Firewall Policy Change Events on SSIM

Updated: 21 May 2010 | 2 comments

raul_b7

0 0 Votes

Hi,

Can we monitor events on Firewall Policy Change through SSIM? Any specific Rule Set for that?

Kind Regards
Raul

discussion Filed Under:

Comments

Nov

2009

0 Votes 0

olaf

Symantec Employee

Accredited

From what firewall products are you collecting events?
You will have to look at the Event Type ID.

For example run a event query like the below on and see what you find.
Product=<Your FW-Product> AND Event Type ID=Configuration Change Succeeded

Nov

2009

0 Votes 0

raul_b7

Hi Olaf,

Hope alls well :) Thanks for your reply. Can we get exactly what all changes are made from this query?

Kind Regards
Raul