In multi-tenant environments, TrueIdentity conflicts can occur when TrueIdentities share the same Root Entity and Identifiers. Entity segregation is disabled by default. To ensure that logs are only enriched with a TrueIdentity when the Log Source and TrueIdentity share the same Root Entity, entity segregation must be enabled in the Mediator.
-
Go to C:\Program Files\LogRhythm\LogRhythm Mediator Server\config.
-
Open the scmedsvr.ini configuration file.
-
Under the [OPTIONAL] section, add the following to the file: EnableIdentityEntitySegregation=True.
-
Save and close the file.
-
Restart the Mediator Service.