Security Monitoring

To monitor security violations, use the Security Monitoring section on the navigation panel:

NOTE. When roles of the information security administrator and the application administrator are separated, the Security Monitoring section is available only for the information security administrator.

As a result of the lack of access permissions, the current attempts to violate the system security are logged: failed login attempts and actions with objects.

The following parameters are displayed for each security violation:

Workstation. Name of the workstation, from which the violation has been made.
OS user. Name of the user who tried to breach security.
Platform user. User name.
Object. Name of the repository object involved (the box is empty if violation occurred during login).
Identifier. Identifier of the repository object involved (the box is empty if violation occurred during login).
Operation. The operation that led to security violation.
Time. The time of security violation.
NOTE. It displays additional information regarding the violation.

The following can be additionally displayed:

Result. Operation execution result.
IP address. Workstation IP address.

To refresh records, select the time period in the drop-down menu of the Refresh button on the toolbar:

Do not use.
Each 5 seconds.
Each 30 seconds.
Each minute.
Each 5 minutes.
Set period. Clicking the button opens the Autorefresh Period dialog box:

Set custom refresh period in seconds, minutes or hours.

After executing the operations, security violation monitoring will be refreshed according to the set time period.

To set up table displaying, filtering and sorting, set sorting by clicking the column header.

To view all the information about the selected event, use the Event Information popup panel.

To show or hide the panel, select or deselect the Event Information checkbox in the context menu of security violation monitoring.

After executing the operations the event information is shown or hidden. By default, the popup panel is located at the bottom of the security manager window.

To search for security violation records:

Click the Search button on the toolbar.
Set up search options in the Search dialog box.
Click the OK button.

After executing the operations the searched record is found, if search parameters match the found object.

To clear security violation monitoring, close the security manager.

After executing the operation, security violation monitoring will be cleared.

To export the lust of security violations:

Click the Export button on the toolbar. After executing the operation, the list of security violations is exported to a CSV (*.csv) file.
Select the file format in the drop-down menu of the Export button:

Export to CSV.
Export to CEF.

After executing the operation, the list of security violations is exported to a file of the selected format: *.csv, *.cef.

For details see the List Export section.