How to create Forensic.xml in Security Manager 6.0 post SP2. (NETIQKB71093)

To call the forensic.xml template from the database, you can use the following procedure.

• Login to a Server or Workstation that has the Security Manager Control Center installed.
• Enable debugging on the Control Center by editing the following file:

%INSTALLPATH%\NetIQ Security Manager\Control Center\NQConsole.exe.config

• On line 24 of this file you will see this line:

<level value="INFO" />

Change: "INFO" To: "DEBUG"

• Save the NQConsole.exe.config.
• Open the Security Manager Control Center.
• In the Navigation pane, click on Forensic Analysis.
• Click on My Queries. Select a query in the center pane and edit it.
• Forensic.xml will be created in the following location on the User Interface Computer:

C:\Documents and Settings\%useraccount%\Local Settings\Application Data\NetIQ\Security Manager\Forensics.xml

• Copy Forensics.xml and rename it to CustomForensics.xml.
• Move to CustomForensics.xml to the following location:

%INSTALLPATH%\NetIQ Security Manager\OnePoint\VSOC\config\

• Disable debugging on the Control Center by editing the following file:

%INSTALLPATH%\NetIQ Security Manager\Control Center\NQConsole.exe.config

• On line 24 of this file you will see this line:

<level value="DEBUG" />

Change: "DEBUG" To: "INFO"

• Save the NQConsole.exe.config.

You can now use the CustomForensics.xml to setup forensic queries on a custom provider.