SEM: Event viewing and export options

11/13/2018 7:36 PM

12/7/2021 2:52 AM

This article applies to Security Event Manager (formerly Log & Event Manager).

This article describes a variety of options for viewing and exporting events.

Security Event Manager

In the HTML5 WebUI: 

• The Dashboard (tab) > Widgets are a replacement for the old Ops Center > Widgets and are used for temporary/quick reviews for quick insights before doing research in the Historical Events tab. It is not recommended to use these Widgets for reporting purposes as they are very simple/limited.
• The  Events (tab) > Filters window can receive and display live event data for up to 100,000 events (the default is 25,000 events) at a time. These are used for seeing event information live and not necessarily for reporting purposes.
• The Historical Search (tab) is a database search feature that can return data historically from the database with some simple search parameters.
  • The Historical Search Details window can display up to 100,000 of the searched events in the WebUI interface, but is set to 25,000 by default in the Event Limits (Settings > Event Limits).
  • Using scheduled saved Historical Searches, you can export up to 100,000 events or (10 MB) to your email.  
  • Using the .csv export, you can export up to 100,000 events from the WebUI.

In the Legacy Flash/Adobe-Air Console:

• The Ops Center > Widgets are for temporary quick reviews, and are often used for quick insights before doing research. It is not recommended to use these for reporting as they are very simple/limited.
• The Monitor > Filters can receive and display live event data for up to 2000 events (the default is 1000 events) at a time. These are used for seeing event information live and not necessarily for reporting purposes.
• The Explore > nDepth search is a database search feature that can return data historically from the database with some simple search parameters.
  • The nDepth Result Details page can display up to 10,000 of the searched events in the Web Console interface.
  • Using scheduled saved nDepth searches, you can export up to 100,000 events or (10 MB) to your email.  
  • Using the .pdf export (top right gear icon), you can export up to 250,000 events.
  • Using the .csv export (middle right gear icon), you can export up to 500,000 events.
  • Related article: nDepth export to CSV/PDF limitation in SEM

 

In the Legacy Reports Console:

• Through the Reports Console (separate Windows Application), you can export up to 20,000,000 million events and schedule searches. However, it is Crystal Reports based and meant for auditing and compliance using templated reports.
• NOTE: If you install another version of Crystal Reports alongside an already installed SEM Reports Console, or try to install the SEM Reports Console on the same client machine, there will be a known issue that will occur related to the Business Objects that prevents our Reports Console from working properly. The only way to fix this issue is to completely remove any traces of the Business Objects and other Crystal Reports from the system. This issue is considered environmental and the SEM Technical Support Team is unable to modify or edit your client system(s) registry or any other components of your client system(s) to fix this issue. Please consider this issue before you install another version of Crystal Reports onto a system that you plan to work with for SEM reporting.