Event Notification issue

[Hamid Ali]

Dear Support, There is an event which is appearing as follow: Event "Operation with the device allowed" occurred on device ********* in Windows domain *********** on Friday, June 14, 2019 3:26:43 PM (GMT+05:00) Event type: Operation with the device allowed Device\Device category: Data bus Device\Device type/Bus type: USB User: ************ (Not defined) Result\Decision: Allow Result\Operation: Connect Could you please guide how to stop this event for "Data bus" only as its indicating above. there is no option is Event Notification in policy settings, please guide. Thanks

[Dmitry Parshutin]

Hello! This event should be configured in active policy. You need to check Event configuration and "Info" window. Then please set the option "Do not store" Thank you!

[Hamid Ali]

Hello! This event should be configured in active policy. You need to check Event configuration and "Info" window. Then please set the option "Do not store" Thank you!

Dear Support, Thanks for the info, actually i want this event to be stored in KSC so that it could be exported to SIEM. The issue is that there are similar kind of same event multiple time registered on KSC, is there any way to limit this event ? I mean i dont want the same event from the following category: "Device\Device category: Data bus" Thanks

[Nikolay Arinchev]

Hi,

The issue is that there are similar kind of same event multiple time registered on KSC, is there any way to limit this event ?

Unfortunately, there is no way to limit the amount of events.

[Hamid Ali]

Hi,

The issue is that there are similar kind of same event multiple time registered on KSC, is there any way to limit this event ?

Unfortunately, there is no way to limit the amount of events.

Dear Support, Thanks for the response. Ok got it, is there any way to stop following category event only for this notification only: "Device\Device category: Data bus" Other than this category i want this event to be enabled, please guide, Thanks

[Hamid Ali]

Dear Support, Waiting for your kind response. Thanks

[Nikolay Arinchev]

Unfortunately, that is not possible either.