User names are not populating in the User Name report widget in Security Analytics

Products

• Security Analytics
• Security Analytics - VA

Issue/Introduction

When running a report where there should be user names populating, the User Name report is blank.  The HTTP Auth Username report does have some names, but there are several missing.

Environment

Security Analytics 8.3.1 and earlier

Cause

The correct report to use is HTTP Auth Username.  The "HTTP Auth Username" report is populated from the HTTP Authorization header.  The difference is that only HTTP 1.1 traffic is parsed for usernames.  If the traffic is HTTP 2, the username is base64 encoded inside the authorization header and Security Analytics does not have the capability to decode it and present the username in the report widget.

Resolution

Currently the HTTP 2 traffic will not show up correctly in the HTTP Auth Username report.  An enhancement has been created and should be remedied in a future release of 8.3.x.