cancel
Showing results for 
Search instead for 
Did you mean: 
cly
Level 7

SIEM UI timeout settings

Jump to solution

Does anyone know if there a way to set the SIEM UI to not timeout, so it can be displayed in a 24/7 SOC?

0 Kudos
1 Solution

Accepted Solutions
McAfee Employee

Re: SIEM UI timeout settings

Jump to solution

Under ESM Proprities | Login Settings the option indicates that you can configure it to '0' to disable.

timeout.png

9 Replies
McAfee Employee

Re: SIEM UI timeout settings

Jump to solution

Under ESM Proprities | Login Settings the option indicates that you can configure it to '0' to disable.

timeout.png

cly
Level 7

Re: SIEM UI timeout settings

Jump to solution

Thanks Andy777!!!  That did the trick.

(and, yes, I've smacked myself in the head for not finding this. Definite Duh moment!)

0 Kudos
btkarp
Level 9

Re: SIEM UI timeout settings

Jump to solution

The real question is can this setting be given to only 1 account. (ie: We want to apply the disabled lockout for a single, read-only account to have showing on our large SOC monitor)

0 Kudos
McAfee Employee

Re: SIEM UI timeout settings

Jump to solution

Actually, yes. The Idle Timeout setting is system-wide but the View Refresh setting is per account. Under Options, on a per user basis, you can configure your view to automatically refresh every x minutes. For an actual analyst account, this would be incredibly annoying as it might refresh while you were in the middle of an investigation but for the SOCMON account, it's perfect to keep the view data refreshed and keep the account from timing out.

0 Kudos
btkarp
Level 9

Re: SIEM UI timeout settings

Jump to solution

I attempted to set the refresh rate in the options tab to 10 minutes (event tried lower than that) and the account still locks out?

0 Kudos
cly
Level 7

Re: SIEM UI timeout settings

Jump to solution

btkarp,  When you say "the account still locks out" do you mean it times out and requires a login (re-login) or is it actually locking the account?

I have our timeout (global) set to 0 - as Andy shows above - and the refresh for the SOC monitor user set to 5.  In over 2 weeks the only time I've had to re-login was this Monday after a patch weekend (because the server that controls the monitor was restarted).

SOC View Refresh SS.JPG

0 Kudos
btkarp
Level 9

Re: SIEM UI timeout settings

Jump to solution

I meant that the account still times out.

Since the Timeout setting is global, that means that every account that logs in will never timeout (unless there are updates or network issues). I am looking for a way to have only a single account never timeout. We have created a SOC Monitoring account with we would like to display on one our large displays. We would like for this account to never time out. This does not seem possible without making EVERY account never time out as well.

Andy advised trying to set the refresh rate on the individual account to see if that prevented the timeout, however, it did not.

This isn't a huge problem, it is more of a nice to have if possible.

0 Kudos
cly
Level 7

Re: SIEM UI timeout settings

Jump to solution

Ah, I thought that's what you meant, but wanted to be sure.

I've had the same results as you.  I had to resort to the global - no timeout.  I was not happy with it either, but for now that seems to be our only recourse.  Maybe a future release will have a fix.

0 Kudos
zachhowell
Level 7

Re: SIEM UI timeout settings

Jump to solution

Has anyone found a good solution for this one?

Having timeout periods different for specific accounts would be highly useful for accounts used for displaying dashboards.

0 Kudos