Monitoring user activity

[RSAAdmin]

Hi,

I am looking for a solution to monitore a specific user - or group of user - for all the networks access (vpn, shared folders, web, etc). Where can I found this type of functionnalities on enVision ? Or some documentation about it.

regards,

S.

[RSAAdmin]

You could write a report that looks for those messages or the categories of interest and use a watchlist that contains the user(s).

If you have updated to the latest ESUs and use Content 2.0, you can also leverage the Enhanced Categorization Tagging and create a where clause like this:

ECActivity='Logon' AND ECOutcome='Success' AND UserName IN (${UserWatchList} )

against the Global Table.

Paul

[RSAAdmin]

Hi,

I am not sure to understand. What type of report exactly, where is the watchlist, etc..?

best,

S

[RSAAdmin]

You can create your own report and make your own watchlist. 

If you are unsure on how to accomplish this there are many good demos and labs in the Intelligence Community Forums that will be able to help.

Paul

[RSAAdmin]

Hi im trying to create a correlation rule to monitor users (in a watch list). My thoughts where create correlated rule with cache variables of Username, SourceAddress, Destination Address. Get events from DC's for login, multi thread the login source address to any other connections or activity from that username and source etc. Can you confirm this is the correct approach or maybe a better way to go about it?