CSA does not Query User every time.

craig.lepchenske · ‎08-07-2009

We have been tasked to have a pop up (User Query) every time someone writes to a removable disk. We have the rule working, but it does not pop up every time a file is written. There seems to be a set time between pop ups. Is there a way to adjust that time? Can it be set to pup up every time someone writes to removable media?

johuston · ‎08-07-2009

Hi Craig,

User queries are cached for 1 hour and that timer cannot be changed. However, you could modify the query so that it's unique each time which would cause the popup to come back. I'd recommend using the @filename cookie in your query response which should pop the query again when a different file is written to removable media.

Thanks,

Josh

craig.lepchenske · ‎08-10-2009

Thank you Josh. Had that in place. I am disappointed the 1 hour timer isn't adjustable. That and the 256 character count for the query.

tsteger1 · ‎08-10-2009

You might be able to use a DAC or set rule to add files to an application class when written to removable drives.

You can also just log it. Create a file set with @removable and create a FAC rule and set the action to monitor to log when any application writes to that fileset.

Tom

jan.nielsen · ‎08-12-2009

You should be very carefull with trying to get it to popup everytime someone accesses a single file from the same app. It could cause large amounts of popups and cpu usage to do this. Just a word of caution