Network Implementation Guide › Applying User Policy to NBA Events › How Are Participants Assigned to NBA Events? › Machine ID as Stored File or IM Event Participants

Machine ID as Stored File or IM Event Participants

When a policy engine processes an NBA file or IM conversation, the resulting event is automatically associated with the source machine. Specifically, an address matching the machine’s IP address is associated with each processed event and stored in the CMS database.

This means each NBA file or IM event is associated with a ‘host machine’ address. This provides a mechanism for associating file uploads, downloads, FTP transfers and IM events with individual CA DLP users. In CA DLP terms, these machine addresses are referred to as ‘pseudo user addresses’.

Notes

• This mechanism does not apply to files sent as email or IM attachments. These are mapped to CA DLP users by conventional email addresses.
• To ensure that the resulting file events are searchable by user name in the iConsole or Data Management console, CA DLP administrators must first add the relevant machine IP addresses to users' address lists in the Administration console. For details, see the online help; search the index for ‘e‑mail addresses: updating’.

  For example, the NBA captures a file being uploaded from machine 10.0.169.5. To ensure this file can be retrieved during an iConsole event search, you would need to add that IP address to the address list for an appropriate CA DLP user account. (You add new addresses in the User Properties dialog in the Administration console.)