Setup Login Alert for Break Glass account

[Jordan]

Hello,

I am configuring a breakglass Admin account on QTS 5.7.8.2823.

This account will not implement MFA, and should only be used where the per-user assigned MFA accounts fail.

My concern is that I need alerting when this account is used to access the system (specifically the Admin web interface).

I attempted to create a Notification Event:

• Notification Center → Event Notification Rule
• Event Category: Users
• Severity Level: All + Keyword filter for breakglass account username

This does not appear to trigger the alert. How can I accomplish this?

Thank you

[Yvette]

Hello, I think this FAQ may be useful to you:

How do I send notifications for access logs and logs from a remote QuLog Center?

[HanzSung]

This is what I did based on above document.
My admin account is “qnanp” , and I wants it only notify me when that account logins webUI (Administration)

In QuLog Center > Notification Settings

The text of Accessed Resources can be found in Access Logs.

After the criteria is set, as a shortcut press the “Configure Notification Rule” at top of the page, and it will open notification center with “Log filter Criteria” ticked by default.

Continue setting up the notification method. And it should work. I use email and the content should look like this

[Jordan]

Thank you Yvette and HanzSung,

I created the QuLog rule and associated notification center entry, but a notification event does not appear to trigger. I’m not sure what I’m missing.

I greatly appreciate any advice you can give!

QuLog Notification Setting
I threw in additional connection protocols for good measure

QuLog Access Logs

Notification Center Rule:

Notification History (Queue is Empty)
No mention of the login event

[HanzSung]

Hi,

When I am setting up the notification rule, I did not tick any option from Users. While you choose “General” & “Login and Security”

Could you try to remove the “User(2)” part in Event Notifications?