RSA Admin

What reports are on your Dashboard?

Discussion created by RSA Admin Employee on Jan 20, 2009
Latest reply on Mar 15, 2011 by albert28

Besides the default reports, I have one custom report I've created.  It is called the "Alerts - Failed Windows Logons". 

 

Table:  Windows Accounting

Fields:  Count(MessageID), MessageID, UserName

 

Sort Order:  count(MessageID)  (Descending)

 

SQL where clause:  EventLog = 'Security' AND Reason NOT IN ('An unexpected error occurred during  logon') AND (MessageID IN ('Security_675_Security') OR MessageID IN ('Security_672_Security') OR MessageID IN ('Security_676_Security'))

 

==============================================

 

Please post your custom reports with specifics. 

Outcomes