9 Replies Latest reply on Mar 2, 2017 3:47 PM by zachhowell

    SIEM UI timeout settings

    cly

      Does anyone know if there a way to set the SIEM UI to not timeout, so it can be displayed in a 24/7 SOC?

        • 1. Re: SIEM UI timeout settings
          andy777

          Under ESM Proprities | Login Settings the option indicates that you can configure it to '0' to disable.

          timeout.png

          • 2. Re: SIEM UI timeout settings
            cly

            Thanks Andy777!!!  That did the trick.

            (and, yes, I've smacked myself in the head for not finding this. Definite Duh moment!)

            • 3. Re: SIEM UI timeout settings
              btkarp

              The real question is can this setting be given to only 1 account. (ie: We want to apply the disabled lockout for a single, read-only account to have showing on our large SOC monitor)

              • 4. Re: SIEM UI timeout settings
                andy777

                Actually, yes. The Idle Timeout setting is system-wide but the View Refresh setting is per account. Under Options, on a per user basis, you can configure your view to automatically refresh every x minutes. For an actual analyst account, this would be incredibly annoying as it might refresh while you were in the middle of an investigation but for the SOCMON account, it's perfect to keep the view data refreshed and keep the account from timing out.

                • 5. Re: SIEM UI timeout settings
                  btkarp

                  andy777 I attempted to set the refresh rate in the options tab to 10 minutes (event tried lower than that) and the account still locks out?

                  • 6. Re: SIEM UI timeout settings
                    cly

                    btkarp,  When you say "the account still locks out" do you mean it times out and requires a login (re-login) or is it actually locking the account?

                     

                    I have our timeout (global) set to 0 - as Andy shows above - and the refresh for the SOC monitor user set to 5.  In over 2 weeks the only time I've had to re-login was this Monday after a patch weekend (because the server that controls the monitor was restarted).

                    SOC View Refresh SS.JPG

                    • 7. Re: SIEM UI timeout settings
                      btkarp

                      cly I meant that the account still times out.

                       

                      Since the Timeout setting is global, that means that every account that logs in will never timeout (unless there are updates or network issues). I am looking for a way to have only a single account never timeout. We have created a SOC Monitoring account with we would like to display on one our large displays. We would like for this account to never time out. This does not seem possible without making EVERY account never time out as well.

                       

                      Andy advised trying to set the refresh rate on the individual account to see if that prevented the timeout, however, it did not.

                       

                      This isn't a huge problem, it is more of a nice to have if possible.

                      • 8. Re: SIEM UI timeout settings
                        cly

                        Ah, I thought that's what you meant, but wanted to be sure.

                        I've had the same results as you.  I had to resort to the global - no timeout.  I was not happy with it either, but for now that seems to be our only recourse.  Maybe a future release will have a fix.

                        • 9. Re: SIEM UI timeout settings
                          zachhowell

                          Has anyone found a good solution for this one?

                          Having timeout periods different for specific accounts would be highly useful for accounts used for displaying dashboards.