Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 3 replies
  • Subscribers 1 subscriber
  • Views 1782 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Custom report using new audit features in SEC 5.2.1

Azwan

Hi Guys,

Does posible to create custom report using audit features beside predefine GUI report in SEC

:42880


This thread was automatically locked due to age.
Parents
  • 0

    HI,

    Well you should use the reporting interface to guarantee the queries will keep running ok in future console versions:

    Documentation here:

    http://www.sophos.com/en-us/medialibrary/PDFs/documentation/sec_52_sriugeng.pdf

    vEventsDataControlData is the view that contains the specific data control data

    If you look on page 8 of the above document at the graphic, you can just join the vComputerHostData view on the vEventsDataControlData view on the computerid to get the 2.

    So something as simple as: 

    select * from [Sophos Reporting Interface].[vComputerHostData] as c
    left join [Sophos Reporting Interface].[vEventsDataControlData] as d on d.computerid = c.computerid

    might be a start and alow you to choose a few columns you might want in the report.

    Regards,

    Jak

    :42910
Reply
  • 0

    HI,

    Well you should use the reporting interface to guarantee the queries will keep running ok in future console versions:

    Documentation here:

    http://www.sophos.com/en-us/medialibrary/PDFs/documentation/sec_52_sriugeng.pdf

    vEventsDataControlData is the view that contains the specific data control data

    If you look on page 8 of the above document at the graphic, you can just join the vComputerHostData view on the vEventsDataControlData view on the computerid to get the 2.

    So something as simple as: 

    select * from [Sophos Reporting Interface].[vComputerHostData] as c
    left join [Sophos Reporting Interface].[vEventsDataControlData] as d on d.computerid = c.computerid

    might be a start and alow you to choose a few columns you might want in the report.

    Regards,

    Jak

    :42910
Children
No Data