Security Compliance

Appliance monitoring rules and alerts in SEM

This article provides information on rules that can be used to receive alerts in SEM.

First published date

10/19/2018 10:20 PM

Last published date

1/24/2022 11:02 AM

Overview

This article provides brief information on rules that can be used to receive alerts in Security Event Manager (formerly Log & Event Manager).

Product section

Security Event Manager

Resolution

Appliance Database Rule: Detects when the appliance is unable to connect to the database, likely the result of a fatal error.Below steps are carried out from HTML5 Console.

1. In the SEM Events Console, click the Rules tab.
2. On the Rules toolbar, click Create rule from template.
3. In the search box, enter Appliance. 


4. Select the Appliance Database Down rule template, click Next, and then click Next again. You will see the following

6. Under Actions, click Add New Actions.
7. In the Add new action search box, type email.
8. Select Send Email Message, and then click Next.
9. Select or enter a recipient, and then click Add.
10. Review your rule details, and then click Create.
11. Repeat the steps for the Appliance Heartbeat email template.

Appliance Hearbeat Rule:Used in conjunction with the Appliance Database to notify once daily via e-mail that the core LEM service is functioning as expected. This rule needs to be setup from the SEM Flash console.

  1. On the SEM toolbar, navigate to Build > Rules.
  2. Locate the Appliance Heartbeat and Appliance Database Down rule templates.
  3. For each rule, click its gear icon, and then select Clone.
  4. Select the Enable check box at the top, and then choose a recipient to send the email alert to in the Send Email Message section.
  5. Click Save, and then click the Activate Rules button in the top-right corner.