Documentation forAccess Rights Manager

Set alerts for groups

Background / Value

Employees receive their access rights through group memberships. Especially sensitive groups grant access to secret folders and other important resources. The AD Logga allows you to actively monitor specific AD groups so that an alert is received if new members are added.

Due to the nested group structures in the Active Directory, it is important to monitor both direct group memberships and indirect memberships.

 

Related features

Set alerts for user accounts

Set alerts for OUs/domains

Manage alerts

 

Step-by-step process

  1. Use the search to find the desired group.
  2. Right-click on the group and select "Create alert" from the context menu.

 

  1. Enter a title for the alert.

  2. Select whether only direct or direct and indirect group membership changes (recommended) trigger an alert.

  1. Choose Actions.
    Here you specify which actions are executed when an alert is triggered. You must activate at least one action.
  2. Activate the option if an email should be sent in case of an alert.

The content of the emails can be customized. This is analogous to the recertification emails.

  1. The alarm is written to the Windows event log using the categorization. This option is especially useful if you are using a SIEM system that monitors the Windows Event Log.
  2. Enable the execution of a script. To be able to activate this option, a script configuration for alerts must exist.

 

Activate this option to write the event to a Syslog server. Syslog servers need to be configured in the ARM configuration application under Server > Syslog.

 

Choose a category. This is used when writing to the Windows Event Log and for the email subject.

 

  1. You must specify a reason for the alert configuration in order to save it.
  2. Click on "Create".