A CEM rule stating account=STC is firing when changes are made to NDT.
book
Article ID: 131868
calendar_today
Updated On:
Products
Compliance Event Manager
Issue/Introduction
A rule to capture administration changes to account=STC is firing when changes are made to NDT, and it should not.
Environment
CEM 6.0 plus available maint. Also TSS ptf SO06888
Cause
'Account' is not valid for the Other Administration events. Instead, Infostorage Key equals STC should be
specified when defining the policy.
Resolution
Modifying the policy from 'Condition = ACCOUNT="STC" ' to Condition = KEY=*"STC" proved corrective.
Feedback
thumb_up
Yes
thumb_down
No