Using the System Action Center

Device Sensor Monitoring rules help you monitor the health of your device sensors, notifying you when they are either offline or haven't sent data within a specified amount of time.

Device Sensor Monitoring rules only work for device sensors. They are not supported for Server Sensors (agents).

You can create the following types of Device Sensor Monitoring rules:

• Device sensor feedback –This rule is triggered when the feedback from a Device Sensor indicates that it has been upgraded. Stellar Cyber checks every five minutes for changes in upgrade feedback.

• Device sensor ingestion change – This rule is triggered when a Device Sensor's daily ingestion deviates more than a specified percentage from its average daily ingestion over the last seven days. Stellar Cyber compares these values once per day at 03:00 AM UTC.

• Device sensor status change – This rule is triggered when a Device Sensor's status is either yellow or red, as defined below. A new notification is generated every five minutes the sensor remains in one of these states. You can investigate further in the Sensor list.

  • Yellow – At least one warning condition is affecting the sensor.

    Click here to see the possible warning conditions:

    • Sensor disk usage exceeds 90%

    • Sensor CPU usage exceeds 99%

    • Sensor feedback contains a config mismatch error message

    • Sensor has not updated its status in at least five minutes

    • Sensor feedback shows a failure to apply a profile with the Tenable Nessus feature enabled to a sensor running version 4.3.3 or lower (Tenable Nessus support was introduced in 4.3.4)

    • Sensor feedback contains at least one warning message

  • Red – At least one danger condition is affecting the sensor.

    Click there to see the possible danger conditions:

    • Sensor has an invalid Engine ID (engid)

    • Sensor has a conflicting Engine ID (engid)

    • Sensor configuration is out of sync (either the ver_sent does not match received ver_ack or one of the two messages is missing)

    • Sensor memory usage exceeds 95%

    • Sensor feedback contains a config failure message

    • Sensor feedback shows at least one failure during the application of a new sensor profile.

• No data from device sensor(s) – This rule is triggered when a sensor has not sent a record with traffic within a specified interval.

• No heartbeat from device sensor(s) – This rule is triggered when Stellar Cyber has not received a heartbeat message from a sensor within a specified interval.

Notice that the No data and No heartbeat rules monitor for different types of inactivity. When a No data from device sensor(s) notification is generated, Stellar Cyber may still have contact with the affected sensor but is not receiving records with traffic. In the case of the No heartbeat from device sensor(s) notification, Stellar Cyber is not receiving heartbeats from affected sensors and has not had contact within the specified monitoring interval.

For all rule types, you can also specify a Mute Interval that specifies a window within which a repeated instance of the same notification will not be generated.

. Use the following procedure to create a Device Sensor Monitoring rule:

1. Click the Create button at the top of the System Action Center and select Device Sensor Monitoring from the dropdown that appears.

   

2. Select the type of rule you want to create. See the start of this section for a description of the rule types.

   The Create Notification wizard starts with the Category set to Device Sensor Monitoring and the Type set to the selected rule type.

3. Supply a name for your notification rule in the Name field.

4. Select the Tenant to which the rule applies. By default, All Tenants are selected. Click anywhere in the Tenant) field to display a pick list including all tenants available on the system where you can select the tenant to which this rule applies.

5. You can either accept the system-provided Description or supply your own. The description supplied here appears in the System Action Center's table of rules.

   

6. Click Next.

7. Set Advanced options for the rule, as described below:

   • All rules include the Excluded Sensors option, with a dropdown that lets you exclude specified sensors from monitoring. The list includes all sensors available to the tenant selected in the first step of the wizard.

   • Rules with All Tenants selected in the first step include the Excluded Tenants option, with a dropdown that lets you exclude sensors assigned to a specified tenant from monitoring. This gives you a handy way to assign a rule to all but a few excluded tenants.

