This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

SEC Auditing

Hi,
i'm using SEC 5.2.2 on Prem. and i have enabled auditing.
Is it possiblee to find out which user have made last changes in the console? E. g. to moved computers from one to another group?

Regards
Dennis



This thread was automatically locked due to age.
Parents Reply Children
  • Hello Dennis Haschke,

    guess by group changes you mean a computer that was moved to some other group?
    For a start, similar to Example 3 in chapter 8.2. (page 16),, keep just the Timestamp>=...  and  (TargetType='Computer') AND (Action='Assign') parts.

    Christian

  • OK, I try this query:

    SELECT *
    FROM SophosSecurity.Reports.vAuditEventsAll
    WHERE (Timestamp>=DATEADD(mm,-3,GETUTCDATE()))
    AND ((TargetType='Computer')) AND
    (Action='Assign')

    Seems to work :-)
    Thanks a lot.

  • I think that a person who is satisfied with his income can be found only among very wealthy people. Others, in any case, will always talk about the fact that they lack something. In any case, you can always sit down at the computer and make money. Here https://2captcha.com/ as an option offer work with captcha (recognition) from you need only a few hours a day, but earnings are not limited can even if the day sit.