Entity Segregation

In multi-tenant environments, TrueIdentity conflicts can occur when TrueIdentities share the same Root Entity and Identifiers. Entity segregation is disabled by default. To ensure that logs are only enriched with a TrueIdentity when the Log Source and TrueIdentity share the same Root Entity, entity segregation must be enabled in the Mediator.

1. Go to C:\Program Files\LogRhythm\LogRhythm Mediator Server\config.
2. Open the scmedsvr.ini configuration file.
3. Add the following to the file: EnableIdentityEntitySegregation=True
4. Save and close the file.

For more information on TrueIdentity, see the Web Console User Guide.