The Vital Security Web Appliance uses four different methods to identify and authenticate network users before allowing any web transaction:

1. Source IP.
2. Read Headers.
3. Get User Credentials.
4. Authentication.

This article describes and demonstrates the Read Headers method.

In the "Read Headers" identification method, the Vital Security Web Appliance relies on the downstream proxy to provide headers information in each transaction.
These headers would be used then to identify the username of the person who originated the transaction and/or the IP of the client machine from which the transaction originated.
The Vital Security Web Appliance can be configured to monitor specific headers, such as X-Authenticated-User for username and/or X-Client-IP for client IP address information. In this scenario, it is assumed that the information forwarded by the downstream proxy is valid.
The Vital Security Web Appliance does not attempt to verify the supplied data.

Please note that the Microsoft ISA server must be properly configured to forward this information to the Vital Security Web Appliance.
Vital Security IP forwarding plugin should be installed on the Micrsoft ISA server for this purpose (please review the below Finjan Vital Knowledge Base article on this topic: http://kb.finjan.com/article.asp?article=1282&p=4 ).

The plugin setup file can be downloaded from the below location:
http://download.finjan.com/products/ng/ipfwd/index.htm

This policy is designed to use one rule "Always Identify Users by Headers" :

This rule is set to "Identify by headers" action based on specific headers information:

As mentioned above, assuming that the information (IP / username) forwarded by the downstream proxy is valid, it then would be properly logged for further usage in reports / log viewer.