Data Loss Prevention

 View Only
  • 1.  User Login Report

    Posted Jan 21, 2013 04:37 AM

    Hi Guys ,

    Need help with retreiving report of "User Login" in Enforce .. I need to know which user logged in, at what time and when did he sign out ? ..

    Can I get that type of report to send to a Manager ? ..

    Need some quick response..

    Thanks !



  • 2.  RE: User Login Report

    Posted Jan 21, 2013 05:03 AM

    HI,

    Check this artical may be help

     

    Auditing/Monitoring of User Activity in DLP

    https://www-secure.symantec.com/connect/articles/auditingmonitoring-user-activity-dlp



  • 3.  RE: User Login Report

    Posted Jan 21, 2013 06:56 AM

    Hi Ashish ,

    I do not have the option AUDITLOG on my Enforce Console. What do i do abt that ?

    Is there no way preloaded in DLP we can monitor User Activity ? ..

     



  • 4.  RE: User Login Report

    Broadcom Employee
    Posted Jan 22, 2013 04:53 AM

    You need to log into the Oracle DB and connect to protect to find out the AUDITLOG table.



  • 5.  RE: User Login Report

    Posted Jan 22, 2013 05:40 AM

    Hi,

    You can connect to DLP Oracle database and run the following query:

    ******************************************

    select p.USERID,p.Name,u.AssumedRoleName,u.IPADDRESS,u.LOGONTIME,u.LOGOFFTIME

    from PROTECTUSER p, USERSESSION u
    where p.USERID = u.USERID
     
    ******************************************
     
    The result will be some like this:
    USERID,NAME,ASSUMEDROLENAME,IPADDRESS,LOGONTIME,LOGOFFTIME
    41,"dlp-user","dlp-remediator","172.16.30.12","2012-11-09 14:23:46","2012-11-09 14:23:46"
    1,"Administrator",(null),"172.16.30.2","2012-11-23 07:47:31","2012-11-23 07:49:18"
     
    You can use the Auditlog as yang_zhang said but the Auditlog don't have the logoff information.
     
    Hope this help...
     
    Eduardo Barcelos

     

     



  • 6.  RE: User Login Report

    Posted Jan 23, 2013 02:55 AM

    @ Eduardo .. I dont think this way would be aprreciated by a Manager who would like a well organised report of User Acivity. Anyother way apart from this ?? ..



  • 7.  RE: User Login Report

    Posted Jan 27, 2013 03:34 AM
    Is there any way, where I can see a systematic report of User Actions .. What all actions have been done by a particular User on the Enforce or Endpoint ? .. I would like a quick response .. Thanks ..


  • 8.  RE: User Login Report

    Posted Jan 27, 2013 04:24 AM
    The Auditlog table has to be accessed from Oracle and what are the commands should i enter to access a User's details like : Login Dates and Time User Activity on Enforce Log Out Time What changes has the user made on the system . Please advise .. its a bit Urgent ! ..


  • 9.  RE: User Login Report

    Broadcom Employee
    Posted Jan 27, 2013 04:52 AM
    open a support ticket, they might help with the script.


  • 10.  RE: User Login Report

    Posted Jan 27, 2013 04:57 AM
    @ pete ..If at all the script is ready, the Administrator has to go to Oracle to view the reports or he can see dem on Enforce ? .. And can it be customized in such a way where the Admin can select a particular user and see all activites on the Enforce only ??


  • 11.  RE: User Login Report

    Broadcom Employee
    Posted Jan 27, 2013 05:04 AM
    The SQL script help you to know the audit information.