topic Re: Alert on every console login in Firewall and Security Management

Alert on every console login

Sagar_Manandhar — Sat, 15 Sep 2018 15:51:15 GMT

hi,

Is there the option that give alert to the admin via mail on every smart console login done by different users. I found sk related to the alert on policy installation but not able find documentation regarding this type of alert.

Regards,

Sagar Manandhar

Re: Alert on every console login

PhoneBoy — Sun, 16 Sep 2018 05:06:29 GMT

As I recall, the Policy Installation alert can come from SmartEvent.

There is an alert that can be sent for unusual login times there as well:

I guess you could create a time similar to the following:

Of course, that leaves a single minute in a week where if someone logs in, you won't get an alert

Re: Alert on every console login

Yuri_Slobodyany — Sun, 16 Sep 2018 06:49:40 GMT

You can try setting Alert instead of Log on a Security Rule that allows administrative access to the firewall, of course it will alert each time there is a match to this rule regardless whether admin actually logged in.

Re: Alert on every console login

Danny — Mon, 17 Sep 2018 01:16:51 GMT

You could simply create a startup script that checks the last logins and sends an email if new logins are logged.

Example:

while `sleep 60`; do last | tail -n 1 | check if login is within last minute, if yes, send email done

Re: Alert on every console login

Mike_Swaminatha — Fri, 05 Jun 2020 06:46:48 GMT

Hi Phoneboy

One of my customer did this configuration as you suggested here but it only give login alert with blank email body and no details of who logged in and from where. is there a way we can get the same ?

Re: Alert on every console login

Amir_Senn — Sun, 07 Jun 2020 09:21:59 GMT

Hey,

Mail alert for this kind of event should look like this. We can also un-obfuscate confidential fields using: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk68020&partition=Advanced&product=SmartEvent

If you don't see the log at all try to check the attached file, it also contains the log.

If you still don't see any information, please share some more details about your version, email client and anything you think might be related.