Security Compliance
SEM Workstation Logon or Logon Failure Activity filter conditions
This article provides the default conditions used for the Workstation Logon/Logon Failure Activity filter under the Endpoint Monitoring section.
First published date
10/17/2018 1:48 PM
Last published date
5/28/2019 7:11 PM
Overview
This article applies to Security Event Manager (formerly Log & Event Manager).
This article provides the default conditions used for the Workstation Logon/Logon Failure Activity filder under the Endpoint Monitoring section.
This article provides the default conditions used for the Workstation Logon/Logon Failure Activity filder under the Endpoint Monitoring section.
Product section
Security Event Manager
Resolution
Name:
Conditions:
Workstation Logon/Logon Failure ActivityConditions:
(OR)1st group{
(AND)2nd group{
UserLogonFailure.LogonType != *blank*
UserLogonFailue.LogonType != Windows:Network
UserLogonFailure.InsertionIP = *ReplaceWithWorkstationConnectorProfileOrADGroup* }
(AND)3rd group{
UserLogon.LogonType != *blank*
UserLogon.LogonType != Windows:Network
UserLogon.InsertionIP = *ReplaceWithWorkstationConnectorProfileOrADGroup* }
}
See Default SEM filter conditions on the Web Console Monitor page for a full list of available default filters in SEM.