On 07-01-2019 10:54 AM, Mohit verma02 wrote:
>
> Thanks for the update Edward.
> Does this mean we need to raise a service request with NetIQ for this?
> Looks like OOB functionality doesn't provide this feature.
> What IP do you see in Sentinel though? Is it the NAM Source IP?


The data in the event itself doesn't contain any source IP. The event was generated by NAM so that is what Sentinel sees. I think this should be seen
as a broader event where the authentication (which does contain a source IP) is separated from the token issuing so I think this is just working as
designed. Whether you agree with that design is obviously a different question


--
Cheers,
Edward