Previous Topic: Compliance ReportingNext Topic: Role-Based Access


Policy Violation Alerting

CA User Activity Reporting Module lets you automate the sending of an alert when an event occurs that requires near-term attention. You can also monitor action alerts from CA User Activity Reporting Module at any time by specifying a time interval, such as from the last five minutes to the last 30 days. Alerts are automatically sent to an RSS feed that can be accessed from a web browser. Optionally, you can specify other destinations, including email addresses, a CA IT PAM process such as one that generates help desk tickets, and one or more SNMP trap destination IP addresses.

To help you get started, many predefined queries are available for scheduling as action alerts, as is. Examples include:

Some queries use keyed lists, where you supply the values used in the query. Some keyed lists include predefined values that you can supplement. Examples include default accounts and privileged groups. Other keyed lists, such as that for business critical resources, have no default values. After you configure them, alerts can be scheduled for predefined queries such as:

Keyed lists can be updated manually, by importing a file, or by running a CA IT PAM dynamic values process.

Note: See the CA User Activity Reporting Module Administration Guide for details on action alerts.

More information:

Action Alerts