Configure An Alert For An Existing Rule; Rule And Report Groups - Cisco CS-MARS-20-K9 - Security MARS 20 User Manual

Rule and Report Groups

Using Rules, you can alert a person if a rule has fired. The roles and groups you can choose are
determined by the information you have entered in User Management. for more information on adding
users into the Local Controller.

Configure an Alert for an Existing Rule

Click on a rule argument.
Step 1
Click Next until the Action/Operation column is selected.
Step 2
Click the Add button to add users for an alert.
Step 3
Enter a Name and Description for the notification.
Step 4
Step 5 Check the box next to the type of notification that you want to send. Your choices are:
•
•
•
•
For SNMP and Syslog, you need to configure the receiving systems for this feature to work.
Note
Click the Change Recipient button to add or edit recipients for alerts for that notification type (email,
Step 6
syslog, page, or SNMP).
Check the box next to the role, group, or system that you want to receive alerts.
Step 7
•
•
Repeat steps 5 - 7 for all the alert selections that you want to include.
Step 8
Click the Submit button.
Step 9
Step 10 Click the Apply button.
If a user adds an alert to a rule created on the Global Controller, and the rule is pushed down and fired
Note
on the Local Controller, the designated user receives the alert from the Local Controller and not the
Global Controller
Rule and Report Groups
This section contains the following subsections:
•
•
User Guide for Cisco Security MARS Local Controller
21-24
Email – select the roles or groups that you want to receive an email.
Syslog – select the systems that you want to receive the syslogs.
Page – select the roles or groups that you want to receive an electronic page on their pagers or
cellular telephones.
SNMP – select the systems that you want to receive the SNMP trap information.
Click the Add button to select recipients (to move them into the left field.)
To remove recipients, click their names to highlight them (in the left field) and click the Remove
button.
Rule and Report Group Overview, page 21-25
Global Controller and Local Controller Restrictions for Rule and Report Groups, page 21-26
Chapter 21 Rules
78-17020-01