cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Highlighted
Level 8
Report Inappropriate Content
Message 1 of 10

SIEM UI timeout settings

Jump to solution

Does anyone know if there a way to set the SIEM UI to not timeout, so it can be displayed in a 24/7 SOC?

1 Solution

Accepted Solutions
Highlighted
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 2 of 10

Re: SIEM UI timeout settings

Jump to solution

Under ESM Proprities | Login Settings the option indicates that you can configure it to '0' to disable.

timeout.png

View solution in original post

9 Replies
Highlighted
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 2 of 10

Re: SIEM UI timeout settings

Jump to solution

Under ESM Proprities | Login Settings the option indicates that you can configure it to '0' to disable.

timeout.png

View solution in original post

Highlighted
Level 8
Report Inappropriate Content
Message 3 of 10

Re: SIEM UI timeout settings

Jump to solution

Thanks Andy777!!!  That did the trick.

(and, yes, I've smacked myself in the head for not finding this. Definite Duh moment!)

Highlighted
Level 9
Report Inappropriate Content
Message 4 of 10

Re: SIEM UI timeout settings

Jump to solution

The real question is can this setting be given to only 1 account. (ie: We want to apply the disabled lockout for a single, read-only account to have showing on our large SOC monitor)

Highlighted
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 5 of 10

Re: SIEM UI timeout settings

Jump to solution

Actually, yes. The Idle Timeout setting is system-wide but the View Refresh setting is per account. Under Options, on a per user basis, you can configure your view to automatically refresh every x minutes. For an actual analyst account, this would be incredibly annoying as it might refresh while you were in the middle of an investigation but for the SOCMON account, it's perfect to keep the view data refreshed and keep the account from timing out.

Highlighted
Level 9
Report Inappropriate Content
Message 6 of 10

Re: SIEM UI timeout settings

Jump to solution

I attempted to set the refresh rate in the options tab to 10 minutes (event tried lower than that) and the account still locks out?

Highlighted
Level 8
Report Inappropriate Content
Message 7 of 10

Re: SIEM UI timeout settings

Jump to solution

btkarp,  When you say "the account still locks out" do you mean it times out and requires a login (re-login) or is it actually locking the account?

I have our timeout (global) set to 0 - as Andy shows above - and the refresh for the SOC monitor user set to 5.  In over 2 weeks the only time I've had to re-login was this Monday after a patch weekend (because the server that controls the monitor was restarted).

SOC View Refresh SS.JPG

Highlighted
Level 9
Report Inappropriate Content
Message 8 of 10

Re: SIEM UI timeout settings

Jump to solution

I meant that the account still times out.

Since the Timeout setting is global, that means that every account that logs in will never timeout (unless there are updates or network issues). I am looking for a way to have only a single account never timeout. We have created a SOC Monitoring account with we would like to display on one our large displays. We would like for this account to never time out. This does not seem possible without making EVERY account never time out as well.

Andy advised trying to set the refresh rate on the individual account to see if that prevented the timeout, however, it did not.

This isn't a huge problem, it is more of a nice to have if possible.

Highlighted
Level 8
Report Inappropriate Content
Message 9 of 10

Re: SIEM UI timeout settings

Jump to solution

Ah, I thought that's what you meant, but wanted to be sure.

I've had the same results as you.  I had to resort to the global - no timeout.  I was not happy with it either, but for now that seems to be our only recourse.  Maybe a future release will have a fix.

Highlighted

Re: SIEM UI timeout settings

Jump to solution

Has anyone found a good solution for this one?

Having timeout periods different for specific accounts would be highly useful for accounts used for displaying dashboards.

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community