cancel
Showing results for 
Search instead for 
Did you mean: 

create an alarm to track useracc

HI Could someone please guide me in creating an alarm to track user activity. Currently I have created a watchlist with the list of user account. The current alarm that I set up sends an email but does not state what activity was performed or what account triggered the alarm.
1 Reply
Highlighted

Re: create an alarm to track useracc

I recommend reading this:
McAfee_SIEM_ESM10_Best_Practices_for_Alarms.pdf

But basically if you already created the alarm, you need to edit the template.

I suggest you to take a screenshot of the event's information. The name of the fields you want to include on the mail.

  1. After you know what you want to report, go and edit your alarm.
  2. On Actions > Send Message Configure> Templates.
  3. Add a new template and edit as you want.
  4. Use the information you took earlier and click the little star to insert all the fields that you want, it will be replaced with the information of the event.

The repeating blocks will help you with correlated events

E.g.
Alarm: [$Alarm Name]
Assignee: [$Alarm Assignee]
Trigger Date: [$Trigger Date]

Summary: [$Alarm Summary]

Source User: [$%UserIDSrc]
Source IP: [$Source IP]

More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator
  • Community Help Hub

      New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

    • Find Forum FAQs
    • Learn How to Earn Badges
    • Ask for Help
    Go to Community Help

    Join the Community

      Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

    • Get helpful solutions from McAfee experts.
    • Stay connected to product conversations that matter to you.
    • Participate in product groups led by McAfee employees.
    Join the Community
    Join the Community