<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic System log filter - email alerts in General Topics</title>
    <link>https://live.paloaltonetworks.com/t5/general-topics/system-log-filter-email-alerts/m-p/482734#M105310</link>
    <description>&lt;P&gt;I would like to receive email alerts on certain system events, such as when there is a successful login and unsuccessful login attempt from GUI and CLI. (Among other events).&lt;/P&gt;
&lt;P&gt;The filter for the stem log is looking for certain "strings" or "attributes" Andi have no idea where to find them. Any ideas?&lt;/P&gt;
&lt;P&gt;Thanks.&lt;/P&gt;</description>
    <pubDate>Tue, 26 Apr 2022 19:55:59 GMT</pubDate>
    <dc:creator>roma</dc:creator>
    <dc:date>2022-04-26T19:55:59Z</dc:date>
    <item>
      <title>System log filter - email alerts</title>
      <link>https://live.paloaltonetworks.com/t5/general-topics/system-log-filter-email-alerts/m-p/482734#M105310</link>
      <description>&lt;P&gt;I would like to receive email alerts on certain system events, such as when there is a successful login and unsuccessful login attempt from GUI and CLI. (Among other events).&lt;/P&gt;
&lt;P&gt;The filter for the stem log is looking for certain "strings" or "attributes" Andi have no idea where to find them. Any ideas?&lt;/P&gt;
&lt;P&gt;Thanks.&lt;/P&gt;</description>
      <pubDate>Tue, 26 Apr 2022 19:55:59 GMT</pubDate>
      <guid>https://live.paloaltonetworks.com/t5/general-topics/system-log-filter-email-alerts/m-p/482734#M105310</guid>
      <dc:creator>roma</dc:creator>
      <dc:date>2022-04-26T19:55:59Z</dc:date>
    </item>
    <item>
      <title>Re: System log filter - email alerts</title>
      <link>https://live.paloaltonetworks.com/t5/general-topics/system-log-filter-email-alerts/m-p/482780#M105311</link>
      <description>&lt;P&gt;Thank you for the post&amp;nbsp;&lt;a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/116207"&gt;@roma&lt;/a&gt;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;this string will capture all successful and failed login attempts from GUI/CLI:&amp;nbsp;( description contains 'failed authentication' ) or ( description contains 'logged in' ) or ( description contains 'logged out' )&amp;nbsp;&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="PavelK_0-1651007370601.png" style="width: 999px;"&gt;&lt;img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/40351iC9A1DAE9F903AAB2/image-size/large/is-moderation-mode/true?v=v2&amp;amp;px=999" role="button" title="PavelK_0-1651007370601.png" alt="PavelK_0-1651007370601.png" /&gt;&lt;/span&gt;&lt;/P&gt;
&lt;P&gt;Kind Regards&lt;/P&gt;
&lt;P&gt;Pavel&lt;/P&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Tue, 26 Apr 2022 21:11:24 GMT</pubDate>
      <guid>https://live.paloaltonetworks.com/t5/general-topics/system-log-filter-email-alerts/m-p/482780#M105311</guid>
      <dc:creator>PavelK</dc:creator>
      <dc:date>2022-04-26T21:11:24Z</dc:date>
    </item>
  </channel>
</rss>

