Juniper Identity Management Service (JIMS) collects username and device IP addresses from both DNS and Active Directory domain controller event logs. DNS is used to resolve hostnames to IP addresses, while Active Directory domain controller event logs are used to get information about user accounts, such as when they last logged in.

You need to create a global firewall rulebase that matches RT_FLOW_SESSION_DENY events.
To do this, you need to specify two policy parameters: deny and session-close.