Firewall Policy Change Events on SSIM
raul_b7
November 8th, 2009
Hi,
Can we monitor events on Firewall Policy Change through SSIM? Any specific Rule Set for that?
Kind Regards
Raul
Filed under: Security Information Manager, Security
From what firewall products
From what firewall products are you collecting events?
You will have to look at the Event Type ID.
For example run a event query like the below on and see what you find.
Product=<Your FW-Product> AND Event Type ID=Configuration Change Succeeded
Hi Olaf, Hope alls well
Hi Olaf,
Hope alls well :) Thanks for your reply. Can we get exactly what all changes are made from this query?
Kind Regards
Raul
Would you like to reply?
Login or Register to post your comment.