Showing results for 
Search instead for 
Did you mean: 

Normalized ID lookup


How do I find where a Normalized ID number maps into the view you see from the policy editor?

IOW, I have a NID, say 405831680.  That ID is associated with an event "A user account was unlocked."  Knowing that, how do I find that NID in the policy window?

OK, I found the answer so I'll post this in case it helps anyone else. 

Once you have your event, in the deails pane, select the Description tab, there it will tell you. 



2 Replies
Level 7
Report Inappropriate Content
Message 2 of 3

Re: Normalized ID lookup

Can you post your answer? I would like to find out how I can find a NID for other events such as windows security events.

Re: Normalized ID lookup


you should use the field (Normalized ID) on the right side bar (Filters).