RSA Admin

Help required on two reports

Discussion created by RSA Admin Employee on Dec 9, 2011
Latest reply on Dec 12, 2011 by scarielli
Hi Guys, Can anyone help/guide me in creating the below two reports which are required for regular monitoring pusposes in our SOC. have struggled a log but could not achieve it as well. Even the alerts would be helpful. a) Simultaneous Logons – Same IDs logged on from multiple IP's. b) For the "U" failed logons multiple times (T) , successful logon attempts by the same users as well on the server "Y". (U= user) (T= number of time failed login detected) , (Y = hostname/servername) Thanks in advance Shakti P. Sharma

Outcomes