Hello, 

I have a closed environment (collectors are open to CM and only CM is open and connected to outsources such as Email/SIEM systems).

Tried using Distributed Reports to give real-time data (time granularity is set to 1 minute) but the distributed reports aren't showing the most relevant data.

Is there any other setting I need to change in order for it to be "up-to-date"?

Appreciate all the help.

------------------------------
itay Mor
------------------------------

Hi Itay,

if you want real-time events to your email or SIEM, policy based rules are the only way to go for STAP based activity collection.  Distributed reporting is not practical for up-to-date processing.

Correlated alerts would be the next best thing that can runon a time-based interval with the records and query for what you are looking for.

But for real-time alerting, policy rules are the only way to go.

Alerting rule actions - IBM Documentation

This can help you get started but you need to understand the message formatting templates as well.

Jennifer

------------------------------
Jennifer Dodson
Data Protection Managed Services
Converge Technology Solutions Corp.
Formerly Information Insights LLC
_____________
m: 469.502.8850
convergetp.com | Jennifer.Dodson@convergetp.com

------------------------------