Using watchlists in Advanced trave views

[PatrickChouinar]

Does anyone knows how to use watchlists in advanced charts or advanced tables ? They are very easy to use in standard trace views, but I can't find any reference in the documentation on how to use them in advanced trace views. Any help would be appreciated. Thanks

[AlejandroNegron]

Hi PatrickChouinard,

Inside the enVision online help there is a topic called "Advanced Table Trace View (RSA enVision Event Explorer)" take a look to that topic to see if that is what you are looking for.

I hope this helps.

[RSAAdmin]

Here is the format for using the watchlists in the traces

DEVICETYPENAME IN ('Windows Events (NIC)')

AND EVENTCATEGORYNAME LIKE 'User.Management.Groups.%' AND  IN_Watchlist  ("GROUP",'Windows High Profile Groups')