Security Compliance

How to create a filter to display FIM data in SEM

This article describes how to build a filter to display data collected by FIM.FileRead.DetectionIP, FileRead.ToolAlias, and FileRead.FileName.

First published date

10/9/2018 8:04 PM

Last published date

10/9/2018 8:04 PM

Overview

This article applies to Security Event Manager (formerly Log & Event Manager).
This article describes how to build a filter to display data collected by FIM events.

Product section

Security Event Manager

Resolution

  1. In the SEM Console, go to Monitor.
  2. Click the + icon in the upper left of the screen to add a new filter.
  3. In the Filter Configuration window, add a filter name, and then drag the appropriate filters to the Condition pane.
    • For example, to filter for read events from a FIM connector for one particular file on one particular server, use:
      • FileRead.DetectionIP =<IPAddressofMonitoredHost>
      • FileRead.ToolAlias=<ConnectorName>
      • FileRead.FileName=<FullPathofFile>
    • For example:
      • FileRead.DetectionIP =10.10.4.125
      • FileRead.ToolAlias=FIM File and Directory
      • FileRead.FileName=G:\SolarWinds\Area51\RestrictedFile.txt

Note: When working with filters, an iterative approach, building a general filter, and then narrowing down the filter based on the events filter, can be the best way to narrow down to very specific events.