Alerts Settings: SMTP
Use the SMTP tab in the Alerts Settings dialog box to configure e-mail notifications.
To open this dialog box, do either of the following:
•Right-click Alerts in the console tree, and then click Manage.
•Select
Alerts in the console tree, and then click
Manage 
on the toolbar.
•Select Alerts in the console tree; then, in the details pane, right-click SMTP and click Manage.
•Select Alerts in the console tree, and then double-click SMTP in the details pane.
Note: You can define different online vs. offline alert settings. Online alert settings (Regular Profile) apply to client computers that are working online. Offline alert settings (Offline Profile) apply to client computers that are working offline. By default, DeviceLock works in offline mode when the network cable is not connected to the client computer. For detailed information on DeviceLock offline policies, see
DeviceLock Security Policies (Offline Profile). |
DeviceLock uses the Simple Mail Transfer Protocol (SMTP) for e-mail messaging. You can configure DeviceLock Service to automatically send notifications to the specified e-mail address or addresses when alert conditions occur. To configure e-mail notifications, you must do the following:
1. Specify SMTP server and e-mail notification settings.
2. Define the e-mail templates.
DeviceLock comes with ready-to-use e-mail message templates that you can use to define the message content. These templates determine the basic content, format, and structure of e-mail notifications. DeviceLock provides the following templates:
•An e-mail message for administrative alerts.
•An e-mail message for all other alerts.
Each e-mail template contains the following information:
•Message subject - The text used in the Subject line of the e-mail message. The default message subject for administrative alerts is “DeviceLock Administrative Alert”. The default message subject for all other alerts is “DeviceLock Alert”.
•Message body - The text used in the body of the e-mail message. DeviceLock can send either the plain text body or an HTML version of the message body. The message body is the same in both templates and includes static text and macros. The default static text in the message body is “The following event has occurred”. You can use the following predefined macros to insert additional information in the Subject line and/or the body of the e-mail message:
•%EVENT_TYPE% - The class of event: Success for allowed access, Failure for denied access, or Information for administrative events.
•%COMP_NAME% - The name of the computer from which the event was received.
•%COMP_FQDN% - The fully-qualified domain name of the computer from which the event was received.
•%COMP_IP% - The comma-delimited list of all network addresses (IPs) associated with the computer.
•%DATE_TIME% - The date and time when the event was received by DeviceLock Service. The date and time are displayed based on the client computer’s regional and language settings.
•%SOURCE% - The type of device or protocol involved.
•%ACTION% - The user’s activity type.
•%NAME% - The name of the object (file, USB device, etc.).
•%INFO% - Other device-specific information for the event, such as the access flags, device names, and so on.
•%REASON% - The cause of the event.
•%USER_NAME% - The name of the user associated with this event.
•%USER_SID% - The security identifier (SID) of the user associated with this event.
•%PROC_NAME% - The name of the process associated with this event.
•%PROC_ID% - The identifier of the process associated with this event.
•%EVENT_ID% - The number identifying the particular event type.
•%SUMMARY_TABLE% - A table detailing individual events for aggregated alerts.
These macros are replaced with their actual values at the message generation time.
Complete the SMTP tab as follows:
•Connection - Configure the e-mail server connection information for notification e-mails.
•SMTP host - Specify the SMTP server host name or IP address.
•Port - Specify the port number through which e-mail is sent to your e-mail server. The default port is 25.
Note: Both non-SSL (unencrypted) and SSL connections to the specified SMTP server are supported. DeviceLock automatically identifies encrypted connections and their type. |
•Security - Set the SMTP security options.
•Server requires authentication - Specify the type of authentication to use with the SMTP server. Select the Server requires authentication check box to specify basic authentication. Clear the Server requires authentication check box to specify no authentication.
•User name - Specify the user name to use for authentication with the SMTP server. This property requires a value if you specified basic authentication.
•Password/ Confirm password - Specify the password to use for authentication with the SMTP server. This property requires a value if you specified basic authentication.
•Options - Define the e-mail sender and recipients.
•Sender address - Specify the e-mail address from which the alerts will be sent.
•Recipients addresses - Specify the e-mail addresses of e-mail recipients (those who will receive the e-mail notification of events). Multiple e-mail addresses must be separated by a comma (,) or semicolon (;).
•Edit Message - Customize the predefined contents of the e-mail message for alerts based on the template.
In the E-mail Message for Alerts dialog box that opens you can also do the following:
•Change the message format for all messages to HTML or plain text. To do so, click either Text or HTML. By default, e-mail messages are sent in plain text format.
•Load the specified message body from a tab-delimited text file (.txt). To do so, click Load. The entire contents of the file are loaded. The text can be either plain text or HTML as needed.
•Restore the default settings. To do so, click Restore Defaults.
•Edit Admin. Message - Customize the predefined contents of the e-mail message for administrative alerts based on the template.
In the E-mail Message for Administrative Alerts dialog box that opens you can also do the following:
•Change the message format for all messages to HTML or plain text. To do so, click either Text or HTML. By default, e-mail messages are sent in plain text format.
•Load the specified message body from a tab-delimited text file (.txt). To do so, click Load. The entire contents of the file are loaded. The text can be either plain text or HTML as needed.
•Restore the default settings. To do so, click Restore Defaults.
•Threshold - Specify the time interval (in hours, minutes and seconds) used for event consolidation when generating alerts. DeviceLock Service consolidates multiple similar events occurring within the threshold time and generates a summary in a single alert if all of the following conditions are true:
a) The events are of the same type (Success, Failure, or Information).
b) The events are associated with the same device type/protocol.
c) The events are associated with the same user.
d) The events are associated with the same PID.
The default value is 10 minutes.
Note: DeviceLock Service combines only access-related events when generating alerts. Administrative events are not consolidated. |
•Test - Send a test e-mail notification to verify that DeviceLock Service is configured correctly. This test operation can have two different outcomes, each resulting in a different message being displayed:
•The test can complete successfully, meaning that a test e-mail notification was successfully sent using the configured e-mail notification parameters. The resulting message states: “Test SMTP alert was successfully sent.”
•The test can fail, meaning that a test e-mail notification was not sent. The resulting message states: “Test SMTP alert was not sent due to error: <error description>.”
Below is an example of the e-mail alert.
DeviceLock Alert
The following event has occurred:
Event type: Failure (16)
Computer: WIN7X64
Date/Time: 09/11/12 18:24:38
Source: Removable (2)
Action: Write
Name: E:\Market research.docx
Info:
Reason: Rule: “Confidential data” (Matched: All keywords)
User name: Win7x64\Administrator
User SID: S-1-5-21-3601177953-2830843172-1403898981-500
Process name: C:\Windows\Explorer.EXE
Process Id: 456
Event id: 13
Note: Field names in an e-mail alert correspond to field names in the Audit Log. |
