User Monitoring

[itgfcsys]

We have some users that may be transitioning and would like to monitor or review activities on the SIEM, is there an easy way to do this, i.e. create a "user" as a data source or watch list for log activity or do I need to review ESM logs.

thanks

[dan2]

If you only watch several users, you may create a New View called User Monitor including what you want to watch such as Source IP and Destination IPs, Source and Destination Ports, Event distribution, Events - Not Reviewed etc. When you need to monitor the user's activities, simply open the view and type the user name in Source User Filters.