Documentation forSecurity Event Manager

Monitor role users and filters

SEM users assigned to the Monitor role can use the filters they have access to, but they cannot create, edit, delete, or import/export filters.

See About SEM roles to learn more.

By default, this role has access to the same set of filters as other users. To remove and/or modify the filters that Monitor-role users can access in the console, complete the following steps. You will need to complete some of these steps on the end-user's computer. When the user logs in to SEM using the same computer and Windows profile, they will only have access to the filters specified.

  1. From the SEM console, navigate to Configure > Users.
  2. Select the appropriate user and click Edit User.
  3. Temporarily assign the user to the Administrator role.

  4. Instruct the user to log in to the SEM console using their Windows profile.

  5. Change the filters as needed, deleting any unnecessary filters.

    If you created and exported the filters in a previous procedure, you can add new filters to the user Filters list by creating or importing the filter as appropriate. To remove a filter from the user Filter list, point to the filter and click x that appears to the right.

  6. Log out the user and close the console window.

  7. Using your administrator login, change the user back to the Monitor role.

  8. From the user computer, have the user log in with their credentials, and then click Monitor.

    The user should only see the specified filters.