Event Log Alerts - Email Only??
Hi
I wonder if you can assist?
Currently configured is a number of Event Log rules that will capture security events such as account lockouts, accounts deleted etc. Each time these are spotted on a server they appear as an alarm in the alarms page, as well as email an address due to a configured notification profile.
What i would like to be able to do is to continue to spot these events, for this to then trigger an email alert but not show up under the alarms section.
We have suffered with conficker virus and we need to trace which accounts are being locked out proactively going forward, but due to the number of alerts generated it clutters the alarm page and the dashboard views and the only way to fix this is to manually clear, but every day we get around 40 alerts, so its a losing battle. So ideally i want to make the alert email only and hidden on the alarms page.
Is this possible to do, or can it be made possible?
I wonder if you can assist?
Currently configured is a number of Event Log rules that will capture security events such as account lockouts, accounts deleted etc. Each time these are spotted on a server they appear as an alarm in the alarms page, as well as email an address due to a configured notification profile.
What i would like to be able to do is to continue to spot these events, for this to then trigger an email alert but not show up under the alarms section.
We have suffered with conficker virus and we need to trace which accounts are being locked out proactively going forward, but due to the number of alerts generated it clutters the alarm page and the dashboard views and the only way to fix this is to manually clear, but every day we get around 40 alerts, so its a losing battle. So ideally i want to make the alert email only and hidden on the alarms page.
Is this possible to do, or can it be made possible?