Skip to content

DriveLock Product Feedback & Ideas

← DriveLock & idgard Feedback Portal

Share your ideas for DriveLock.

Submit improvement ideas, explore existing ones, and vote on what matters most.

Teilen Sie Ihre Ideen mit DriveLock.

Reichen Sie Verbesserungsvorschläge ein, sehen Sie bestehende Ideen und stimmen Sie ab.

What is missing or could work better in DriveLock?

(thinking…)

Enter your idea and we'll search to see if someone has already suggested it.

If a similar idea already exists, you can support and comment on it.

If it doesn't exist, you can post your idea so others can support it.

Enter your idea and we'll search to see if someone has already suggested it.

  • Hot ideas
  • Top ideas
  • New ideas
  • My feedback

6 results found

  1. Syntax-basierte Benachrichtungsregeln - DOC

    Aktuell können Benachrichtigungsregeln (E-Mail) im DOC nur auf Basis der Event ID getriggert werden.
    Sinnvoll wäre die Möglichkeit, innerhalb der ID auf spezifische Syntaxinhalte filtern und alarmieren zu können.
    BSP: EVENT ID 130 - The device HP LaserJet Pro M404-M405 was connected to the computer.;Device type: Media player.
    Alle anderen Events zur ID130 sollen dann keine E-Mail Benachrichtigung im DOC zur Folge haben.
    Filterung im Bereich der Eventgenerierung selbst, würde die ID nur einschränken. Es würden Informationen verloren gehen.

    4 votes

    We're glad you're here

    Please sign in to leave feedback
    Signed in as (Sign out)
    Close
    Close

    We’ll send you updates on this idea

    under review  ·  0 comments  ·  Detection & Response  ·  Admin →
    How important is this to you?

    We're glad you're here

    Please sign in to leave feedback
    Signed in as (Sign out)
    Close
    Close

  2. Alert frequency based rule

    DriveLock should allow the creation of alert based on frequency and time. Ideally with boolean logic f.e:
    -if event happens (more¦less) X time within Y minutes (most important one)
    -if event happens between X am and Y pm
    -if event does not happen between X am and Y pm
    -if event happened at least X minutes after the last event
    -if event not happened after X minutes of the previous event

    4 votes

    We're glad you're here

    Please sign in to leave feedback
    Signed in as (Sign out)
    Close
    Close

    We’ll send you updates on this idea

    0 comments  ·  Detection & Response  ·  Admin →
    How important is this to you?

    We're glad you're here

    Please sign in to leave feedback
    Signed in as (Sign out)
    Close
    Close

  3. Direkter Link aus E-Mail-Benachrichtigung zum Event im DOC

    Direkter Link aus E-Mail-Benachrichtigung zum Event im DOC

    Beschreibung:
    E-Mail-Benachrichtigungen zu Sicherheitsereignissen enthalten derzeit keinen direkten Zugriff auf das zugehörige Event in der zentralen Management-Konsole (DOC).

    Anforderung:
    Bereitstellung eines direkten Links in der E-Mail-Benachrichtigung, der Anwender unmittelbar zum entsprechenden Event im DOC führt.

    Nutzen:

    Schnellere Analyse und Reaktion auf Ereignisse
    Reduzierter manueller Suchaufwand im DOC
    Effizientere Bearbeitung durch Support und Administratoren

    1 vote

    We're glad you're here

    Please sign in to leave feedback
    Signed in as (Sign out)
    Close
    Close

    We’ll send you updates on this idea

    0 comments  ·  Detection & Response  ·  Admin →
    How important is this to you?

    We're glad you're here

    Please sign in to leave feedback
    Signed in as (Sign out)
    Close
    Close
    under review  ·  AdminAndreas Fuchs (Product Management, DriveLock SE) responded

    Vielen Dank für den Vorschlag. Wir nehmen das als Feature Request auf.

