Here is a quick script that could be used
to remove the "WinNT://DOMAIN/" prefix before a username from the
sender-email field which BlueCoat sends via ICAP to Web Prevent.

This would be configured as a Script Lookup Plugin and chained to run
before other plugins.  This script puts the remaining username into
a custom attribute field called UserName.

For more info on configuring Script Lookups and Plugins see the product
doco or also view this posting: http://www.symantec.com/connect/forums/liveldaplookup-using-substrings

See the attached lookup.txt  Rename it to lookup.vbs

Hope it helps,

Bob.