Jump to content

Rule alert email and time window


Go to solution Solved by thae,

Recommended Posts

Hello

I'm a newbie in Eset Inspect and I'm asking you a suggestion: I've a rule "Administrator account login [F1007]" I want to have an email if this rule match from the 8PM to 8AM.

Is it possible ? If yes can you help me ?

My best regards

Link to comment
Share on other sites

  • Solution

In ESET Protect go to Notifications.

In Configuration select ESET INSPECT alerts . Rule name as the Filter by and enter the rule name.

In Advanced Settings - Throttling you select Time-based Criteria and add the period you want.

Link to comment
Share on other sites

Hello @thae

 

Thanks for your support is very clear.

Now: in Inspect I've enabled rule "User was added to administrator group [F1000]"  modified the severity to 90. When I test the HIT count increments but I haven't any new incidents or detections and email log. How can I'set this rule ?

My best regards

 

Link to comment
Share on other sites

On 7/3/2024 at 7:13 PM, PaoloneCM said:

Hello @thae

 

Thanks for your support is very clear.

Now: in Inspect I've enabled rule "User was added to administrator group [F1000]"  modified the severity to 90. When I test the HIT count increments but I haven't any new incidents or detections and email log. How can I'set this rule ?

My best regards

 

I just tried it with the following settings for Rule D0811:

image.png.ffb07ad6244d34f0b0bb0cbce006e69a.png

image.png.1bac202cd85721b9f49be089ed5d1470.png

In Distribution you obviously would set it to send a mail to your mail address.

I got a notification of it.

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...