The UserID agent is designed to perform transparent authentication on selected NGFW devices. It uses Microsoft Active Directory logs (via the WMI protocol) and Syslog (via the standardized syslog protocol RFC 3164, RFC 5424, RFC 6587) as the authentication data source.