Alerts provides a list of alerts that will perform tasks when the alerts specified conditions.
The following is a list of the default alerts that can be viewed by logging in to the management console then navigating to "Administration | Alerts";
|
A number of alerts are available to be customised for your use (the default alerts are listed above).
Alerts can be edited by left clicking on the context menu of the alert and selecting "Edit";
A new window will now open titled "Alert - Edit" that will allow you to specify the recipients of the alert, and what conditions trigger the execution of the alert.
As an alternative to editing a pre-existing alert you have the option to create a new alert by clicking on the button;
When you create an alert you need to specify which of the two alert templates the alert will be based on;
This is the most common type of alert where the alert is triggered based only on the conditions specified in the "Conditions" parameter (therefore for audit alerts this parameter is obligatory).
For intrusion alerts the conditions for the alert itself are determined by multiple factors outside of the conditions specified in the alert, and the "Conditions" parameter is just an optional method of restricting which of the intrusion events are actioned upon).
Currently the only alert based on this template is the alert "Intrusion Alert".
When the alert is triggered you have the option to send a message to specified recipients using the "Recipient Users" and "Recipient Groups" parameters.
Using the "Condition Builder" tool to determine when the alert is triggered
You can add additional filters that restrict when an alert is actioned upon by altering the contents of the "Conditions" parameter.
The contents of the "Conditions" parameter can be changed by clicking on the pencil icon ();
A new window titled titled "Condition Builder" will now open that allowing you to edit the conditions that cause the alert to be triggered.
Sending Notifications
Provided the alert is enabled, the send message is selected, and one or both delivery channels have been enabled, then when a alert is triggered, message notifications will be sent to the selected users (or groups of users)
After the alert is triggered you have the additional option to cause one of the existing tasks to be run.
To add task execution to the alert you need to first tick the checkbox prompted "Execute Task", then select what task (or tasks) are to be executed using theicon;