XMA: Filter to send an email alert when using XCF to update XYGATE configuration files
This is an example filter you can modify to use in your own environment to generate email alerts when XYGATE configuration files are updated with XCF.
!======================================================================
! Alert when ACL or CONF file is changed USING XCF
!======================================================================
FILTERDEFBEGIN $XYGATE-CONFIG-CHANGES-USING-XCF
STATUS ACTIVE
EVALUATE_MSG CONTINUE
MOVER_BEGIN
MOVER_SELECT_BEGIN
PRODUCT = XYGATETR
MOVER_SELECT_END
MOVER_END
DATA_BEGIN
DATA_SELECT_BEGIN
FILTERTYPE STRINGFILTER
AUDIT.PRODUCTCODE = XYGATETR
AUDIT.RULENAME = SECURE-XYGATE-CONFIG-FILES
AUDIT.RESULT LIKE "CFAUDIT Configuration file"
DATA_SELECT_END
DATA_END
ACTIONCOLL_BEGIN
ACTION_BEGIN
ACTIONTYPE SETDATA
AUDIT.USER_DATA XYGATE config
ACTION_END
!= Add other desired ACTIONs here
ACTIONCOLL_END
ACTIONCOLL_BEGIN
ACTION_BEGIN
ACTIONTYPE MAIL !generate email alerts
#IF @NODE = "\<NODENAME>"
MAIL_FROM <MAILFROM@YOURCOMPANY.COM>
MAIL_IPPROCESS <IPPROCESS>
#ENDIF
MAIL_SRV <MAILSERVER.COM>
MAIL_PORT <PORT>
MAIL_TO <MAILTO@YOURCOMPANY.COM>
MAIL_SUBJECT ALERT - XYPRO ACL or CONF file changes
MAIL_TEXT
"Node: |(INSTALL.SYSTEMNAME)|"
"Source: |(AUDIT.PRODUCTCODE)|"
"Time: |(AUDIT.RECORDLCT)|"
"Operation: |(AUDIT.OPERATION)|"
"Type: |(AUDIT.OBJECTTYPE)|"
"Name: |(AUDIT.OBJECTNAME)|"
"Target login: |(AUDIT.TARGETLOGIN)|"
"Message ID: |(AUDIT.MESSAGEID)|"
"Attempted: |(AUDIT.SUBJECTLOGIN)|"
"IP Addr: |(SESSION.IPADDRV46)|"
"Result: |(AUDIT.RESULT)|"
"Outcome: |(AUDIT.OUTCOME)| (Success = 1; Fail = 3)"
MAIL_TEXT_END
ACTION_END
ACTIONCOLL_END
FILTERDEFEND
If you are unable to locate the solution needed or if you need additional assistance please Click Here to open a case from our Customer Care Portal.