cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
656
Views
4
Helpful
2
Replies

"custom event creation"

Hi all

I would like to recieve a mail everytime the user pnadmin logs in (that is not just any admin but pnadmin).

I can not find an event type under "info/misc/cs-mars" matching this.

Is it possible to create (or modify an existing) a custom eventtype in Mars?

How is this done?

looking forward to any answer

/JanV - Infrastructure

2 Replies 2

Scott Fringer
Cisco Employee
Cisco Employee

Jan;

  To generate an incident for just successful pnadmin user logins it would be most effective to create a rule based on a keyword query limited to your CS-MARS as the reporting device.  If you are interested in any pnadmin activity, you could use just 'pnadmin' as the keyword; this should catch both successful and failed logins.  If you want to restrict it to successful pnadmin logins, you could use two keywords ANDed together; 'pnadmin' and 'login successful'.  By making this a rule you can assign the email action to be alerted when this rule fires.

Scott

Scott - your answer was very helpfull!

Thanx a lot! ! !

/Jan - KS-Infrastructure

Denmark

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: