Hi,i'm using SEC 5.2.2 on Prem. and i have enabled auditing.Is it possiblee to find out which user have made last changes in the console? E. g. to moved computers from one to another group?RegardsDennis
Hello Dennis Haschke,
I haven't done it but according to the Auditing Guide this should be possible.
Thanks, actually i'm reading the guide :-)Seems not so easy :-(
where's the problem? What specifically is it that Seems not so easy?
I try the report like in the guide beginning on site 14, chapter 7.2 due to 7.4. This works fine. But i don't know what i must do to search for all group changes till last 3 month. The query i don't know.
guess by group changes you mean a computer that was moved to some other group? For a start, similar to Example 3 in chapter 8.2. (page 16),, keep just the Timestamp>=... and (TargetType='Computer') AND (Action='Assign') parts.
OK, I try this query:SELECT *FROM SophosSecurity.Reports.vAuditEventsAllWHERE (Timestamp>=DATEADD(mm,-3,GETUTCDATE()))AND ((TargetType='Computer')) AND(Action='Assign')
Seems to work :-)Thanks a lot.
I think that a person who is satisfied with his income can be found only among very wealthy people. Others, in any case, will always talk about the fact that they lack something. In any case, you can always sit down at the computer and make money. Here https://2captcha.com/ as an option offer work with captcha (recognition) from you need only a few hours a day, but earnings are not limited can even if the day sit.