ICAP and WinNT://DOMAINNAME
Here is a quick script that could be used
to remove the "WinNT://DOMAIN/" prefix before a username from the
sender-email field which BlueCoat sends via ICAP to Web Prevent.
This would be configured as a Script Lookup Plugin and chained to run
before other plugins. This script puts the remaining username into
a custom attribute field called UserName.
For more info on configuring Script Lookups and Plugins see the product
doco or also view this posting: http://www.symantec.com/connect/forums/liveldaplookup-using-substrings
See the attached lookup.txt Rename it to lookup.vbs
Hope it helps,