USM Anywhere provides a centralized view of your system eventsAny traffic or data exchange detected by AT&T Cybersecurity products through a sensor or external devices such as a firewall.. Go to Settings > System Events to see this centralized view.
The system events page displays information on any events generated within your environment. On the left you can find the search and filters options. In the upper-left side of the page, you can see any filters you have applied, and you have the option to create and select different views of the system events. The main part of the page is the actual list of system events. Each row describes an individual system event. The following table lists the default columns for system events.
Note: System events older than 30 days are cleared from hot storage on a regular basis.
|Event Name||Name of the event.|
|Time Created||Date and time of the creation of the event. The displayed date depends on your computer's time zone.|
Name of the USM Anywhere SensorSensors are deployed into an on-premises, cloud, or multi-cloud environment to collect logs and other security-related data. This data is normalized and then securely forwarded to USM Anywhere for analysis and correlation. detecting the event. The type of sensor is also displayed below the sensor name.
|Source User Email||Email of the user that performed the action. For example, when user firstname.lastname@example.org logs in, the source email is email@example.com.|
|Destination User Email||Email of the user that the action is being performed on. For example, if user firstname.lastname@example.org modifies or creates user email@example.com, then the destination email is firstname.lastname@example.org.|
|Event Outcome||Indicates if the action was successful and completed or if it failed.|
Brief description of what was changed in the system event.
It only gets populated for certain actions and indicates what is being changed. Most of these are user changes (for example, when a user is suspended, locked status is reset, multifactor authentication (MFA) is enabled or disabled, or password updated).
|Source AssetAn IP-addressable host, including but not limited to network devices, virtual servers, and physical servers.||
HostnameA hostname is a label that is assigned to a device connected to a computer network and is used to identify the device on the network. or IP address of the hostReference to a computer on a network. (with the national flag if the country is known) that initiates the event.
Important: If you want to create a rule, instead of using this field, use the Source Name or Source Asset ID fields.
|Identity Source Address||IP address of the event or computer that it takes place on.|
If you want to analyze the data, you can maximize the screen and hide the filter pane. Click the icon to hide the filter pane. Click the icon to expand the filter pane.
Click Generate Report to open the Configure Report dialog box. See Create and Schedule Reports for more details.
Click the icon to bookmark an item for quick access.
You can choose the number of items to display by selecting 20, 50, or 100 below the table.
Within the page, you can configure the columns and fields that display in the List view. You can also save your columns configuration to return to it whenever you need it.
To configure your columns
system eventlist view, click the icon.
Configurationdialog box opens.
Search the columns you want to have in the list view. You can enter your search in the search field.
Use the and icons to pass the items from one column to the other and select the columns you want to see.
You can order the columns by clicking one of them and dragging the column to the desired place.
- Click Apply.
Note: If you generate a report when you have set custom columns, your report keeps the columns you have configured.
Important: If you want to keep your configuration, you need to save it by selecting Save View > Save as. Otherwise, your custom view is not kept when you move to another feature. See Views for more information.
USM Anywhere enables you to define and save a custom
You can configure the view you want for the list of items in the page.
To create a view configuration
- From the List view,
select the filters you want to apply.
- If you want to delimit the search, select the filters you want to apply.
Select Save View > Save as.
The Save Current View dialog box opens.
- Enter a name for the view.
- Select Share View if you want to share your view with other users.
- Click Save.
The created view is already selected.
To select a configured view
- From the List view, click View above the filters.
Click Saved views and select the view you want to see.
- Click Apply.
Note: A shared view includes the icon next to its name.
To delete a configured view
- From the
System Eventslist view, click View above the filters.
- Click Saved views and click the icon next to the saved view you want to delete.
- Click Accept.
A dialog box opens to confirm the deletion.
Note: You can delete the views you have created.
Important: The icon does not display if the view is selected.