   • Some of the rules include additional options, as summarized in the table below:

   Device Sensor Monitoring Rule Type	Advanced Options	Description	Default Value
   Device sensor ingestion change	Ingestion Change Percent	Specify the percentage differential in daily ingestion (up or down) from the average of the previous seven days at which this rule is triggered.	20%
   No data from device sensor(s)	No Data Threshold	Specify the amount of time that can pass without a device sensor sending a record with traffic before this rule is triggered.	1 hour
   	Mute Threshold	Use these options to temporarily silence notifications from the rule for a specified amount of time. Once the rule is triggered, no new notifications will be generated from the same rule until the Mute Threshold has passed. Stellar Cyber still monitors the rule for signs of activity from the sensor until the mute threshold passes and restarts the monitoring interval if they are detected. A new alert is only generated when the Mute Threshold is passed if no activity has been seen during the monitoring interval.	1 hour
   No heartbeat from device sensor(s)	No Heartbeat Threshold	Specify the amount of time that can pass without a device sensor sending a heartbeat before this rule is triggered.	4 hours
   	Mute Threshold	Use these options to temporarily silence notifications from the rule for a specified amount of time. Once the rule is triggered, no new notifications will be generated from the same rule until the Mute Threshold has passed. Stellar Cyber still monitors the rule for heartbeats from the sensor until the mute threshold passes and restarts the monitoring interval if they are detected. A new alert is only generated when the Mute Threshold is passed if no heartbeats have been seen during the monitoring interval.	24 hours

   The image below shows the Advanced step for a No data from device sensor(s) rule:

   

8. Use the Actions step to specify how this rule notifies you when it is triggered:

   • All rules have In Platform enabled so that triggered instances appear in the Notification Center.

   • Click the Add Configuration button and choose whether to add an Email or Slack action, as illustrated below.

     

   • Set the following options for an Email action in the Notification Type: Email section:

     • Check the Send individual email for each notification option if you would like to send separate emails for each triggered instance of the rule. If you do not check this option, the System Action Center sends a consolidated email listing all matching events.

       Refer to Consolidated or Individual Notifications for details.

     • Use the Recipients field to specify who will receive a notification email when the rule is triggered. Click to display a pick list containing all email recipients configured in the System | Recipients page. If you want to send an email to someone who is not already configured in the Recipients page, you can also type addresses in manually.

     • Use the Subject field to specify the subject line of the email. If you want to use different subject lines for different recipients, you can click the Add Configuration button and add a second Email notification with a different subject line and set of addressees.

     The figure below shows a configured Email notification:

     

   • Set the following options for a Slack action in the Notification Type: Slack section:

     • Check the Send individual Slack messages for each notification option if you would like to send separate Slack messages for each triggered instance of the rule. If you do not check this option, the System Action Center sends a consolidated Slack message listing all matching events.

       Refer to Consolidated or Individual Notifications for details.

     • Use the Recipients field to specify the Slack channel or user that will receive a message when the rule is triggered.

       You can click to display a pick list containing all Slack recipients configured in the System | Recipients page. You can also manually type in the URL for an incoming webhook that you create in the Slack API.

     The figure below shows a configured Slack notification:

     

     Email and Slack messages both include a summary of the event(s) that triggered the notification and a link back to the Stellar Cyber platform to a location that makes sense based on the type of notification that was generated. You can configure a rule with any combination of email and Slack messages, including multiple destinations.

9. Click Next and review the settings for your notification rule. Use the Back button to go back and correct anything that's not quite right. When you are satisfied, click Submit to add your rule to the list.

   The rule appears in the System Action Center's list and is automatically Enabled.

License Enforcement rules notify you about issues regarding your licenses. You can create the following types of License Enforcement rules:

• License in undesirable state – This rule is triggered when your license enters the warning, violation, or out-of-compliance state. Refer to .Understanding License Compliance for details on each of these license states.

• License limit exceeded – This rule is triggered when your license is exceeded on a given day, but remains below the 110% of usage that would put it in a warning state.

The system includes built-in License in undesirable state and License limit exceeded rules that can be neither disabled nor deleted. You can edit those rules to change who is notified by them or, alternatively, you can create additional License Enforcement rules using the procedure below to notify different sets of people with different emails.

