Monitor Top Secret SCA administrators making changes to themselves

Products

• Compliance Event Manager

Issue/Introduction

Can Compliane Event Manager track Top Secret SCA type admins making changes to their own ACID?

 

Resolution

Monitoring SCA type Top Secret admin ACIDs updating themselves is currently not a feature of Compliance Event Manager, but is on the Product Roadmap for future enhancement. 

This type of monitoring can be done using GROUP LISTS, but it will potentially capture more events including the self-administration events. 

Example:

1. Create a group list of all of your SCA User ID's
2. Use that group list in two test conditions
   • First, that the userid is in that list
   • And second, that the userid being the account user id is also in that group list.  
   • This will capture all events like this, even when one SCA is updating another ID that is not their own.

Capturing excessive events using reporting, allows filtering on "User ID" and "Account User ID"

This is a stop gap measure until the enhancement is in place.