Monitoring Internal And External Activity By Calling Line Id; Nortel Callpilot; Administrator Guide; Nn44200-601 01.11 Standard - Nortel CallPilot Administrator's Manual

106 Chapter 7 Security recommendations
5
Viewing the details for a specific event or return code
You can click the Event in the System/Event Browser to open the Event Code
Help. If the help does not automatically display the desired information, click
the Index tab in the left pane of this help file and type the event or return
code as the keyword to find. The code is displayed in the index list, and
when you click the code in the index list, the right pane refreshes to display
the details for the specified event or return code.

Monitoring internal and external activity by calling line ID

When a call comes in to the system, CallPilot keeps track of the CLID, if
available. The CLID identifies a caller to the system. If you identify certain
CLIDs as suspicious (possibly the number from which a hacker is calling in to
your system), you can use CallPilot Security Administration to monitor them.
How to identify suspicious CLIDs
You might become suspicious of certain CLIDs under the following
conditions:
•
•
Notification of access by monitored CLIDs
When thru-dial attempts are monitored, an alarm is generated whenever a
monitored CLID gains access to the system and places an outgoing call.
It does not matter how the call was transferred. All thru-dial activity that
originates from the monitored CLID generates an alarm.
Copyright © 2007, Nortel Networks
.
If you would like to monitor specific mailboxes:
a. Select Selected.
Result: The Add and Delete buttons are enabled.
b. Type in a selected mailbox to be monitored.
c. Click Add.
Note: To remove a mailbox entry, highlight the entry and
click delete.
Click Save to enable the changes.
You receive an Excessive After-Hours Logons alert. This alert reports
the mailbox number and caller DN (the CLID).
You run the Mailbox Call Session Summary report on mailboxes you
suspect are targets of hackers and notice calls repeatedly originating
from certain caller DNs.

Nortel CallPilot

Administrator Guide

NN44200-601 01.11 Standard

5.0 9 November 2007
—End—