Alerts - Protection Violation
The Alerts - Protection Violation page triggers an alert when a file is changed or access violation detected on a managed machine. Options include Distributed file changed on agent and was updated, File access violation detected, and Network access violation detected.
Passing Alert Information to Emails and Procedures
The following type of alert emails can be sent and formatted:
Note: Changing this email alarm format changes the format for all
The following variables can be included in your formatted email alerts and in procedures.
Click Apply to apply parameters to selected machine IDs. Confirm the information has been applied correctly in the machine ID list.
Click Clear to remove all parameter settings from selected machine IDs.
If checked and an alarm condition is encountered, a ticket is created.
If checked and an alarm condition is encountered, an agent procedure is run. You must click the select agent procedure link to choose an agent procedure to run. You can optionally direct the agent procedure to run on a specified range of machine IDs by clicking this machine ID link. These specified machine IDs do not have to match the machine ID that encountered the alarm condition.
If checked and an alarm condition is encountered, an email is sent to the specified email addresses.
Distributed file changed on agent and was updated
File access violation detected
If checked, an alert is triggered when an attempt is made to access a file specified as blocked using Audit > File Access.
Network access violation detected
If checked, an alert is triggered when an attempt is made to access either an internal or external internet site using an application specified as blocked using Audit > Network Access.
Select All/Unselect All
Click the Select All link to check all rows on the page. Click the Unselect All link to uncheck all rows on the page.
These icons indicate the agent check-in status of each managed machine:
Online but waiting for first audit to complete
Agent online and user currently logged on. Icon displays a tool tip showing the logon name.
Agent online and user currently logged on, but user not active for 10 minutes
Agent is currently offline
Agent has never checked in
Agent is online but remote control has been disabled
The agent has been suspended
Click a row's edit icon to populate header parameters with values from that row. You can edit these values in the header and re-apply them.
The ATSE response code assigned to machine IDs or SNMP devices:
A comma separated list of email addresses where notifications are sent.