cancel
Showing results for 
Search instead for 
Did you mean: 

Normalized ID lookup

Howdy,

How do I find where a Normalized ID number maps into the view you see from the policy editor?

IOW, I have a NID, say 405831680.  That ID is associated with an event "A user account was unlocked."  Knowing that, how do I find that NID in the policy window?

OK, I found the answer so I'll post this in case it helps anyone else. 

Once you have your event, in the deails pane, select the Description tab, there it will tell you. 

Cheers,

Mike

2 Replies
ericd
Level 7
Report Inappropriate Content
Message 2 of 3

Re: Normalized ID lookup

Can you post your answer? I would like to find out how I can find a NID for other events such as windows security events.

Re: Normalized ID lookup

Hi,

you should use the field (Normalized ID) on the right side bar (Filters).

Rgds,