XMA: How can I generate an alert when a SEEP is disabled?

XMA: How can I generate an alert when a SEEP is disabled?

Using a Safeguard mover an addition can be made to the FILTERS filter to capture the audit result "SEEP Enabled On to Off" and take an action defined with the ACTIONTYPE keyword to generate an alert.

The FILTERS file example below uses ACTIONTYPE IPALERT to send messages to a SIEM.  Other ACTIONTYPE options to generate alerts include ALERT (EMS), SYSLOGQ (SIEM via TCP), MAIL (email). 
 
FILTERDEFBEGIN $EVENTS-SEEP-DISABLED
!= This FILTER alerts when  a SEEP is disabled
STATUS ACTIVE            
MOVER_BEGIN
  MOVER_SELECT_BEGIN  
    PRODUCT = SAFEGUARD
  MOVER_SELECT_END
MOVER_END
DATA_BEGIN
DATA_SELECT_BEGIN
  FILTERTYPE STRINGFILTER
  AUDIT.OBJECTTYPE = SEEP
  AUDIT.MESSAGEID  = 54
  AUDIT.RESULT contains "SEEP Enabled On to Off"
DATA_SELECT_END

ACTIONCOLL_BEGIN
!Below sample ACTIONTYPE sends messages to a SIEM
ACTION_BEGIN
ACTIONTYPE IPALERT
IPALERT_ADDRESS 127.0.0.1
IPALERT_PORT 512
IPALERT_IPPROCESS $tcp1p
IPALERT_PREFIX <130> HPNS
ALERTSTRING @0
ALERTSTRING @|(AUDIT.RECORDLCT)|
ALERTSTRING @|(AUDIT.OPERATION)|
ALERTSTRING @|(AUDIT.OUTCOME)|
ALERTSTRING @|(AUDIT.MESSAGEID)|
ALERTSTRING @|(AUDIT.MESSAGECODE)|
ALERTSTRING @|(AUDIT.SUBJECTLOGIN)|
ALERTSTRING @|(AUDIT.SUBJECTSYSTEM)|
ALERTSTRING @|(AUDIT.TARGETLOGIN)|
ALERTSTRING @|(AUDIT.OBJECTTYPE)|
ALERTSTRING @|(AUDIT.OBJECTNAME)|
ALERTSTRING @|(AUDIT.TERMINAL)|
ALERTSTRING @|(AUDIT.MESSAGEID)|
ALERTSTRING @|(AUDIT.MESSAGECODE)|
ALERTSTRING @|(AUDIT.RULENAME)|
ALERTSTRING @|(AUDIT.USER_DATA)|
ALERTSTRING @|(AUDIT.RESULT)|
ACTION_END
ACTIONCOLL_END
FILTERDEFEND
 


If you are unable to locate the solution needed or if you need additional assistance please Click Here to open a case from our Customer Care Portal.


    • Related Articles

    • XMA: Filter to send an email alert when using XCF to update XYGATE configuration files

      This is an example filter you can modify to use in your own environment to generate email alerts when XYGATE configuration files are updated with XCF. !====================================================================== ! Alert when ACL or CONF ...

    • XMA: how to resend XMA alerts when using IPALERT

      Add Alert-Only movers to resend the messages with a FILTER that will not send the records created later than the end DateTime. - The Start DateTime can be specified (e.g. "2022-05-09:00:00:00.000000") when the commands to start the added Alert-Only ...

    • XMA: How to generate email alerts for priviliged ID usage when PRMTMAC is used

      This example shows how to generate an email when PRMPTMAC is used in conjunction with a privileged AC Command. The FILTER below looks for an XAC-O (output) record type with "REASON: " in the result field. Tokens are then used to customize the email ...

    • XMA: SLSENDER is busy

      Use the XMA_SQLCOMPALL macro to generate a new optimized query plan, which will then be used when compiling the objects. TACL> VOLUME $SYSTEM.XYGATEMA TACL> RUN XMA INSTALL TACL> XMA_PWSTOP TACL> XMA_SQLCOMPALL TACL> XMA_PWCOOL The XMA_SQLCOMPALL ...

    • XMA: How to generate the SQL explain plan for movers.

      To produce an explain plan to show the SQL/MP cost and table usage for XMA movers. Using XMA_MANAGER stop the Mover Volume $<XUGATEMA Installation volume>.XYGATEMA RUN NEWDEFS SQLCOMP /IN <Object>/CATALOG =XMA_CAT,EXPLAIN Using XMA_MANAGER start the ...