If this rule triggers
The If this rule triggers parameter specifies the following additional actions to be performed when the rule triggers:
•Send Alert - Specifies that an alert is sent whenever the rule triggers. DeviceLock sends alerts on the basis of alert settings. These settings specify where and how the alerts should be sent. Before enabling alerts for a specific firewall rule, you must configure alert settings in
Service Options (see
Alerts).
•Log Event - Specifies that an event is logged in the Audit Log whenever the rule triggers.
The Audit Log Viewer displays the following information about the event:
•Type - Success if traffic allowed by the firewall, Failure if traffic denied by the firewall.
•Date/Time - The date and time that the event occurred, in the following format: dd.mm.yyyy hh:mm:ss. Example: 05.06.2012 14:54:46. For allowed traffic - the date and time that the connection started. For denied traffic - the date and time that the packet was dropped.
•Source - The type of the protocol involved: IP
•Action - The user’s activity type: either Incoming Connection or Outgoing Connection
•Name - Contains no information.
•Information - The IP address with the port number and the fully qualified domain name (FQDN) of the remote host. Example:
Remote host: 192.168.100.10:99 (mycomputer.mygroup.mydomain.com)
•Reason - The cause of the event: IP Firewall: “<rule_name>”
•User - The name of the user associated with this event, in the following format: <domain_name>\<user_name>.
•PID - The identifier of the process associated with this event. Example: 4420
•Process - The fully qualified path to the process executable file. Example: C:\Program Files\AppFolder\AppName.exe