. Use the following procedure to create a License Enforcement rule:

1. Click the Create button at the top of the System Action Center and select License Enforcement from the dropdown that appears.

   

2. Select either License in undesirable state or License limit exceeded, depending on the type of rule you want to create. See the start of this section for a description of the two rule types.

   The Create Notification wizard starts with the Category set to License Enforcement and the Type set to the selected rule type.

3. Supply a name for your notification rule in the Name field.

4. Select the Tenant to which the rule applies. By default, All Tenants are selected. Click anywhere in the Tenant field to display a pick list including all tenants available on the system where you can select the tenant to which this rule applies.

5. You can either accept the system-provided Description or supply your own. The description supplied here appears in the System Action Center's table of rules.

   

6. Click Next.

7. Use the Actions step to specify how this rule notifies you when it is triggered:

   • All rules have In Platform enabled so that triggered instances appear in the Notification Center.

   • Click the Add Configuration button and choose whether to add an Email or Slack action, as illustrated below.

     

   • Set the following options for an Email action in the Notification Type: Email section:

     • Check the Send individual email for each notification option if you would like to send separate emails for each triggered instance of the rule. If you do not check this option, the System Action Center sends a consolidated email listing all matching events.

       Refer to Consolidated or Individual Notifications for details.

     • Use the Recipients field to specify who will receive a notification email when the rule is triggered. Click to display a pick list containing all email recipients configured in the System | Recipients page. If you want to send an email to someone who is not already configured in the Recipients page, you can also type addresses in manually.

     • Use the Subject field to specify the subject line of the email. If you want to use different subject lines for different recipients, you can click the Add Configuration button and add a second Email notification with a different subject line and set of addressees.

     The figure below shows a configured Email notification:

     

   • Set the following options for a Slack action in the Notification Type: Slack section:

     • Check the Send individual Slack messages for each notification option if you would like to send separate Slack messages for each triggered instance of the rule. If you do not check this option, the System Action Center sends a consolidated Slack message listing all matching events.

       Refer to Consolidated or Individual Notifications for details.

     • Use the Recipients field to specify the Slack channel or user that will receive a message when the rule is triggered.

       You can click to display a pick list containing all Slack recipients configured in the System | Recipients page. You can also manually type in the URL for an incoming webhook that you create in the Slack API.

     The figure below shows a configured Slack notification:

     

     Email and Slack messages both include a summary of the event(s) that triggered the notification and a link back to the Stellar Cyber platform to a location that makes sense based on the type of notification that was generated. You can configure a rule with any combination of email and Slack messages, including multiple destinations.

8. Click Next and review the settings for your notification rule. Use the Back button to go back and correct anything that's not quite right. When you are satisfied, click Submit to add your rule to the list.

   The rule appears in the System Action Center's list and is automatically Enabled.

License Usage rules notify you about issues regarding your licenses. You can create the following types of License Enforcement rules:

• Asset threshold exceeded – This rule is triggered when your license's asset threshold is exceeded on a given day.

• Ingestion threshold exceeded – This rule is triggered when your license's volume-based threshold is exceeded on a given day.

The system includes built-in Asset threshold exceeded and Ingestion threshold exceeded rules that cannot be deleted. You can disable these rules or edit them to change who is notified by them. Alternatively, you can create additional License Usage rules using the procedure below to notify different sets of people with different emails.

. Use the following procedure to create a License Usage rule:

1. Click the Create button at the top of the System Action Center and select License Usage from the dropdown that appears.

   

2. Select either Asset threshold exceeded or Ingestion threshold exceeded, depending on the type of rule you want to create. See the start of this section for a description of the two rule types.

   The Create Notification wizard starts with the Category set to License Usage and the Type set to the selected rule type.

3. Supply a name for your notification rule in the Name field.

4. Select the Tenant to which the rule applies. By default, All Tenants are selected. Click anywhere in the Tenant field to display a pick list including all tenants available on the system where you can select the tenant to which this rule applies.

