1 reply to this topic

[brodonium]

The filtering for the Multiple Failed Logons alert doesn't allow you to filter on the Workstation field. We have a situation where a user is logged on, their password expires or they get locked out somewhere, and the session they have open on a desktop will bang away at our Internet proxy and trigger the Mulitple Failed Logons alert. I have tried to add a filter to ignore the proxy which appears in the Wokstation field but there just isn't a way. The Everywhere filter only allows the Operator to be "Contains" and if Netwrix would just "Does not contain" my problem would be solved. As it stands, if i have that alert enabled I get flooded with alerts and it's just noise.

[jeffb]

Hello Brodonium,

 

You can type into these fields whatever you want to filter by as seen here:

http://prntscr.com/jafj8f

 

Does that work for you?

 

-Jeff