. The Firepower Management Center populates the Initiator/Responder IP field with the IP address of the TS Agent that reported the connection and the Source Port/ICMP Type field with the port the TS Agent assigned to the connection.