Sysmon Configurations - security

I have to work with windows event viewer where i was first required to install sysmon. As part of my first task, i am required to make sure that event id 11 and 22 work as they should. For event id 11(where it logs if a file has been created), it doesnt log whenever i create a file. For event id 22, i can see the logs but i cannot see the website that im accessing in the details tab. I was tasked to use the xml file sysmonconfig-export and configure it to make sure that the event id's display as they shoould. which line in the xms file do i change to make sure both id's work as i want them to?
my lecturer showed us how to make sure the event viewer showed event id 23 which was by changing the lines
<ClipboardChange onmatch="include">
</ClipboardChange>
to
<FileDelete onmatch="exclude">
</FileDelete>
which worked. but i have no idea how to work with event id's 11 and 22.

Related

NetSuite: Calling an API in real time as field values get updated

I'm looking for a way (using SuiteScript 2.0) to handle real-time persistent (stored) field updates, where a field might have changed in NetSuite (for example a lead time was just updated), and it doesn't matter if a user saved the change, or some other automated process changed that field. I just want to be able to pick up on that change:
The moment that it's done, and
Without regard for who or what kicked it off (e.g. it could be a person, but it could also be an automated change from a workflow, or a formula on the field itself which pulls values from another field)
Doing some research I found some options that looked somewhat promising at first. One being the afterSubmit event in a client script, and the other being the fieldChanged event. My issue however is, from what I understood those only really seem to be triggered by a user manually going in and making those changes, but this is only one part of the puzzle and doesn't seem to cover changes made outside of the scope of the user making those changes. Is that correct however? Or would one of those events still be able to capture changes done to that field regardless of who (or what) initiated or triggered the change, and right at the moment the change was saved/ persisted to the database?
UserEvents are basically triggers. In their deployment records you can set the context in which they fire so you can get them to fire in all circumstances (called contexts in Netsuite) but one.
That circumstance is User Events are not fired for record saves made in User Event scripts. i.e., if an AfterSubmit UserEvent script loads, changes and saves your record a fresh user event will not be fired.

Unable to add Field in AX Table, Event viewer shows Object name exist

While adding fields, I am facing issue that I am not able to open my table if there is new field added. it shows error like this:
Whenever a field is added, it shows an error like this:
when I check the event viewer, it shows this error:
Full error code :
Can anyone help me with this issue?
It looks like SalesTable is not properly sync'd. This type of error usually just means you need to compile & sync the entire environment to get things "working" better.
Remove your custom fields, compile the table, right click on the table, and synchronize and verify first you can successfully synchronize the individual table. If you can sync it, then sync your entire data dictionary to ensure everything is sync'd up...if one table is off (in this way), it can mean there are other tables as well.
You can choose to try and add fields and see if it works, but I would just start with a full system compile & sync.
Note: Your infolog screenshots cut off the error message. When asking a question, make sure to include the actual error messages and redact personal information. Your event viewer screenshot is also cut off...same thing.
Identify that the ID in SQL is not match with the Table name at AOT .

