topic Re: Alert on Policy Rule Modification in General Topics

Alert on Policy Rule Modification

Valentino — Mon, 31 Jan 2022 14:00:12 GMT

Hello Everybody,

I would like to know if there is a possibility to be alerted in case of modification of a rule.
For example: if a rule is modified, an email is automatically sent to a specific person

Thank you

Valentino

Re: Alert on Policy Rule Modification

Mudhireddy — Mon, 31 Jan 2022 14:54:00 GMT

Hi Valentino,
Yes, it's possible to configure Configuration log settings with an EMAIL server. You can send a log to email for every policy config change as a notification.

Re: Alert on Policy Rule Modification

Valentino — Mon, 31 Jan 2022 15:28:24 GMT

Thank you for your answer.
Thus, my need is to alert by mail when modifying specific rules.

Indeed, I have a hundred sensitive rules which must be monitored more precisely than the three thousand other rules.

I have a column "modified" and I thought to create an alert from Splunk with this data. But this column is not shown in Splunk.

If you have any idea, you're welcome

Re: Alert on Policy Rule Modification

LAYER_8 — Mon, 31 Jan 2022 19:09:35 GMT

Ah, splunk is easier! You would create an HTTP server profile instead of email.

See an example for slack here. So you would then just use a predefined format for config logs, but change the parameters to only be for the rules you are referencing. A little HTML copy-paste, but a big automation improvement in monitoring.