5. You can either accept the system-provided Description or supply your own. The description supplied here appears in the System Action Center's table of rules.

   

6. Click Next.

7. Select the Tenant to which the rule applies. By default, All Tenants are selected. Click anywhere in the Tenant field to display a pick list including all tenants available on the system where you can select the tenant to which this rule applies.

8. Use the Threshold field to specify by how much the asset or ingestion threshold must be exceeded in order for this rule to be triggered:

   • Asset threshold exceeded – The threshold specifies the number of assets above the allowed threshold at which this notification is triggered.

   • Ingestion threshold exceeded – The threshold specifies the number of GB above the allowed threshold at which this notification is triggered.

   

9. Click Next.

10. Use the Actions step to specify how this rule notifies you when it is triggered:

    • All rules have In Platform enabled so that triggered instances appear in the Notification Center.

    • Click the Add Configuration button and choose whether to add an Email or Slack action, as illustrated below.

      

    • Set the following options for an Email action in the Notification Type: Email section:

      • Check the Send individual email for each notification option if you would like to send separate emails for each triggered instance of the rule. If you do not check this option, the System Action Center sends a consolidated email listing all matching events.

        Refer to Consolidated or Individual Notifications for details.

      • Use the Recipients field to specify who will receive a notification email when the rule is triggered. Click to display a pick list containing all email recipients configured in the System | Recipients page. If you want to send an email to someone who is not already configured in the Recipients page, you can also type addresses in manually.

      • Use the Subject field to specify the subject line of the email. If you want to use different subject lines for different recipients, you can click the Add Configuration button and add a second Email notification with a different subject line and set of addressees.

      The figure below shows a configured Email notification:

      

    • Set the following options for a Slack action in the Notification Type: Slack section:

      • Check the Send individual Slack messages for each notification option if you would like to send separate Slack messages for each triggered instance of the rule. If you do not check this option, the System Action Center sends a consolidated Slack message listing all matching events.

        Refer to Consolidated or Individual Notifications for details.

      • Use the Recipients field to specify the Slack channel or user that will receive a message when the rule is triggered.

        You can click to display a pick list containing all Slack recipients configured in the System | Recipients page. You can also manually type in the URL for an incoming webhook that you create in the Slack API.

      The figure below shows a configured Slack notification:

      

      Email and Slack messages both include a summary of the event(s) that triggered the notification and a link back to the Stellar Cyber platform to a location that makes sense based on the type of notification that was generated. You can configure a rule with any combination of email and Slack messages, including multiple destinations.

11. Click Next and review the settings for your notification rule. Use the Back button to go back and correct anything that's not quite right. When you are satisfied, click Submit to add your rule to the list.

    The rule appears in the System Action Center's list and is automatically Enabled.

Scheduled Report Monitoring rules can notify you when a scheduled report has failed, helping you investigate report generation issues in real time. Scheduled Report Monitoring rules check for failed reports every five minutes.

. Use the following procedure to create a Scheduled Report Monitoring rule:

1. Click the Create button at the top of the System Action Center and select Scheduled Report Monitoring | Scheduled report failed from the dropdown that appears.

   

   The Create Notification wizard starts with the Category set to Scheduled Report Monitoring and the Type set to Scheduled report failed.

2. Supply a name for your notification rule in the Name field.

3. Select the Tenant to which the rule applies. By default, All Tenants are selected. Click anywhere in the Tenant) field to display a pick list including all tenants available on the system where you can select the tenant to which this rule applies.

4. You can either accept the system-provided Description or supply your own. The description supplied here appears in the System Action Center's table of rules.

   

5. Click Next.

6. Use the Actions step to specify how this rule notifies you when it is triggered:

   • All rules have In Platform enabled so that triggered instances appear in the Notification Center.

   • Click the Add Configuration button and choose whether to add an Email or Slack action, as illustrated below.

     

   • Set the following options for an Email action in the Notification Type: Email section:

     • Check the Send individual email for each notification option if you would like to send separate emails for each triggered instance of the rule. If you do not check this option, the System Action Center sends a consolidated email listing all matching events.

