Quantcast
Channel: THWACK: Popular Discussions - Security Event Manager (SEM) - Formerly Log & Event Manager
Viewing all articles
Browse latest Browse all 5911

Filtering out Computer Account Activity

$
0
0

I'm attempting to set up both a saved search (nDepth) and filter (Monitor) excluding computer accounts (ending in $ sign). However....

  • In nDepth, when I add a Group with the following condition...     UserModifyAttribute.SourceAccount ≠ *$     ...I still get computer accounts showing up in the results.
    I have tried putting that in quotes... "*$"   ...but that just added escape characters in the top Search Bar:   (SourceAccount = "\"*$\"") ...and still got the same results.
    NOTE: There is a red line under part of the search text when in Text Input Mode, but there's no way of knowing what - if anything - is wrong with the syntax.
  • In Monitor, same results as above. ...I was wondering if there is any regex permitted in the Search Builder fields, and is it seeing the dollar sign as a special character instead of the string itself?

 

Thanks for any thoughts.


Viewing all articles
Browse latest Browse all 5911

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>