000012444 - Envision: Alerts firing for fields that should not match watchlist

Document created by RSA Customer Support Employee on Jun 16, 2016Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 2Show Document
  • View in full screen mode

Article Content

Article Number000012444
Applies ToenVision
IssueStop alerts from firing when, for example, username is not in watchlist
CauseWatchlists will match if the name in the watchlist is a subset of the name in the event message if Regex is turned on.
ResolutionDisable Regex if the watchlist contains an exact match for the field.  i.e. use UserName instead of UserID if the watchlist does not contain the windows domain\username and only contains the username.
Legacy Article IDa47527