How to audit ESM users' activity in ESM console?

[msingh]

Hi Everyone,

I want to build a report or dashboard which shows ESM users (Analyst, Admin, Operator) who logon to ESM last time. Please suggest something so that we can record ESM users' logon activity for Auditing purpose.

Thanks

[msingh]

The main purpose of is to track down the ESM user i.e. when did someone logged in or logged out from ESM console. What was last activity in ESM by users existing under USER resource.

[brian.freedman@1]

I am assuming ESM 6.0c...

Page 629 of the ESM_ArcSightConsole_UserGuide_6.0c.pdf

[msingh]

We have 5.0 version console

[brian.freedman@1]

pg 636 then for your version.

[balahasan.v1 · Accepted solution]

Hi MS,

What Brain Suggested is for Extending Audit Event Logging and if u want to simply User Activities.Simply create a filter with OR Condition with these Device Event Class ID's, tat will do

[msingh]

That's awesome Bala .... this is what I was looking for...Thank you very much

[Ranjeet Singh]

Try some OOTB CP.

Regards

Ranjeet Singh