Comments
-
Poke. I am trying to do the same thing. Their reports take way too long to run. We need direct access to the DB. Getting no where with support. For an appliance that reporting is such a crucial part, it doesnt make it easy to filter or create custom reports. Tried running one report and 4 hrs later still running. What…
-
With that filter in place I am not getting File deletes. The source account is not SYSTEM here. Its a user. I am trying to create a filter that shows file deletes, writes and creates but not show form EventInfo .TMP files, NT Authority\SYSTEM doing something to the file and ~$ files. It seems like I cannot get the right…
-
Also, and I see this a lot: You don't need to tell the LEM to look for "Thing" and "Thing.SpecificField." "Thing" is implied by "Thing.SpecificField" so you only need the second thing. OK. Wanna make sure I understand. You dont need to identify "File Audit Alerts" because "FileAttributeChange" is part of "File Audit…
-
that worked. I thought the other bar said AND. I thought the big bar was for an other set of conditions but I just realized you cannot create another set of conditions. Still learning
-
Lucky i didnt do it yet. I will wait to hear this fixed before i install it on my Exchange
