Alert on Administrator Login

[Matt_Dunn]

Hi,

In R80.10 I'm trying to get al alert when a SmartConsole administrator logs in.  I can't see an option for this, so I've been playing around with a custom event.  I've tried matching various things from the logs such as Operation "Log In" and Description "logged ln to SmartConsole" but nothing seems to trigger the event when I log in to SmartConsole.

Has anyone else found a way to generate an event when someone logs in to SmartConsole?

Thanks,

Matt

[ED]

Maybe not exactly what you want but you can try  to misuse this event "Logs and monitor > new tab > SmartEvent settings and policy. In the Event policy select Unauthorized entry > Check Point administrator login at irregular hours.

Automatic reaction > mail

Regular working hours > create your own time object like this below

General settings > Objects > Time objects > 

Save policiy and Install policy.

[Matt_Dunn]

Hi Enis,

I tried that but I'm still getting no joy   I'll keep experimenting...

Thanks,

Matt

[Pedro_Espindola]

Hey Matt,

I would also suggest the Check Point administrator login at irregular hours cloning, but I tried that and also had no luck.

I send SNMP trap alerts with use the Check Point administrator login at irregular hours event and it works fine, but the clone does not work, I don't know why.

I remember having issues making the custom time objects work in the past, the only ones that work for me are the default ones.