       Refer to Consolidated or Individual Notifications for details.

     • Use the Recipients field to specify who will receive a notification email when the rule is triggered. Click to display a pick list containing all email recipients configured in the System | Recipients page. If you want to send an email to someone who is not already configured in the Recipients page, you can also type addresses in manually.

     • Use the Subject field to specify the subject line of the email. If you want to use different subject lines for different recipients, you can click the Add Configuration button and add a second Email notification with a different subject line and set of addressees.

     The figure below shows a configured Email notification:

     

   • Set the following options for a Slack action in the Notification Type: Slack section:

     • Check the Send individual Slack messages for each notification option if you would like to send separate Slack messages for each triggered instance of the rule. If you do not check this option, the System Action Center sends a consolidated Slack message listing all matching events.

       Refer to Consolidated or Individual Notifications for details.

     • Use the Recipients field to specify the Slack channel or user that will receive a message when the rule is triggered.

       You can click to display a pick list containing all Slack recipients configured in the System | Recipients page. You can also manually type in the URL for an incoming webhook that you create in the Slack API.

     The figure below shows a configured Slack notification:

     

     Email and Slack messages both include a summary of the event(s) that triggered the notification and a link back to the Stellar Cyber platform to a location that makes sense based on the type of notification that was generated. You can configure a rule with any combination of email and Slack messages, including multiple destinations.

7. Click Next and review the settings for your notification rule. Use the Back button to go back and correct anything that's not quite right. When you are satisfied, click Submit to add your rule to the list.

   The rule appears in the System Action Center's list and is automatically Enabled.

Sensor Token rules notify you three days before a token is about to expire. Tokens are used to authorize sensor installations.

Use the following procedure to create a Sensor Token rule:

1. Click the Create button at the top of the System Action Center and select Sensor Token from the dropdown that appears.

   

2. The only rule available in the Sensor Token category is Token is about to expire. This rule notifies you when a token is three days from expiring.

3. Supply a name for your notification rule in the Name field.

4. Select the Tenant to which the rule applies. By default, All Tenants are selected. Click anywhere in the Tenant) field to display a pick list including all tenants available on the system where you can select the tenant to which this rule applies.

5. You can either accept the system-provided Description or supply your own. The description supplied here appears in the System Action Center's table of rules.

   

6. Click Next.

7. Use the Actions step to specify how this rule notifies you when it is triggered:

   • All rules have In Platform enabled so that triggered instances appear in the Notification Center.

   • Click the Add Configuration button and choose whether to add an Email or Slack action, as illustrated below.

     

   • Set the following options for an Email action in the Notification Type: Email section:

     • Check the Send individual email for each notification option if you would like to send separate emails for each triggered instance of the rule. If you do not check this option, the System Action Center sends a consolidated email listing all matching events.

       Refer to Consolidated or Individual Notifications for details.

     • Use the Recipients field to specify who will receive a notification email when the rule is triggered. Click to display a pick list containing all email recipients configured in the System | Recipients page. If you want to send an email to someone who is not already configured in the Recipients page, you can also type addresses in manually.

     • Use the Subject field to specify the subject line of the email. If you want to use different subject lines for different recipients, you can click the Add Configuration button and add a second Email notification with a different subject line and set of addressees.

     The figure below shows a configured Email notification:

     

   • Set the following options for a Slack action in the Notification Type: Slack section:

     • Check the Send individual Slack messages for each notification option if you would like to send separate Slack messages for each triggered instance of the rule. If you do not check this option, the System Action Center sends a consolidated Slack message listing all matching events.

       Refer to Consolidated or Individual Notifications for details.

     • Use the Recipients field to specify the Slack channel or user that will receive a message when the rule is triggered.

       You can click to display a pick list containing all Slack recipients configured in the System | Recipients page. You can also manually type in the URL for an incoming webhook that you create in the Slack API.

