Step 3: Specify Alert Components - 8e6 Technologies Threat Analysis Reporter TAR HL/SL/MSA Evaluation Manual

Step 3: Specify Alert Components

Create a new alert by performing the following actions:
1. Click on one of the gauge names in the "Current Gauge" list (e.g. "Adult
Content").
2. Enable Alert Action checkboxes for "Email" and "Lockout".
3. Type in the name for your alert in the "Alert Name" field.
4. Type in an email address and click the "Add Email" button. This is the address
of the person who will be notified when an alert is triggered. You can add
multiple email addresses.
5. Select a Severity level (Low, Medium or High). This section is only enabled
when the "Lockout" checkbox is selected. A "Low" selection will lock out the
user by the categories monitored in the specific gauge only. A "Medium" selec-
tion will lock out the user from Internet access altogether. A "High" selection will
lock out the users from all network protocols, so they cannot access the
Internet, send e-mails, use instant messaging, or use P2P or FTP.
NOTES: Time-based lockouts can be set for a range of 30 minutes, one hour to eight
hours, or unlimited.
System Tray will not be shown in this demo, but if this feature is enabled, the administrator
with an LDAP username, password and domain will see a system tray alert in the desktop
system tray when an alert has been triggered. This applies to Active Directory environ-
ments only. For more information, please consult the Threat Analysis Reporter User
Guide.
6. Create a Threshold per user. This numeric value is the number of times each
user will be allowed to visit categories monitored by the gauge before triggering
an alert.
7. Click on the "Submit" button to activate the alert.
Specify alert criteria
8 6 T , T A
E ECHNOLOGIES HREAT NALYSIS
C 4: C
HAPTER
R E G
EPORTER VALUATION UIDE
A A
REATE AN UTOMATED LERT
S 3: S A C
TEP PECIFY LERT OMPONENTS
13