SharePoint Site Filtering

Products Activity Monitor Ideas
, , ,
1

What is a one sentence summary of your feature request?

The ability to only collect activity for specific SharePoint sites

Please describe your idea in detail. What is your problem, why do you feel this idea is the best solution, etc.

Currently within NAA we can filter specific set of sites for SPAA/SPEEK scans. However, there is no configuration for SPAC/NAM activity. Also, within NAM we can filter specifc FS paths on Windows and NetApp for example. There is no configuration to limit the scope of collected activity in SharePoint, specifically SharePoint Online.

How do you currently solve the challenges you have by not having this feature?

We have implemented a PowerShell script to “clean” the activity files into another directory and point SPAC to collect the “cleaned” activity files. This works, but it would be more supportable if it was baked into NAM or NAA, preferably in NAM since some customers do not want other site-specific details logged at all.

1 Like
2

Hi Justin,

Thanks a lot for the detailed feedback. Sorry you’ve had to work around this with scripts.

This feature will be included in Activity Monitor 10, and we are very likely to backport it to earlier versions as well.

In fact, filtering by sites/URLs already exists in the current product, but the settings are not yet exposed in the UI - making them accessible is part of the upcoming improvements. If you’re interested, I can share the steps for configuring it manually. There are two parameters, PATHFILTERS and SITEFILTERS, in the agent’s configuration responsible for this filtering.

Your input is very valuable and helps us prioritize the right changes.

1 Like
3

You are welcome @paul_shmakov! That would be great if you can share the configuration format for those two parameters. We will give it a try and if it works as we expect the implement at our customers. Thank you!

4

Hi Justin,

Here is a workaround for the current version, but only for SharePoint Online.

  1. Locate the agent’s configuration file. Refer to the Step 1 here Agent Backup | Netwrix Product Documentation
  2. Open the file and locate sections starting with the [SHAREPOINTONLINE_MONITOR prefix. For example, [SHAREPOINTONLINE_MONITOR1], [SHAREPOINTONLINE_MONITOR2]. There will be a section for each output.
  3. To filter by sites, add the SITESFILTERS parameter to the section. See below.
  4. To filter by object URLs, add the PATHFILTERS parameter to the section. See below.
  5. Save the file. The changes will be applied immediately.

Site filtering

The format of the SITEFILTERS parameter is a semicolon-separated list of site URLs, each prefixed with either + to include or - to exclude. The order matters - the first match wins. Wildcards *, **, and ? are supported. Here are a few examples:

Example 1 - Monitor two sites: Finance and RND

SITEFILTERS=+https://mycompany.com/sites/Finance/;+https://mycompany.com/sites/RND/

Example 2 - Monitor all sites but Management

SITEFILTERS=-https://mycompany.com/sites/Management/

Example 3 - Monitor all sites under https://mycompany.com/sites/ but exclude those with “private” in their URLs

SITEFILTERS=-**private**;+https://mycompany.com/sites/**

Object URL filtering

The format of the PATHFILTERS parameter is the same as for the SITEFILTERS. Here are a few examples:

Example 4 - Exclude all events for files under the “_layouts” subfolder.

PATHFILTERS=-**/_layouts/**

Example 5 - Exclude activity for __siteIcon__.png, theme.sptheme and theme.spcolor files

PATHFILTERS=-**/__siteIcon__.png;-**/theme.sptheme;-**/theme.spcolor

I hope it helps.

1 Like
5

This is fantastic, thank you @paul_shmakov. Just to clarify, it’s my understanding that nothing needs to happen after saving the configuration file to trigger the changes, correct?

6

Yes, it’s enough to just save the configuration file - the product will detect the change and apply new configuration automatically.

1 Like