Unknown users reported in Authetication datamodel

[EFonua]

We have an alert showing users that are authenticating after working hours for security reasons, I'm sure y'all familiar with, but at the same time, we know who leaves their workstations on during the night.

However, we have recently received alerts with "unknown" users reported in the alert. But after checking the host's event viewer (Security Log) and comparing with the timestamps in the alert, the event logs shows the users.

Any idea how we can edit our search string, or what may have caused the string to return the unknown value?

[livehybrid]

Hi @EFonua 

It seems that something must have changed in either the field extractions for your users, or the source data. 

Have you updated any apps recently or made any field extractions changes?

Without the actual search you are running it is hard for us to determine the issue here, but I would start out by running the search manually to see what user values you get, then work back from there to determine why the correct value isnt appearing.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing