Release Notes › Features › Policy Violation Alerting

Policy Violation Alerting

CA Enterprise Log Manager lets you automate the sending of an alert when an event occurs that requires near-term attention. You can also monitor action alerts from CA Enterprise Log Manager at any time by specifying a time interval, such as from the last five minutes to the last 30 days. Alerts are automatically sent to an RSS feed that can be accessed from a web browser. Optionally, you can specify other destinations, including email addresses, a CA IT PAM process such as one that generates help desk tickets, and one or more SNMP trap destination IP addresses.

To help you get started, many predefined queries are available for scheduling as action alerts, as is. Examples include:

• Excessive user activity
• High CPU utilization average
• Low available disk space
• Security event log cleared in last 24 hours
• Windows audit policy changed in last 24 hours

Some queries use keyed lists, where you supply the values used in the query. Some keyed lists include predefined values that you can supplement. Examples include default accounts and privileged groups. Other keyed lists, such as that for business critical resources, have no default values. After you configure them, alerts can be scheduled for predefined queries such as:

• Group membership addition or removal by privileged groups
• Successful login by default account
• No events received by business critical sources

Keyed lists can be updated manually, by importing a file, or by running a CA IT PAM dynamic values process.

Note: See the CA Enterprise Log Manager Administration Guide for details on action alerts.

More information:

Action Alerts