Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Matt_Dunn
Participant

Alert on Administrator Login

Hi,

In R80.10 I'm trying to get al alert when a SmartConsole administrator logs in.  I can't see an option for this, so I've been playing around with a custom event.  I've tried matching various things from the logs such as Operation "Log In" and Description "logged ln to SmartConsole" but nothing seems to trigger the event when I log in to SmartConsole.

Has anyone else found a way to generate an event when someone logs in to SmartConsole?

Thanks,

Matt

3 Replies
ED
Advisor

Maybe not exactly what you want but you can try  to misuse this event "Logs and monitor > new tab > SmartEvent settings and policy. In the Event policy select Unauthorized entry > Check Point administrator login at irregular hours.

Automatic reaction > mail

Regular working hours > create your own time object like this below

General settings > Objects > Time objects > 

Save policiy and Install policy.

Matt_Dunn
Participant

Hi Enis,

I tried that but I'm still getting no joy Smiley Sad  I'll keep experimenting...

Thanks,

Matt

0 Kudos
Pedro_Espindola
Advisor

Hey Matt,

I would also suggest the Check Point administrator login at irregular hours cloning, but I tried that and also had no luck.

I send SNMP trap alerts with use the Check Point administrator login at irregular hours event and it works fine, but the clone does not work, I don't know why.

I remember having issues making the custom time objects work in the past, the only ones that work for me are the default ones.

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events