Creating Security Alert Definitions
You can create an alert definition to monitor your data in real time. You can identify issues and attacks before they impact your network.
For example, if you are an administrator, you can define a condition such that if the number of firewall deny events crosses a predefined threshold in a given time frame for a specific device, you receive an e-mail alert.
To create a security alert definition:
- Select Monitor > Alerts & Alarms > Alert Definitions
The Security alert definitions page appears.
- Click the create icon (+) or add icon (+).
The Create an Alert Definition page appears.
- Complete the configuration according to the guidelines provided in Table 1.
- Click OK. If you want to discard the changes, click Cancel instead.
A new alert definition with the configured alert triggering condition is created. You can view the generated alerts from the alert definition to troubleshoot the issues with your system.
Table 1: Fields on the Security Alert Definitions Page
Enter a unique string of alphanumeric characters, colons, periods, dashes, and underscores. No spaces are allowed and the maximum length is 63 characters.
Enter a description for the alerts; maximum length is 1024 characters.
Displays the type of alert that is system-based.
Select the Active check box to view only the active alerts.
Select the severity level of the alert: info, minor, major, critical.
Use Data Criteria from Filters
Specifies the data criteria from the list of default and user-created filters that are saved from the Event Viewer.
To add saved filters:
Add Data Criteria
Specifies the data criteria based on the Time Span period, Group By, and Filter By option. Filtered data only displays the subset of data that meets the criteria that you specify.
Specify the e-mail addresses for the recipients of the alert notification.
Enter a custom string for identifying the type of alert in the alert notification e-mail.