Once the SMS is configured with the Identity Agent, the SMS
automatically polls the agent, and the user login and group information
displays in the User ID IP Correlation table. You can use this data to
correlate events to user information. This data is used for SMS reports.
You can also search an IP address to view historical information.
| Column | Description |
| Time | Specifies the date and time that the event was retrieved by the SMS. |
| IP Address | Specifies the IP address of the security login event. |
| User Name | Specifies the user name. |
| Domain | Specifies the user domains. |
| Machine | Specifies the user machines. |
| Member of Groups | Specifies all of the groups for the user. |
 |
NoteYou can manage the User ID IP Correlation data maintained by the
SMS when you perform Database Maintenance and specify retention parameters for
the data. See
Database maintenance.
|
Unknown user
The SMS may display "unknown" for the following reasons:
- Any security event that happened before the Identity Agent was installed.
- The user is not logged into a domain that is monitored by an agent which SMS is using.
- The user is logged on a non Windows system
- The user is logged on a system that uses something other than Active Directory for authentication
- Any IPs that are listed in the Unmapped IPs area in the Identity Agent.
- A remote IP address outside of your corporate network that cannot be correlated by the Identity Agent.