FIM Exclusions

This exclusion option seems to only cover files or file extensions. Do you know when Folder or Directory exclusions will be part of SEM?

FIM Exclusions are now possible as part of the SEM 6.7 release.

seems like a no brainer and one of the same problems I have with GFI EventsManger.  The noise generated inside the windows directories is insane.

I am currently working with a client for LEM who needs to be PCI compliant, so using the built-in FIM template for PCI for Windows connections is crucial. However, there are some events we would love to be able to ignore, like any event where the NT AUTHORITY\SYSTEM account was who made the change, or to ignore files in, for example, HP Insight's Program Files folder (surprisingly noisy) without the "workaround" being dealing with GPOs (not everyone is a wondrous AD admin that can delve that far into audit policies without help) or having to select every file and folder AROUND the thing you want to exclude. This is a feature that the lack of having is seriously changing my client's entire views on the product. They need it for PCI compliance, but can't consider themselves compliant because the events they have to monitor are lost in such a firehose of superfluous events that they only are able to keep a few weeks of data at best. We can tune out the folders using the "select around it" method but that only goes so far. Being able to have a whitelist-style list of services/files/folders to ignore events for would be extremely welcome and make the product much easier to use. I'd love to see some movement on this request.

Nathan Hejnicki

Loop1 Systems

YES