I have worked with a large amount of LEM clients over the past 18 months. During that time, I have not had a single client need (or want) anything from WFP events.
For me, I absolutely LOVE the new setup where we have to turn ON rules with a new installtion (instead of turning OFF things that were not neded). Given that our time with clients is generally short and to the point, it is not always possible to get a GPO-level auditing policy change through an enterprise while working with them. I would strongly support the ability to 'ignore' these events by default with the product and let the client work through their change management to get their auditing policies to stop generating the events in the first place. For the random one-off scenarios with clients who might want to "see all the things!!!", I think a connector would really be ideal, and easy to implement. Functionally speaking, it takes minutes to add a WFP connector to a profile.
Count me in for a big +1
Loop1 Systems: SolarWinds Training and Professional Services
- LinkedIN: Loop1 Systems
- Facebook: Loop1 Systems
- Twitter: @Loop1Systems