Administration Guide › Action Alerts › Preparing to Use Alerts with Keyed Lists › Customize Keyed Values for Default_Accounts

Customize Keyed Values for Default_Accounts

You can use a predefined query to create an alert when a login by a default account is successful. You can use the default keyed list only or you can supplement it with your own values. Predefined values include bin, cisco, daemon, DBSNMP, Guest, helpdesk, Imnadm, invscout, IUSR_ComputerName, mail, Nobody, root, sa, sshd, sys, SYSMAN, system, and Uucp.

To customize the list, you identify the default accounts that are created during operating system, database, or application installations as values in the key-value list for Default_Accounts. The query that uses the values you supply is named Successful Login by Default Accounts in the last 24 hours.

If you create a custom query that uses this key, define the filter as follows:

To customize keyed values for Default_Accounts

1. Click the Administration tab and the Services subtab.
2. Click Report Server.

   A list of keys to which you add user-defined values is displayed at the bottom of the main pane.

3. Select the key, Default_Accounts.

   The predefined values appear.

4. Take one or more of the following actions to update this list:
   • Click Add Value and enter a new value to include in the keyed list.
   • Select a value and click Remove Value to delete the value from the list.
   • Select a value, click Edit Value, modify the value and click OK.
   • Click Export Values to export the current list, edit the list to add other values, save the file. Then, click Import Values to import your edited file.
   • If the values for this key are dynamically generated by the configured CA IT PAM process, click Import Dynamic Values List.
5. Click Save.

   If you have already scheduled an action alert for the query Successful Login by Default Accounts in the last 24 hours, that alert will be generated based on the evaluation of all values in your modified keyed list for Default_Accounts.

More information:

Example: Send an Alert that Runs an IT PAM Process Per Row