09-21-2010 04:55 AM
Hi all
I would like to recieve a mail everytime the user pnadmin logs in (that is not just any admin but pnadmin).
I can not find an event type under "info/misc/cs-mars" matching this.
Is it possible to create (or modify an existing) a custom eventtype in Mars?
How is this done?
looking forward to any answer
/JanV - Infrastructure
09-24-2010 04:55 AM
Jan;
To generate an incident for just successful pnadmin user logins it would be most effective to create a rule based on a keyword query limited to your CS-MARS as the reporting device. If you are interested in any pnadmin activity, you could use just 'pnadmin' as the keyword; this should catch both successful and failed logins. If you want to restrict it to successful pnadmin logins, you could use two keywords ANDed together; 'pnadmin' and 'login successful'. By making this a rule you can assign the email action to be alerted when this rule fires.
Scott
10-04-2010 02:06 PM
Scott - your answer was very helpfull!
Thanx a lot! ! !
/Jan - KS-Infrastructure
Denmark
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide