Just Published! Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

App Control: Where To Determine How Many Times a Rule Triggered?

App Control: Where To Determine How Many Times a Rule Triggered?

Environment

App Control Console: All Supported Versions

Question

Where can it be determined how many times a Custom Rule has been triggered, or see how often Custom Rules are being used?

Answer

  1. Login to the Console and navigate to Reports > Events.
  2. Set the Saved View to: (none).
  3. Click Show Columns to be sure Rule Name is included in the Selected Column list, and click Apply.
  4. If necessary, use Show Filters to limit the search to a specific Source (Computer).
  5. Set the Max Age accordingly (usually best to start with a limited selection such as 12 hours).
  6. Rules can now be sorted by the Rule Name value.

Additional Notes

  • Depending on the total number of Events, setting the Max Age to higher values could cause the query to time out and fail to return results.
  • Use the Group By or Subgroup By to further organize results to determine specific Computers that are generating the most Events, or what Events on Computers are triggering the most.

Related Content


Labels (1)
Tags (2)
Was this article helpful? Yes No
100% helpful (1/1)
Article Information
Author:
Creation Date:
‎09-09-2020
Views:
247
Contributors