In Hybris ,Content page doesn't get synced when change approval status in cms

Not able to sync content page when i changed the approval status to unapproved.
I reverted back it to "Approved" still page not getting synced.
I compared the dumps in sync job , it's exactly same.
What could be causing the issue?
Troubleshooting the synchronization is very complicated...
A synchronization is executed using a synchronization cronjob. To find the respective cronjob:
go to hmc/backoffice
navigate to System/Cronjobs in hmc or System/Background Processes/Cronjobs in backoffice
use the types dropdown to restrict the search to "Multithreaded Synchronization"
pick the most recent one OR look in log file for this output and search for the code.
INFO [Thread-107] (000000RS) [CatalogVersionSyncJob] Sync 'sync powertoolsContentCatalog:Staged->Online' (pk:8796094464500) configured 0 entries for job '000000RS' (pk:8796125823477) schedule medias: 1
This is the cronjob that executed your synchronization. Now it is getting even more tricky:
go to the administration tab
look for an attribute called "Dump medias"
download the media file where attribute Realfilename starts with "sync_dump_"
The downloaded file should contain comma seperated values.
Example:
8796256994364;8796256961596;;actions,allDocuments,...,uid,urlLink,visible;;false
The entries represent the following data:
the PK of the source item
the PK of the target item
(timestamp)
a list of attributes, that could not be synchronized
?
item has been victim to a deadlock
Now you can troubleshoot your synchronization by evaluating source and target items and pending attributes.
Sometimes there is a problem when referencing an item, that does not exist in the target catalog, sometimes a uid is already existing in the target catalog. Sometimes an initial attribute needs change. There are a lot of pitfalls. In this case you can try to use this property to get more details about the exception that is thrown during sync:
synchronization.itemcopycreator.stacktraces=true
Here is some additional information:
https://www.sap.com/cxworks/article/2589632280/catalog_synchronization#CatalogSynchronization-TroubleshootingFailure

Script Type(s) for Updating All Item Records in NetSuite

I'm still new to NetSuite, so I appreciate any help you all can provide. I've created a script to update a couple custom fields on item records. Currently, it is a Client script, and while I do want it to execute when a user updates a record, I'd also like it to execute after a server update as well. In addition, I'd like to apply this to all current item records to provide a baseline for future changes.
Have I made this overly complicated? What script type should I be using? Can I get this done with one script, or do I need multiples? Thank you for the help!
You should use one User Event script that would run whenever a record is updated. you can deploy the script to run on items. In the user event you can check for context (e.g.: user interface, particular script type, maxss update etc.) if you do not want to run it in all context

How to update an existing activity stream entry in IBM Connections

I am trying to update an existing activity stream entry e.g. the title of the entry.
Here I found the code for the creation of the new entry:
Link
But I could not find any reference how do I update an existing entry?
Additional information:
I use IBM Connections 4.5 and the IBM SBT
I create the entries with a system user to other users with the flag
'actionable'
Here my questions:
Which URL?
Which Method (PUT?)?
Which Json?
And another question about the actionable flag:
How can I change the actionable flag for an entry of another user? The description for my own entries is described on slide 37 here: Link
Thank you so much !
Markus
Ok, I think I fully understand the issue now. As suggested this is not supported, but there is a way you can achieve the same result.
First of all why isn't it supported . . .
Events are a point in time (and they were accurate at that point in time)
A new event on the same object supersedes it (as it's now the most interesting) but
doesn't invalidate it (it can still be seen in history)
The Actionable view does not show a rolled up view, instead it shows all events that are marked actionable (and there may be multiple actions related to any given Object)
What you can do . . .
If you want to replace an entry in the Actionable view, you can remove the event from the actionable view (it is just removed from that view and could still be seen in event history)
You can then add another event to the actionable view (which as the latest event will also supersede events in other rolled up views)
Removing the actionable flag is here ->http://www-10.lotus.com/ldd/appdevwiki.nsf/xpDocViewer.xsp?lookupName=IBM+Connections+4.5+API+Documentation#action=openDocument&res_title=Support_for_Saved_and_Actionable_events&content=pdcontent
an activity stream object is treated an an immutable object in IBM Connections.
you can Create Delete and Read.
You can use a rollup-id in IBM Connections.
In order to address the scenario where a user posts a file and 200 people 'like' it, filling up their Activity Stream, rollup needs to be performed. This means:
Only the latest event on any given object is shown
The 2 most recent comments are returned.
http://www-10.lotus.com/ldd/appdevwiki.nsf/xpAPIViewer.xsp?lookupName=IBM+Connections+4.0+API+Documentation#action=openDocument&res_title=Support_for_Rollup&content=apicontent
Just to extend the last answer, delete is not directly supported in the Activity Stream in IBM Connections, though a means of propagating delete based on deletion of an Object was introduced in IBM Connections 4.5.
However it does seem like submitting a new event with an appropriate rollup id is what you're looking for. That way users will see the latest, but the history remains and can be seen if desired.

Resources