Security Compliance
Create a custom report to show only interactive user logon events in SEM
This article describes how to create a custom Authentication - User Log On or Authentication - User Log On by User report that filters out everything but actual interactive logon events (physical logons).
First published date
10/9/2018 2:45 AM
Last published date
10/9/2018 2:45 AM
Overview
This article applies to Security Event Manager (formerly Log & Event Manager).
This article describes how to create a custom Authentication - User Log On or Authentication - User Log On by User report that filters out everything but actual interactive logon events (physical logons).
This article describes how to create a custom Authentication - User Log On or Authentication - User Log On by User report that filters out everything but actual interactive logon events (physical logons).
Product section
Security Event Manager
Resolution
- Open your Reports Console and run an Authentication - User Log On or Authentication - User Log On by User report for the last 24 hours.
- Click on the Select Expert button and click New.
- Select the last field, USERLOGON_1.LOGONTYPE, and click OK.
- Change the drop down box to is equal to and change the second drop down box to Windows: Interactive and click OK. This will filter the report to show only interactive logon events.
- Click the Export button and change the Format to Crystal Reports (RPT). Save it to the CustomReports folder under your SolarWinds Log and Event Manager Reports installation folder.
- You can now press F5 to refresh your reports list and see your saved report by going to the Settings tab and changing the Category to Custom Reports.