How to find which user deleted the entries in the Active list in ESM
there is a scenario where entries in Active list erased. I would like to know who/how entries were deleted in Active List in ESM
Can some one help me on this is there a way to find the details about how or who has erased the Active list entries.
Thanks in advance!!
Look for the following events:
Device Event Class ID: activelist:102
Name: ActiveList entry deleted
This are internal events generated by the Manager Internal Agent and they are triggered when an active list entry is deleted.
Namely, in those events you will find additional information such as:
File Name: <name of your active list>
File Path: <path to your active list>
Target User Name and Target User ID: <information about the user who deleted the entry, if it was a user that did it>
Otherwise check the events and see what other pieces of information are valuable to your scenario.
All the best,