How do you creat an ESM data source inactivity report?

[michael.yin]

I'm running ESM v9.4.2 and I have many devices with the Yellow flag due to inactivity. I'd like to generate a report that includes all the devices that haven't sent logs for x amount of time (maybe a weekly report of the previous week, or a daily report of devices that haven't sent logs in > 7 days). I've looked around for a while, read the user guide, and searched the web for help but haven't found anything. Can someone provide instructions for creating such a report?

[exbrit]

Moved this to Security Information and Event Management (SIEM) for better support.

---

Peter

Moderator

[michael.yin]

Thanks Peter. I don't seem to have the ability to choose any of the Enterprise "places" so I couldn't put it there.

[exbrit]

This community software can be a little picky at times, often when you think you are logged in, in actual fact you aren't.  That's probably what happened.

[michael.yin]

What else should I do to try to get an answer? Is this a really hard report to create, or is it so basic that it doesn't dignify a response?

[ksudki]

Hey michael,

I don't know if you have the same option as I in 9.5, but basically you can export a list from the Receiver Properties > Receiver Management > Time Delta.

Regards

[michael.yin]

, I looked for that option but I wasn't able to find it. I've attached snapshot of what options I have when I go to Receiver Properties > Receiver Management

[ksudki]

Found somewhere else where sou can find this information

ESM Properties > System Information > "Device Summary Reports : " View Reports (button at the bottom) and then sort by "Last Event Time"

[michael.yin]

What version of ESM was that? I'm running 9.4.2 and I don't show that option. Mine is a combo box, so ESM and ELM is combined. Is there some feature/function option I need to enable before I can see that Device Summary Reports? Thanks for your help

[robert_dearbyte · Accepted solution]

Hi,

This option is available in 9.4.2 but only when you login as NGCP. There is no option to give other users the rights tro access this feature. I believe the same applies to 9.5.x.