     The figure below shows a configured Slack notification:

     

     Email and Slack messages both include a summary of the event(s) that triggered the notification and a link back to the Stellar Cyber platform to a location that makes sense based on the type of notification that was generated. You can configure a rule with any combination of email and Slack messages, including multiple destinations.

8. Click Next and review the settings for your notification rule. Use the Back button to go back and correct anything that's not quite right. When you are satisfied, click Submit to add your rule to the list.

   The rule appears in the System Action Center's list and is automatically Enabled.

Server Sensor Monitoring rules help you monitor the health of your Server Sensors, notifying you when they are either offline or haven't sent data within a specified amount of time.

Server Sensor Monitoring rules only work for server sensors. They are not supported for Device Sensors (dedicated sensors).

You can create the following types of Server Sensor Monitoring rules:

• No data from server sensor(s) – This rule is triggered when a server sensor has not sent a record with traffic within a specified interval.

• No heartbeat from server sensor(s) – This rule is triggered when Stellar Cyber has not received a heartbeat message from a server sensor within a specified interval.

  Notice that these rules are monitoring for different types of inactivity. When a No data from server sensor(s) notification is generated, Stellar Cyber may still have contact with the affected Server Sensor but is not receiving records with traffic. In the case of the No heartbeat from server sensor(s) notification, Stellar Cyber is not receiving heartbeats from affected Server Sensors and has not had contact within the specified monitoring interval.

  For both the No data and No heartbeat rules, you can also specify a Mute Intervalthat specifies a window within which a repeated instance of the same notification will not be generated.

• Server sensor status change – This rule is triggered when the status of a Server Sensor is either yellow or red, as defined below. A new notification is generated every five minutes the sensor remains in one of these states. You can investigate further in the Sensor list.

  • Yellow – At least one warning condition is affecting the sensor.

    Click here to see the possible warning conditions:

    • Sensor disk usage exceeds 90%

    • Sensor CPU usage exceeds 99%

    • Sensor feedback contains a config mismatch error message

    • Sensor has not updated its status in at least five minutes

    • Sensor feedback shows a failure to apply a profile with the Tenable Nessus feature enabled to a sensor running version 4.3.3 or lower (Tenable Nessus support was introduced in 4.3.4)

    • Sensor feedback contains at least one warning message

  • Red – At least one danger condition is affecting the sensor.

    Click there to see the possible danger conditions:

    • Sensor has an invalid Engine ID (engid)

    • Sensor has a conflicting Engine ID (engid)

    • Sensor configuration is out of sync (either the ver_sent does not match received ver_ack or one of the two messages is missing)

    • Sensor memory usage exceeds 95%

    • Sensor feedback contains a config failure message

    • Sensor feedback shows at least one failure during the application of a new sensor profile.

      The exception to this is a failure to apply a modular sensor profile with the Tenable Nessus feature enabled to a sensor running 4.3.3 or lower. Those failures are reported as warnings and only display the yellow LED, as described above.

Use the following procedure to create a Server Sensor Monitoring rule:

1. Click the Create button at the top of the System Action Center and select Server Sensor Monitoring from the dropdown that appears.

   

2. Select the type of rule you want to create. See the start of this section for a description of the rule types.

   The Create Notification wizard starts with the Category set to Server Sensor Monitoring and the Type set to the selected rule type.

3. Supply a name for your notification rule in the Name field.

4. Select the Tenant to which the rule applies. By default, All Tenants are selected. Click anywhere in the Tenant) field to display a pick list including all tenants available on the system where you can select the tenant to which this rule applies.

5. You can either accept the system-provided Description or supply your own. The description supplied here appears in the System Action Center's table of rules.

   

6. Click Next.

7. Set Advanced options for the rule, as described below:

   • All rules include the Excluded Sensors option, with a dropdown that lets you exclude specified sensors from monitoring. The list includes all sensors available to the tenant selected in the first step of the wizard.

   • Rules with All Tenants selected in the first step include the Excluded Tenants option, with a dropdown that lets you exclude sensors assigned to a specified tenant from monitoring. This gives you a handy way to assign a rule to all but a few excluded tenants.

