Automatic Response - Audit Log

[Aj-richer]

Hi All,

Not sure if it's possible to do what i am looking for but hopefully it is.

I need it so that every time an event is generated in the Audit Log, in this case a specific event "Save Policy Object" an automatic response will send me an email notifying me of this.

I have looked in automatic responses but unable to see an option to do this.

Any ideas?

Thanks

Aj

[LKS · Accepted solution]

Hi Aj-richer,

There is no specific Event Id for this action as per the below article.

https://kc.mcafee.com/corporate/index?page=content&id=KB54677

Was my reply helpful?

If you find this post useful, please give it a Kudos! Also, please don't forget to select "Accept as a Solution" if this reply resolves your query!

[cdinet]

Some of those save policy object entries will be by system. If you update an extension, or content updates (as in IPS rules example), associated policies will get updated in the background.  You might also see that with distributed repository changes - all the agent policies will be updated.  

5.10 has the feature to require approvals before any policy changes are actually applied, and you would see a notification in the top right notification icon when that occurs.