• State Verified Answer
  • Locked Locked
  • Replies 1 reply
  • Subscribers 22 subscribers
  • Views 309 views
  • Users 0 members are here
Options
Related
This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

Solarwinds LEM

ffannoh

We recently just deployed LEM into our environment and I am having issues with setting up a rule/filter. I am unsure if this should be a rule initially before filtering or vise versa. Nevertheless, I am working on a close network so no traffic internally can get outside and vise versa. I want to create a filter or rule that will show me if any (DNS) query that is performed from an address outside our network. Additionally, is it possible to get that filter to display on the dashboard as a widget within the "OPS Center" tab. I haven't seen any DNS related filter that could help me accomplish this as of yet?

Please assist

  • 0

    Rules and Filters are largely independent other than they use the same logic. So you don't need a filter before a rule or vice versa.

    Filters are used to sort the data in real time, rules are used to perform actions on your behalf.

    Filters ARE necessary for creating most widgets and I would likely use it like that in your case.

    You will want to create a filter and make sure it's returning the types of data you're expecting prior to creating the widget. As far as filtering for DNS requests from outside of your organization you may have to do it with a broad correlation such as where the sourcemachine is not *10.* for example. The more specific you can get the better, but LEM doesn't really do IP ranges or anything. If you need help with this part we would need more information about the environment or Support might be able to help you.

    Once you get to the widget portion, most of the settings are going to relate to how you want to display the data, but you'll select the filter you want to use for the data, you can find out more here:

    Create and edit LEM widgets with Widget Builder - SolarWinds Worldwide, LLC. Help and Support

    If you needed to be alerted when something like this happens in your environment, then you would want to create a rule for it as well so it could notify you or take other action immediately on your behalf.

SolarWinds solutions are rooted in our deep connection to our user base in the THWACK® online community. More than 195,000 members are here to solve problems, share technology and best practices, and directly contribute to our product development process.

SolarWinds Customer Success Center Certification Media Vault Link Accounts
About THWACK Blogs For Government Edit Settings Free Tools & Trials
Legal Documents Terms of Use Privacy California Privacy Rights Security Information
©2024 SolarWinds Worldwide, LLC. All Rights Reserved.