XYGATE Merged Audit Reference Manual

XYGATE Merged Audit
®
Reference Manual
Chapter 3. Configuring Filters and the FILTERS File
XYPRO Technology Corporation 53 Proprietary and Confidential
If you have the Safeguard Global AUTHENTICATE-MAXIMUM-ATTEMPTS set to 3,
you would select records with the text "Logon Fail count 2 to 3" because this is the
event that will cause Safeguard to freeze the userid. Now XMA will generate an email
every time a userid is frozen because of a bad password. All logons, whether
successful or not, will still be written to the XMA database.
DATA_SELECT_BEGIN
FILTERTYPE STRINGFILTER
AUDIT.OPERATION = VERIFYUSER
AUDIT.OUTCOME = 3
AUDIT.RESULT CONTAINS "Logon Fail count 3 to 4"
DATA_SELECT_END
Note: The text in the RESULT field is case sensitive. You must enter the text exactly
as it appears in the audit record. To see the exact text, run an Audit Pro report
via the Report Manager GUI, where you can view the “raw data.”
What if you then decide that you really only want to be notified when a User attempts
to log directly on to one or more specific privileged IDs? Now you need to add a third
criteria to define the specific IDs you need to monitor. In this case it is the userids
themselves that make the audit records unique. Data identifying the userid that is
being logged on will be placed in four columns: OBJECTNAME, TARGETLOGIN (the
user name), TARGET_USERNUMBER_MAJOR (the group number) and
TARGET_USERNUMBER_MINOR (the member number). Note that the
OBJECTNAME column contains both the user name and the user number.
DATA_SELECT_BEGIN
FILTERTYPE STRINGFILTER
AUDIT.OPERATION = VERIFYUSER
AUDIT.OBJECTNAME CONTAINS "255,255"
DATA_SELECT_END
The chapter criteria shown above will send an email for all logon attempts to
SUPER.SUPER whether they succeed or not. All logon attempts will still be written to
the XMA database.
Choosing Selection Criteria for Monitoring XAC Activity
If you want to generate an EMS message every time a user invokes a specific XAC
command, it is the command name itself that makes the event unique. So you would
use the XAC data mapping table (page 274) to determine which column contains the
command names. If you check the data mapping table now, you will see that the
command names are placed in both the RULENAME column and the OBJECTNAME
column. You could choose either column for your Filter. Then, using the appropriate
operator, you would define the XAC command name(s) that you want to trigger an
email each time a user invokes it.
If you want an alert for use of a single command, use the = (equals) operator and the
exact command name: