In multi-tenant environments, TrueIdentity conflicts can occur when TrueIdentities share the same Root Entity and Identifiers. Entity segregation is disabled by default. To ensure that logs are only enriched with a TrueIdentity when the Log Source and TrueIdentity share the same Root Entity, entity segregation must be enabled in the Mediator.
- Go to C:\Program Files\LogRhythm\LogRhythm Mediator Server\config.
- Open the scmedsvr.ini configuration file.
- Add the following to the file: EnableIdentityEntitySegregation=True
- Save and close the file.