    Ein direkter Deep Link auf ein einzelnes Event ist aktuell technisch nicht möglich, da einzelne Events im DOC keine eigene URL besitzen. Eine mögliche Lösung wäre jedoch, die Event-Ansicht bereits passend gefiltert zu öffnen – z. B. anhand des Zeitstempels des Events. Alternativ könnte zukünftig auch ein eindeutiger Event-Identifier verwendet werden.

  4. Ability to Filter what syslog events I want to forward

    I know I can enable my events to be forwarded to a remote Syslog server, but we're missing an option to filter what events will actually be sent, at the source, in this case our DES tenant.
    That would be important for narrowing the data ingestion in our XDR, and also would enable us to better manage alerts and block incidents directly in MS Defender for example, in our case is only for Blocked Processes, eventId 473.

    1 vote

    We're glad you're here

    Please sign in to leave feedback
    Signed in as (Sign out)
    Close
    Close

    We’ll send you updates on this idea

    0 comments  ·  Detection & Response  ·  Admin →
    How important is this to you?

    We're glad you're here

    Please sign in to leave feedback
    Signed in as (Sign out)
    Close
    Close
    on the roadmap  ·  AdminAndreas Fuchs (Product Management, DriveLock SE) responded

    Thanks for the feedback. We will track this as a feature request.

    Until source-side filtering is available in DriveLock, you should also be able to filter or discard unwanted events on the receiving SIEM/XDR side and only process the relevant event types, such as Event ID 473.

  5. Unterschiedliche Informationen bei ähnlichen Ereignissen

    Wenn ich in den Ereignissen, z.B. Geräteereignissen die Einträge zu einem System ansehen, fällt auf das die Hardware ID bei Event 130 unter Parameter 2, bei Event 782 unter Parameter 3 eingetragen ist.
    Beim Geräte-Typ sind es Parameter 4 und 2.

    Dies macht eine Sinnvolle Auswertung/Suche eigentlich unmöglich.
    Hier wäre eine Bereinigung/Vereinheitlichung wünschenswert

    1 vote

    We're glad you're here

    Please sign in to leave feedback
    Signed in as (Sign out)
    Close
    Close

    We’ll send you updates on this idea

    0 comments  ·  Detection & Response  ·  Admin →
    How important is this to you?

    We're glad you're here

    Please sign in to leave feedback
    Signed in as (Sign out)
    Close
    Close
    under review  ·  AdminAndreas Fuchs (Product Management, DriveLock SE) responded

    Vielen Dank für den Hinweis. Eine Vereinheitlichung der technischen Parameterpositionen (Parameter 1, 2, 3 usw.) ist aus unserer Sicht nicht der sinnvollste Ansatz, da unterschiedliche Events unterschiedliche Strukturen haben.

    Wir möchten die Ereignisdarstellung stattdessen stärker auf verständliche, fachliche Informationen wie Hardware-ID, Hersteller oder Seriennummer ausrichten und prüfen zudem eine bessere Suche nach den mit einem Event verknüpften Geräten.

    Bereits heute können Sie unter Security Controls > Devices im Tab Events direkt nach den Hardware-Informationen des jeweiligen Geräts filtern.

  6. Include System Name in Email Alert Subject Line

    Improvement Suggestion: Include System Name in Email Alert Subject Line

    Currently, the subject lines of automatically generated email alerts do not include any indication of which computer system triggered the respective event. In order to identify the affected system, each message must be opened individually, which significantly reduces clarity and efficiency when handling alerts.

    Suggestion:
    It would be very helpful if the subject line of alert emails could be extended to include the name of the affected system. This would make it immediately visible in the email client whether recurring alerts are coming from the same system or if different…

    1 vote

    We're glad you're here

    Please sign in to leave feedback
    Signed in as (Sign out)
    Close
    Close

    We’ll send you updates on this idea

    under review  ·  1 comment  ·  Detection & Response  ·  Admin →
    How important is this to you?

    We're glad you're here

    Please sign in to leave feedback
    Signed in as (Sign out)
    Close
    Close
  • Don't see your idea?

DriveLock Product Feedback & Ideas

Categories