AnsweredAssumed Answered

Customizing Reports

Question asked by Curtis Crouse on Apr 27, 2020
Latest reply on Apr 27, 2020 by Curtis Crouse

Like • Show 0 Likes0
Comment • 4

Hello,

Hopefully I am asking this question in the correct place. Using RSA Security Console. I am looking to make a custom report that shows user failed sign on, but I need it to exclude blank user names, SYSTEM, etc. Basically I only want failed logins for our actual non-admin users. I am guessing that "output columns" would be the place to config this, however none of the options will get the job done. Is there a way to add or edit output columns? If not, how can I go about doing this?

Thanks!

No one else has this question

Outcomes

4 Replies

Erica Chalfin Apr 27, 2020 2:29 PM
Mark Correct
Correct Answer
Curtis Crouse,

Welcome to RSA Link!

I've moved your question to the RSA SecurID Access space where it will be seen by the product's support engineers, other customers and partners. Please bookmark this page and use it when you have product-specific questions.

Alternatively, from the RSA Customer Support page, click on Ask A Question on the blue navigation bar and choose Ask A Product Related Question. From there, scroll to RSA SecurID Access and click Ask A Question. That way your question will appear in the correct space.

Regards,
Erica
Like • Show 0 Likes0
Actions
Mohamed Saber Apr 27, 2020 3:01 PM
Mark Correct
Correct Answer
Curtis Crouse,

In the Security Console, navigate to Reporting > Report > Add New. Then select the Authentication Activity Report and click Next.

In there, you can customize the following options to achieve what you want:
- Display Successful Actions: When Yes, shows successful actions. When No, does not show successful actions
  Display Failed Actions: When Yes, shows failed actions. When No, does not show failed actions
  Display Warned Actions: When Yes, shows failed actions. When No, does not show failed actions
- Authentication Method:
  Set this to SecurID_Native. That will only get events for users authenticating using a Token. Therefore, excluding SYSTEM and admins logging into Security Console using Password.
- Identity Source:
  If your normal non-admin users are Active Directory (or any other External Identity Source) users, you can select the Identity User to run the report against excluding your Internal Database users.
Give the report a name and save the changes. You can then run these report to see if it collects the info that you're looking for or not.
Like • Show 0 Likes0
Actions
Edward Davis Apr 27, 2020 3:30 PM
Mark Correct
Correct Answer
Hello,

The report templates are fixed, there is not a way to add or change the templates, only select what specific options are within any one template.. So, for reports, you typically need to run a report on a wider scope (include those blanks and system names) then if this output is cumbersome to manage in the Security Console... export as CSV and use a macro in Excel (just an example) to parse it down to your preferred targets.

Or, you can use SQL queries directly on the postgres database to mine information, however, there is not a way to use an existing report template here...so your query would need to be complete.
1 person found this helpful
Like • Show 0 Likes0
Actions
- Curtis Crouse @ Edward Davis on Apr 27, 2020 4:11 PM
  Mark Correct
  Correct Answer
  thank you
  Like • Show 0 Likes0
  Actions

Customizing Reports

Outcomes

Related Content

Recommended Content