Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

SolarWinds SEM - Security Filters

SolarWinds Security Filters

Good Evening and Happy Sunday.

I'm working with SEM and have basic setup from what I can tell. I have the following connectors deployed: Windows System, Windows Security, Windows Application, and Windows Active Response.

Its prob also important to note that i don't have any rules setup yet but I have been able to create a new filter for domain admins failures. I posted a question about that earlier in thwack but was able to fix that issue myself.

I'm wondering why I don't have any of my security filters triggering, like Security Events, Firewall Events, Threat Events, Virus attacks, Web Traffic - Spyware. I would think with 1 thousand machines on our network, I got to think there should be some security traffic coming back to SEM. Am I missing something?

Thank you,

mbaker_wv

Find more posts tagged with

Accepted answers

All comments

mbaker_wv

So i was able to get this machine to start pushing defender events. I added the defender operational connector to the node, enabled the connector, and made the right reg edits on the node to start sending these logs to SEM console. So now I'm getting security event, threat events, virus attacks (verified with EICAR)

I guess ill have to figure how how to get the web traffic logs to send to SEM. I'm not sure if that's done from the host or if that's done from the edge firewall or its gateway router. what's the best way to monitor for users that navigate to known malicious or spyware sites?

mbaker_wv

npatterson

This is done at the firewall level or router level using syslogs. Do you have any IDS/IPS setup that will allow for more granular logs such as geolocation and better dynamic filter of applications traffic specifically (for example TeamViewer web traffic)