CSA does not Query User every time.

Unanswered Question
Aug 7th, 2009

We have been tasked to have a pop up (User Query) every time someone writes to a removable disk. We have the rule working, but it does not pop up every time a file is written. There seems to be a set time between pop ups. Is there a way to adjust that time? Can it be set to pup up every time someone writes to removable media?

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 4 (1 ratings)
Loading.
johuston Fri, 08/07/2009 - 18:52

Hi Craig,

User queries are cached for 1 hour and that timer cannot be changed. However, you could modify the query so that it's unique each time which would cause the popup to come back. I'd recommend using the @filename cookie in your query response which should pop the query again when a different file is written to removable media.

Thanks,

Josh

craig.lepchenske Mon, 08/10/2009 - 11:04

Thank you Josh. Had that in place. I am disappointed the 1 hour timer isn't adjustable. That and the 256 character count for the query.

tsteger1 Mon, 08/10/2009 - 18:55

You might be able to use a DAC or set rule to add files to an application class when written to removable drives.

You can also just log it. Create a file set with @removable and create a FAC rule and set the action to monitor to log when any application writes to that fileset.

Tom

jan.nielsen Wed, 08/12/2009 - 13:06

You should be very carefull with trying to get it to popup everytime someone accesses a single file from the same app. It could cause large amounts of popups and cpu usage to do this. Just a word of caution

Actions

This Discussion