Setting up an alert

FileAudit provides 2 types of alerts:

• Single access alerts, triggered by an individual access event,

• Mass access alerts, triggered when multiple access events occur within a defined period.

This tutorial uses a Single access alert.

Make sure you have completed the previous steps in this guide:

• Configuring your first audit path: an audit path such as C:\FileAudit-Test is set up.

• Displaying the events: file access events appear in the All access events report.
  

1. Open the FileAudit console.

2. Click Alerts.

   

   
   
   

3. Under Single access, click Add.

   

   
   
   

4. From the Main tab, in the Access type drop-down list, select a simple condition such as File deletion.

   

   Note

   The fields Domain, User and Source should be kept empty if you want to be alerted for any domain, user or source that generates an event.

   The Source field allows you to specify the name of the process generating the access attempt when the file/folder is accessed locally or the IP address of the machine from which the access has been performed when the access is performed through the network.

5. Select the audited path C:\FileAudit-Test from the Paths tab.

   

   
   
   

6. From the Email tab, enter a destination email address.

   

   
   
   

7. Click Save.

FileAudit sends alert notifications by email. If this isn't already configured, set it up now with your organization's SMTP server:

1. In the FileAudit console, open Settings and select E-mail settings.

2. In Server, enter your SMTP server address.

3. In Port, enter the port your server uses.

4. In Sender E-mail, enter the address that will appear as the sender.

5. Set Mode according to what your server accepts, and provide credentials if required.

6. Click Save, then send a test email to confirm delivery.

Delete a file in C:\FileAudit-Test.

If configured correctly:

• The alert is triggered.

• A notification is sent to the configured email address.

You have now:

• Configured an audit path

• Viewed file access events

• Created a single access alert

You have the basics to start using FileAudit. Continue with Best practices to make sure your setup is production-ready.