   • Some of the rules include additional options, as summarized in the table below:

   Server Sensor Monitoring Rule Type	Advanced Options	Description	Default Value
   No data from server sensor(s)	No Data Threshold	Specify the amount of time that can pass without a server sensor sending a record with traffic before this rule is triggered.	1 hour
   	Mute Threshold	Use these options to temporarily silence notifications from the rule for a specified amount of time. Once the rule is triggered, no new notifications will be generated from the same rule until the Mute Threshold has passed. Stellar Cyber still monitors the rule for signs of activity from the sensor until the mute threshold passes and restarts the monitoring interval if they are detected. A new alert is only generated when the Mute Threshold is passed if no activity has been seen during the monitoring interval.	1 hour
   No heartbeat from server sensor(s)	No Heartbeat Threshold	Specify the amount of time that can pass without a server sensor sending a heartbeat before this rule is triggered.	4 hours
   	Mute Threshold	Use these options to temporarily silence notifications from the rule for a specified amount of time. Once the rule is triggered, no new notifications will be generated from the same rule until the Mute Threshold has passed. Stellar Cyber still monitors the rule for heartbeats from the sensor until the mute threshold passes and restarts the monitoring interval if they are detected. A new alert is only generated when the Mute Threshold is passed if no heartbeats have been seen during the monitoring interval.	24 hours

   The image below shows the Advanced step for a No data from server sensor(s) rule:

   

8. Use the Suppression step to set up a schedule of times during which notifications from the rule will not be displayed in the Notification Center or sent to configured recipients. This can be handy for suppressing notifications from sensors that you know are normally not seeing any data during specific hours.

   The times you configure for the Suppression schedule are specified in browser time.

   1. Use the Mute Schedule checkbox to enable or disable suppression for the rule. When Mute Schedule is checked, you can set up a schedule as follows:

   2. Select a time zone for the schedule from the dropdown. By default, the time zone is set to your browser's time zone.

   3. Use the Start Day/Time and End Day/Time fields to specify a window of time during which notifications from the rule are not sent.

   4. Use the + Row button to add an additional row to the schedule. Each row creates a new window of time during which notifications from the rule are not sent.

   The figure below shows a sample Suppression schedule configured to exclude notifications during weekends and late evenings on Monday nights to Tuesday mornings:

   

9. Use the Actions step to specify how this rule notifies you when it is triggered:

   • All rules have In Platform enabled so that triggered instances appear in the Notification Center.

   • Click the Add Configuration button and choose whether to add an Email or Slack action, as illustrated below.

     

   • Set the following options for an Email action in the Notification Type: Email section:

     • Check the Send individual email for each notification option if you would like to send separate emails for each triggered instance of the rule. If you do not check this option, the System Action Center sends a consolidated email listing all matching events.

       Refer to Consolidated or Individual Notifications for details.

     • Use the Recipients field to specify who will receive a notification email when the rule is triggered. Click to display a pick list containing all email recipients configured in the System | Recipients page. If you want to send an email to someone who is not already configured in the Recipients page, you can also type addresses in manually.

     • Use the Subject field to specify the subject line of the email. If you want to use different subject lines for different recipients, you can click the Add Configuration button and add a second Email notification with a different subject line and set of addressees.

     The figure below shows a configured Email notification:

     

   • Set the following options for a Slack action in the Notification Type: Slack section:

     • Check the Send individual Slack messages for each notification option if you would like to send separate Slack messages for each triggered instance of the rule. If you do not check this option, the System Action Center sends a consolidated Slack message listing all matching events.

       Refer to Consolidated or Individual Notifications for details.

     • Use the Recipients field to specify the Slack channel or user that will receive a message when the rule is triggered.

       You can click to display a pick list containing all Slack recipients configured in the System | Recipients page. You can also manually type in the URL for an incoming webhook that you create in the Slack API.

