Alert Profiles

• Create Alert Profile
• Notify Alerts by Email

Create Alert Profile

The below mentioned requirements are to be met for an Alert Profile.

1. Name of the Alert Profile
2. Description for the Alert Profile
3. Severity of the Alert configured.
4. Report Profiles to be Associated with the Alert Profile.
5. Alert Message.

To create a New Alert Profile:

1. Click on "Configuration" Tab -->>"Create Alert Profile" under Alert Profiles.
2. This displays the Create Alert Profile Page.
3. Enter the "Name" of the Alert Profile in the Box Provided.
4. Enter the "Description" of the Alert Profile in the Box Provided.
5. Select the "Severity" of the Alert Profile
   • The Severity depends on importance of the Alert and can indicate "Attention, Trouble, or Critical"
6. Select the "Report Profile" for a Domain
   • Click the " "Plus icon to the right of Report Profile Box a Pop-up appears.
   • Select the "Domain" from the Drop Down.
   • Select the "Category" from the Drop Down.
   • Select one or more of the available "Report Profiles" to be alerted by providing a check against them.
   • Click on OK.
7. Click on 'Advanced Configurations' to filter the event
   1. Threshold based Alerts - Use this to manage the number of alerts generated for a particular event.
   2. Business hour alert - Filter the event based on business or non-business hours
   3. Filter - Using this advanced filter, any event can be drilled further down.
8. To add an Alert Message Click on the [Add] link to the right of Alert Message Box.
   • The "Alert Message" can be typed with a common alert message or customized alert messages can also be configured.
   • Click on "OK".
9. To Send Email Notifications provide a check against the "Send E-mail Notification" Check Box and Enter the recipient Email addresses in the box provided.
10. Click on the "More" to configure recipient via the "mail" attribute of user.
11. Use the "Throttle Notification" feature to suppress unwanted noisy emails.
12. "SMS Notification" helps to send alerts as SMS.
13. "Execute Script" feature can be used to configure any actionable scripts to be executed.
    1. The supported scripts are powershell, vbscript, executables and batch.

    2. Syntax for "Script Location" :
       Powershell script:
       powershell.exe ⟨Script_path⟩ ⟨Event_variables⟩
       Example: powershell.exe C:\Users\administrator\Desktop\alert_test_scripts\test.ps1 "%USERNAME%"
       
       VBScript script:
       wscript/script ⟨Script_path⟩ ⟨Event_variables⟩
       Example: wscript C:\Users\administrator\Desktop\alert_test_scripts\test.vbs
       "%USERNAME%"
       
       Batch script:
       ⟨Script_path⟩ ⟨Event_variables⟩
       C:\Users\administrator\Desktop\alert_test_scripts\test.bat "%USERNAME%"
       
       ⟨Script_path⟩ - Full path to the Script.
       ⟨Event_variables⟩ - They are parameters to be passed as command line arguments to the script. Use the "Add" button to add them to the command.

    3. The complete list of variables is available at, https://www.manageengine.com/products/active-directory-audit/help/alerts/alert-variables.html
14. Click on "Save".
15. A new Alert Profile is created.

Notify Alerts by Email

An important part of an alert is its ability to notify users. ADAudit Plus facilitates notifications of one or all configured Alerts by email.

To configure an email alert directly from the Alert Tab

1. Click on the "Email Notification" Link to the top right of the page.
2. This will redirect to the "Configuration" Page showing all "Available alert profiles".
3. Click on the "Configure" link under the column "E-mail Notify".
4. This will redirect to the page where you can "Modify Alert Profiles"
5. Under "Modify Alert Profile" provide a check against "Send E-mail Notification".
6. Enter the "Mail To" address in the check box provided. (For multiple recipients,separate email addresses with commas.)
7. Click on Update.

This will update the "Alert Profile" for the "Selected Report Profile". Any new alert will be notified by email to one or all recipient email addresses entered here.