TrueIdentity Entity Segregation

In multi-tenant environments, TrueIdentity conflicts can occur when TrueIdentities share the same Root Entity and Identifiers. Entity segregation is disabled by default. To ensure that logs are only enriched with a TrueIdentity when the Log Source and TrueIdentity share the same Root Entity, entity segregation must be enabled in the Mediator.

1. Go to C:\Program Files\LogRhythm\LogRhythm Mediator Server\config.
2. Open the scmedsvr.ini configuration file.
3. Under the [OPTIONAL] section, add the following to the file: EnableIdentityEntitySegregation=True.
4. Save and close the file.
5. Restart the Mediator Service.

For more information on TrueIdentity, see the Web Console User Guide.