Security Compliance

Which user to log in for SEM console

This article provides additional assistance for log in

First published date

11/29/2018 10:57 PM

Last published date

11/29/2018 10:57 PM

Overview

This article applies to Security Event Manager (formerly Log & Event Manager).

This article provides additional assistance for log in. 

Product section

Security Event Manager

Resolution

Before choosing a user to log in, there are several things to take note of:

 

  • When the SEM is first deployed, the first (and only) user to log into the SEM is "admin", and during that first log in, you will be forced to change the password to a secure password of your choice. 
  • The "admin" user is the default user for the 'web-based' GUI-console login to SEM.
  • Like Windows you cannot delete this user, but unlike Windows you cannot rename this user.
  • Also like Windows, you can login using admin whenever you want. We advise logging in with a specific user (local user or AD user) so that activity is tracked to the user.  And if a mistake was made in Monitor (filters) to make your user login unusable, you can always login with "admin" to verify access.
  • Never allow two users to login with the same user at the same time, especially the "admin" account. When using the web-based access to the SEM console, the user profile is kept on the SEM itself. Either user can corrupt the filters, and the nDepth searches created by this user. It may be possible to cause other problems as well.

 

Refer to creating new users in the SEM console:

  • Always log into the SEM with either your created local user account, or the Active Directory (AD) account.
  • The AD account will need to be all lower case characters for the fully-qualified domain and include the user (for example, microsoft.com\bill.gates). The domain name must be lower-case.

 

Always create users with the lowest permissions possible:

  • If the user only needs to receive email notifications, set the user role to 'contact'.
  • If the user only needs to view filters and rules, set the user role to 'monitor'.
  • If the user only needs to create/change filters, and only view rules, set the user role to 'auditor'.
  • If the user only needs to run reports, set the user role to 'reports'.