AlienVault USM Anywhere provides a centralized view of your system eventsAny traffic or data exchange detected by AlienVault products through a Sensor, or through external devices such as a firewall.. Navigate to SETTINGS > SYSTEM EVENTS.
The system events page displays information on any events generated within your environment. On the left you can find the search and filters options. Across the top, you can see any filters you have applied, and you have the option to create and select different views of the system events. The main part of the page is the actual list of system events. Each row describes an individual system event.
If you want to analyze the data, you can maximize the screen and hide the filter panel. Click the Expanded Filter Panel icon () to hide the filter panel. Click the Collapsed Filter Panel icon () to expand the filter panel.
Note: By default, the list will display all System Events created during the last 24 hours.
|Column Field Name||Description|
|Event Name||Name of the event|
|Time Created||The date and time of the creation of the event. The displayed date depends on your computer's time zone|
|Source User Email||Email of the user that performed the action. For example, when user [email protected] logs in, the source email is [email protected]|
|Destination User Email||Email of the user that the action is being performed on. For example, if user [email protected] modifies or creates user [email protected], then the destination email is [email protected]|
|Event Outcome||Indicates if the action was success and completed or if it failed|
It is a small description of what was changed in the system event.
It only gets populated for certain actions and indicates what is being changed. Most of these are user changes. For example, when a user is suspended, locked status is reset, MFAA method of access control in which a user is granted access only after successfully presenting several separate pieces of evidence to an authentication mechanism – typically at least two of the following categories: knowledge, possession, and inherence. is enabled/disabled, password updated, etc.
|identity Source Address||IP address of the event or computer that it takes place on|
Click the star symbol to the left of an item to mark it as a bookmark for quick access. Clicking the Star icon () on the secondary menu shows the bookmarked items and a link to them.
You can also sort items by selecting 20, 50, or 100 below the result table.
USM Anywhere allows you to define and save a custom
To create a view configuration
- Navigate to SETTINGS > SYSTEM EVENTS.
- If you want to delimit the search, select the filters you want to apply.
- Click the pull-down menu Save View > Save as.
- Type a name for the view and click Save.
To select a configured view
- From the
System Eventslist view, click the View pull-down menu above the filters.
- Click Saved views and select the view you want to see.
- Click Apply.