Video Screencast Help


Created: 01 Feb 2013 • Updated: 04 Feb 2013 | 4 comments

Here is a quick script that could be used
to remove the "WinNT://DOMAIN/" prefix before a username from the
sender-email field which BlueCoat sends via ICAP to Web Prevent.

This would be configured as a Script Lookup Plugin and chained to run
before other plugins.  This script puts the remaining username into
a custom attribute field called UserName.

For more info on configuring Script Lookups and Plugins see the product
doco or also view this posting:

See the attached lookup.txt  Rename it to lookup.vbs

Hope it helps,


Comments 4 CommentsJump to latest comment

kishorilal1986's picture

Nice document Bob , but can u provode me script for getting machine IP of networks incidents

bob_b's picture

K S Sharma -

Check out this post and the uploaded script.  It uses the IP address of the machine in Network incidents and returns the DNS name of the client and the server (along with a whole lot of other attributes).  I think it is what you want.


Anil Kishore_Acpl's picture

Hi Bob,

Here we are using enforce on linux platform, Please suggest how can we achive the same on linux platform.

Thanks in advance.



bob_b's picture

Anil -

Unfortunately, I wrote the script only in vbScript.  There is no reason that the whole thing couldn't be written in PHP or Perl for those customers running on Linux platforms.  If someone wants to port the code I posted to one of those other languages, that would be great for the community.