Create a FIM rule to get email notifications in SEM

10/9/2018 1:41 PM

8/25/2022 10:23 PM

This article applies to Security Event Manager (formerly Log & Event Manager).

This article provides steps to get email alerts when a third party accesses folders, or certain folders monitored by FIM, for a specific node agent.

In your SEM environment:

• An agent with a FIM connector is enabled
• The current event is File Read
• Events are processing into the system correctly

Security Event Manager

Create a Rule:

This rule will monitor the directory specified above with the Tool Alias as FIM. 

SEM Flash console

1. Log in to your SEM web console.  
2. On the SEM menu bar, navigate to Build > Rules.
3. On the upper right of the Rules pane, click the plus (+) sign to open the Rule Creation page.
4. In the search box in the left panel, enter FileRead. 
5. Drag EventInfo and ToolAlias to Correlation box.

   Correlation should appear similar to the following: 

   FileRead.EventInfo = *c:\gentkeys\*
   FileRead.ToolAlias = FIM File and Directory

   

6. Expand the Actions group, and then drag the Send Email Message into the Actions box. The Action box must be assigned the correct recipients of the alert. 
7. Leave the Correlation Time as it is.
8. Save the rule, and then click Activate Rule on the upper-right corner of the Rules page.

SEM HTML5 console

1. In the SEM Events Console, click the Rules tab.
2. On the rules toolbar, click Create new rule.
3. In the Rule Values search box, enter FileRead.
4. Under FileRead fields, drag EventInfo and ToolAlias into the rules builder. 

   

   Correlation should appear similar to the following:

   FileRead.EventInfo = *c:\gentkeys\*
   
   FileRead.ToolAlias = FIM File and Directory

5. Click Next.
6. Complete the Details and actions, and include Send Email message as an action. Ensure the correct recipients are added.
7. Ensure the rule is enabled, and then click Create.