uberAgent

User & Host Tagging Examples

With uberAgent 5.3 comes a very powerful and flexible tagging feature which lets you enrich uberAgent’s dataset with your own custom data. While there is a feature description in the advanced topics section, we wanted to share a comprehensive list of tags you may find useful which you can copy and paste without further ado. Please read the feature description first to get the most out of the following list.

Operating System Language

# The language the operating system was installed with
[UserHostTagging]
Tag name = Host install language
Tag type = Host
Tag source = Registry
Tag value = HKLM\SYSTEM\CurrentControlSet\Control\Nls\Language\InstallLanguage

# The default language for the operating system
[UserHostTagging]
Tag name = Host default language
Tag type = Host
Tag source = Registry
Tag value = HKLM\SYSTEM\CurrentControlSet\Control\Nls\Language\Default

# The user's preferred language
[UserHostTagging]
Tag name = User preferred language
Tag type = User
Tag source = Registry
Tag value = HKCU\Software\Microsoft\CTF\SortOrder\Language\00000000
<!--NeedCopy-->

Windows 10 Version

# Windows 10 version like 1709 or 1909. More information: https://docs.microsoft.com/en-us/windows/release-information/
[UserHostTagging]
Tag name = WindowsVersion
Tag type = Host
Tag source = Registry
Tag value = HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ReleaseId
<!--NeedCopy-->

User Name

# uberAgent collects the user name in the format domain\username. This tag gives you the user name without the domain.
[UserHostTagging]
Tag name = Username
Tag type = User
Tag source = Environment
Tag value = USERNAME
<!--NeedCopy-->

User Domain

# uberAgent collects the user name in the format domain\username. This tag gives you the user's domain without the user name.
[UserHostTagging]
Tag name = Userdomain
Tag type = User
Tag source = Environment
Tag value = USERDOMAIN
<!--NeedCopy-->

User Principal Name

# The user's principal name (UPN). Example: johndoe@company.com
[UserHostTagging]
Tag name = UPN
Tag type = User
Tag source = Ad
Tag value = userPrincipalName
<!--NeedCopy-->

User Company

# The user's company. The AD attribute company has to be set for this to work.
[UserHostTagging]
Tag name = User company
Tag type = User
Tag source = Ad
Tag value = company
<!--NeedCopy-->

User Department

# The user's department. The AD attribute department has to be set for this to work.
[UserHostTagging]
Tag name = User department
Tag type = User
Tag source = Ad
Tag value = department
<!--NeedCopy-->

User AD Organizational Unit

[UserHostTagging]
Tag name = User OU
Tag type = User
Tag source = Ad
Tag value = distinguishedName
<!--NeedCopy-->

User DNS Domain

# This gives you the user's full qualified DNS domain name
[UserHostTagging]
Tag name = User DNS domain
Tag type = User
Tag source = Environment
Tag value = USERDNSDOMAIN
<!--NeedCopy-->

User Account Control

# Account options. 512 = activated, 514 = deactivated, 66048 = password never expires. More information: https://support.microsoft.com/en-us/help/305144/how-to-use-useraccountcontrol-to-manipulate-user-account-properties
[UserHostTagging]
Tag name = User account control
Tag type = User
Tag source = Ad
Tag value = userAccountControl
<!--NeedCopy-->
User & Host Tagging Examples