Documentation

Contents
Contents

User & Host Tagging Examples

With uberAgent 5.3 comes a very powerful and flexible tagging feature which lets you enrich uberAgent’s dataset with your own custom data. While there is a feature description in the advanced topics section, we wanted to share a comprehensive list of tags you may find useful which you can copy and paste without further ado. Please read the feature description first to get the most out of the following list.

Operating System Language

# The language the operating system was installed with
[UserHostTagging]
Tag name = Host install language
Tag type = Host
Tag source = Registry
Tag value = HKLM\SYSTEM\CurrentControlSet\Control\Nls\Language\InstallLanguage

# The default language for the operating system
[UserHostTagging]
Tag name = Host default language
Tag type = Host
Tag source = Registry
Tag value = HKLM\SYSTEM\CurrentControlSet\Control\Nls\Language\Default

# The user's preferred language
[UserHostTagging]
Tag name = User preferred language
Tag type = User
Tag source = Registry
Tag value = HKCU\Software\Microsoft\CTF\SortOrder\Language\00000000

User Name

# uberAgent collects the user name in the format domain\username. This tag gives you the user name without the domain.
[UserHostTagging]
Tag name = Username
Tag type = User
Tag source = Environment
Tag value = USERNAME

User Domain

# uberAgent collects the user name in the format domain\username. This tag gives you the user's domain without the user name.
[UserHostTagging]
Tag name = Userdomain
Tag type = User
Tag source = Environment
Tag value = USERDOMAIN

User Company

# The user's copmany. The AD attribute company has to be set for this to work.
[UserHostTagging]
Tag name = User company
Tag type = User
Tag source = Ad
Tag value = company

User Department

# The user's department. The AD attribute department has to be set for this to work.
[UserHostTagging]
Tag name = User department
Tag type = User
Tag source = Ad
Tag value = department

User AD Organizational Unit

[UserHostTagging]
Tag name = User OU
Tag type = User
Tag source = Ad
Tag value = distinguishedName

User DNS Domain

# This gives you the user's full qualified DNS domain name
[UserHostTagging]
Tag name = User DNS domain
Tag type = User
Tag source = Environment
Tag value = USERDNSDOMAIN

User Account Control

# Account options. 512 = activated, 514 = deactivated, 66048 = password never expires. More information: https://support.microsoft.com/en-us/help/305144/how-to-use-useraccountcontrol-to-manipulate-user-account-properties
[UserHostTagging]
Tag name = User account control
Tag type = User
Tag source = Ad
Tag value = userAccountControl