SECMON-Filter events from Eventviewer and still report on them

[mkirbyii]

Does anyone know of a way to tell SECMON to not show an event in the Event viewer but still have it in the DB to report on? Example would be IIS Unicode sig, this fires all the time on our sensors, we have Deny actions setup and do not need to see the events in EventViewer. I would like to run a report at the end of the month to see all the activity though.

Anybody know if this can be done?

Thanks

M

[mkirbyii]

Anyone?

[wong34539]

Try the "Alarm channel Event Filter" option available on the sensor. This will help you to filter out unwanted alarms going to the Event Viewer.

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/csids/csids10/idmiev/swchap3.htm#wp31156

You can use "Filters" in the Event Viewer to customize your views, but can get the complete list of events by specifying the "Data Source".