Comments
-
Is it possible that the AP's are in another Vlan? I looked up the availble connectors for Sophos in SEM, but I can't figure out if one of them is specified for AP's. As far as I know, you can manage the AP's over XG Firewall and Sophos UTM 9, so it may be possible to log them over those connectors.
-
i just found a great video for you: How to Use and Create Filters in SEM - YouTube
-
i can understand that. i wanted to look it up this morning, now i see that neomatrix1217 already gave the answer. Rule > Continuous Excessive Logon Failures > click the three Menu Dots > edit I hope this helps. have a nice one
-
...
-
Sounds like you're on your way for a certificate. I guess the best way to solve this specific task is to create rules wich filter for the admin IP's and the logon logoff event ID's.
-
Why do you want to forward as .xml? There is a way If you want to save your logs as .xml in the manager. In the log to file action change .txt to .xml and change the log file format to XML tagged format
