eSCOP Event Filter Manager

The eSCOP Event Filter Manager provides the ability to limit the collection of events.

 The eSCOP Filter Manager has an easy point and click interface. The administrator needs to simply select the event or parameter and add to it the restricted list.

• Event Identification – Individual events may be selected and added to list of filtered-out items
• Category – Major parameter category filtering is provided based upon the following:
  • System Event
  • Logon/Logoff
  • Object Access
  • Privilege Use
  • Detailed Tracking
  • Policy Change
  • Account Management
  • Directory Service Access
  • Account Logon
• Agent Machine – Filtering is provided based upon agent status criteria
• Source – Filtering is provided based upon the source
• ACS Source – Filtering is provided based upon the specific ACS sources:
  • Microsoft Windows Security Auditing
  • Security
  • Others
• Header User – Filtering is provided based upon the header user criteria:
  • Computer
  • System
  • Administrator
  • Local Service
  • Network Service
  • Anonymous Logon
  • Owner
  • Other
  • Not Applicable
• Header Sid – Filtering is provided based upon the header system identification
• Header Domain – Filtering is provided based upon the header domain criteria

• Primary User – Filtering is provided based upon the primary user
  • Computer
  • System
  • Administrator
  • Local Service
  • Network Service
  • Anonymous Logon
  • Owner
  • Other
  • Not Applicable
• Primary Sid – Filtering is provided based upon the primary system ID
• Primary Domain – Filtering is provided based upon the primary domain
• Client User – Filtering is provided based upon the client user
  • Computer
  • System
  • Administrator
  • Local Service
  • Network Service
  • Anonymous Logon
  • Owner
  • Other
  • Not Applicable
• Client Sid – Filtering is provided based upon the client system ID
• Client Domain – Filtering is provided based upon the client domain
• Target User – Filtering is provided based upon the target user
• Target Sid – Filtering is provided based upon a target system ID
• Target Domain – Filtering is provided based upon a target domain
• Primary Logon Id – Filtering is provided based upon a primary logon ID
• Client Logon Id – Filtering is provided based upon a client logon ID