How to identify PTA authentication agent id

%3CLINGO-SUB%20id%3D%22lingo-sub-2633784%22%20slang%3D%22en-US%22%3EHow%20to%20identify%20PTA%20authentication%20agent%20id%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2633784%22%20slang%3D%22en-US%22%3E%3CP%3E%3CBR%20%2F%3Ewe%20are%20using%204%20pta%20agents%20across%20our%20environment%20and%20looking%20to%20identify%20PTA%20agent%20id%20for%20each%20installed%20server.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Ewe%20send%20azure%20authentication%20logs%20to%20SIEM.%20Our%20SIEM%20logs%20show%20that%20user%20has%20authenticated%20through%20PTA%20with%3C%2FP%3E%3CP%3EPTA%20AgentId%3A%20xx13bxxx-54xx-41xx-8exx-xxxx2d9xxxx%22%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Ei%20am%20interested%20to%20know%20through%20which%20agent%20user%20has%20been%20authenticated%20through.%26nbsp%3B%20Is%20there%20way%20to%20find%20out%20each%20allocated%20pta%20agent%20id%20for%20individual%20servers%20%3F%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-2633784%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20AD%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E
Visitor


we are using 4 pta agents across our environment and looking to identify PTA agent id for each installed server. 

 

we send azure authentication logs to SIEM. Our SIEM logs show that user has authenticated through PTA with

PTA AgentId: xx13bxxx-54xx-41xx-8exx-xxxx2d9xxxx"

 

i am interested to know through which agent user has been authenticated through.  Is there way to find out each allocated pta agent id for individual servers ? 

0 Replies