     The figure below shows a configured Slack notification:

     

     Email and Slack messages both include a summary of the event(s) that triggered the notification and a link back to the Stellar Cyber platform to a location that makes sense based on the type of notification that was generated. You can configure a rule with any combination of email and Slack messages, including multiple destinations.

10. Click Next and review the settings for your notification rule. Use the Back button to go back and correct anything that's not quite right. When you are satisfied, click Submit to add your rule to the list.

    The rule appears in the System Action Center's list and is automatically Enabled.

User Modification rules help you monitor a wide variety of changes and events related to user accounts, giving you a powerful audit trail for identity management.

You can create the following types of User Modification rules:

• Account lockout triggered – This rule is triggered when a user's account is locked out due to excessive failed login attempts.

• Account password change – This rule is triggered when an account's password has been changed.

• New RBAC profile created – This rule is triggered when a new RBAC profile is created.

• New user created – This rule is triggered when a new user account is created.

• RBAC profile deleted – This rule is triggered when an RBAC profile is deleted.

• User RBAC privilege escalation – This rule is triggered when the a user's RBAC profile is changed to one with increased capabilities in the platform (for example, from User to Platform Admin).

• User deleted – This rule is triggered when a user account is deleted.

• User has disabled 2FA – This rule is triggered when two-factor authentication is disabled for a user account.

For all User Modification rules, new notifications are sent every five minutes.

. Use the following procedure to create a User Modifications rule:

1. Click the Create button at the top of the System Action Center and select User Modifications from the dropdown that appears.

2. Select the type of rule you want to create. See the start of this section for a description of the available rule types.

   The Create Notification wizard starts with the Category set to User Modifications and the Type set to the selected rule type.

3. Supply a name for your notification rule in the Name field.

4. Select the Tenant to which the rule applies. By default, All Tenants are selected. Click anywhere in the Tenant) field to display a pick list including all tenants available on the system where you can select the tenant to which this rule applies.

5. You can either accept the system-provided Description or supply your own. The description supplied here appears in the System Action Center's table of rules.

   

6. Click Next.

7. Use the Actions step to specify how this rule notifies you when it is triggered:

   • All rules have In Platform enabled so that triggered instances appear in the Notification Center.

   • Click the Add Configuration button and choose whether to add an Email or Slack action, as illustrated below.

     

   • Set the following options for an Email action in the Notification Type: Email section:

     • Check the Send individual email for each notification option if you would like to send separate emails for each triggered instance of the rule. If you do not check this option, the System Action Center sends a consolidated email listing all matching events.

       Refer to Consolidated or Individual Notifications for details.

     • Use the Recipients field to specify who will receive a notification email when the rule is triggered. Click to display a pick list containing all email recipients configured in the System | Recipients page. If you want to send an email to someone who is not already configured in the Recipients page, you can also type addresses in manually.

     • Use the Subject field to specify the subject line of the email. If you want to use different subject lines for different recipients, you can click the Add Configuration button and add a second Email notification with a different subject line and set of addressees.

     The figure below shows a configured Email notification:

     

   • Set the following options for a Slack action in the Notification Type: Slack section:

     • Check the Send individual Slack messages for each notification option if you would like to send separate Slack messages for each triggered instance of the rule. If you do not check this option, the System Action Center sends a consolidated Slack message listing all matching events.

       Refer to Consolidated or Individual Notifications for details.

     • Use the Recipients field to specify the Slack channel or user that will receive a message when the rule is triggered.

       You can click to display a pick list containing all Slack recipients configured in the System | Recipients page. You can also manually type in the URL for an incoming webhook that you create in the Slack API.

     The figure below shows a configured Slack notification:

     

     Email and Slack messages both include a summary of the event(s) that triggered the notification and a link back to the Stellar Cyber platform to a location that makes sense based on the type of notification that was generated. You can configure a rule with any combination of email and Slack messages, including multiple destinations.

8. Click Next and review the settings for your notification rule. Use the Back button to go back and correct anything that's not quite right. When you are satisfied, click Submit to add your rule to the list.

   The rule appears in the System Action Center's list and is automatically Enabled.