RSA Admin

File access alert based on file name.

Discussion created by RSA Admin Employee on Mar 12, 2008
Latest reply on Jul 4, 2012 by RSA Admin

I'm trying to configure an alert for file access to a specific file by anyone other than a specific user.  I'm using Security_560_Security as the message to alert on.  I'm having trouble determining what variable to use for the file name.  The way it is listed in the message is "Object Name: <misc_name>."  However, when I use Miscellaneous Name as the variable, and the file location as the value, I don't get any results.   None of the other variables seem to be right. 

 

Example:

 

where misc_name in ('\XXX\XXXX\XXXX\xxx.txt') and Client User Name not in ('username')

 

thanks for your help.

Outcomes