09-21-2010 04:55 AM
Hi all
I would like to recieve a mail everytime the user pnadmin logs in (that is not just any admin but pnadmin).
I can not find an event type under "info/misc/cs-mars" matching this.
Is it possible to create (or modify an existing) a custom eventtype in Mars?
How is this done?
looking forward to any answer
/JanV - Infrastructure
09-24-2010 04:55 AM
Jan;
To generate an incident for just successful pnadmin user logins it would be most effective to create a rule based on a keyword query limited to your CS-MARS as the reporting device. If you are interested in any pnadmin activity, you could use just 'pnadmin' as the keyword; this should catch both successful and failed logins. If you want to restrict it to successful pnadmin logins, you could use two keywords ANDed together; 'pnadmin' and 'login successful'. By making this a rule you can assign the email action to be alerted when this rule fires.
Scott
10-04-2010 02:06 PM
Scott - your answer was very helpfull!
Thanx a lot! ! !
/Jan - KS-Infrastructure
Denmark
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: