Security Compliance

Exclude specific account from a rule in SEM

This article details how to exclude a specific account from a rule so you are not receiving email alerts for that account.

First published date

10/9/2018 6:29 PM

Last published date

10/9/2018 6:29 PM

Overview

This article applies to Security Event Manager (formerly Log & Event Manager).

This article details how to exclude a specific account from a rule so you are not receiving email alerts for that account.

Product section

Security Event Manager

Resolution

  1. Log in to the SEM console
  2. On the SEM menu bar, navigate to Build > Rules.
  3. Find the rule you need to modify, click the gear icon in the left column, and then choose Edit.
  4. Expand Events on the left side, and then highlight the applicable Event Name used in the Correlations section.
  5. Drag the DestinationAccount field from the Fields section beneath Events to a new line under Correlations.
  6. Click the Equal sign to change it to Not Equal.
  7. Enter the account name you wish to exclude, and then surround it with asterisks (wildcards).
  8. Save the rule, and then click Activate Rules.

Here is an example of what this looks like using the Account Lockout rule:

Note that you may not necessarily be using the DestinationAccount field in every case. If you're not sure, find the event using nDepth and verify which field the account name is under.