Security Violation Monitoring

To monitor security violations, use the Security Violation Monitoring section on the navigation panel.

NOTE. When roles of information security administrator and application administrator are separated, the Security Violation Monitoring section is available only for information security administrator.

As a result of the lack of access permissions, the current attempts to violate the system security are recorded: failed login attempts and actions on the objects.

NOTE. In the desktop application, security violations are registered only if the Security Violation Monitoring section is opened. When the security manager is closed, security violation records are not saved.

The following parameters are displayed for each security violation:

Workstation. Name of the workstation, from which the violation has been made.
OS user. Name of the user who tried to breach security.
Platform user. User name.
Object. Name of the repository object involved (the box is empty if violation occurred during login).
Identifier. Identifier of the repository object involved (the box is empty if violation occurred during login).
Operation. The operation that led to security violation.
Time. The time of security violation.
NOTE. It displays additional information regarding the violation.

The following can be additionally displayed in the web application:

Result. Operation execution result.
IP address. Workstation IP address.

To update records in the web application, select the time period from the Update button drop-down menu on the toolribbon:

Do not use.
Each 5 seconds
Each 30 seconds
Each minute
Each 5 minutes.
Specify period. Clicking the button opens the Autoupdate Period dialog box:

Set custom update period in seconds, minutes or hours.

After executing the operations, monitoring of security violations will be updated according to the specified time period.

To set up table display, filtering, and sorting:

In the desktop application:

Use table display setup.
Use table filtering and sorting.

In the web application:

Set sorting by clicking a column header.

To easily view all the information about the selected event, use the Event Information window.

To enable or disable window display:

In the desktop application:

Select or deselect the View > Event Information main menu checkbox.
Select or deselect the Event Information checkbox in the context menu of security violation monitoring.

In the web application:

Select or deselect the Event Information checkbox in the context menu of security violation monitoring.

After executing the operations the event information is enabled or disabled. By default, the window is located at the bottom of the security manager window.

To search for security violation records:

In the desktop application:

Use list display settings.

In the web application:

Click the Search button on the toolbar.
Set up search parameters in the Search dialog box.
Click the OK button.

After executing the operations the searched record is found, if search parameters match the found object.

To clear security violation monitoring:

In the desktop application:

Close the section.

In the web application:

Click the Clear button on toolbar.
Select the radio button to clear security violation monitoring in the Clear Access Protocol dialog box.