MyZapp watches certain security events and raises an alert when one of them occurs. Every alert is kept, and administrators receive a notification with a link to the alerts screen.
What raises an alert
Two rules are active from installation:
- Burst of failed sign-ins: 20 or more failures in 5 minutes from the same IP address, whatever the account targeted. Only one alert per address during those 5 minutes.
- Member added to a privileged group: an account is added to the Administrators group, by hand or by a synchronization.
Other rules can be enabled by the instance operator: two-factor authentication exemption granted, two-factor authentication of an account reset, mass export by the same account, audit log integrity fault, audit anchor export failure, no encryption key at startup, SIEM sending late. Thresholds, privileged groups and the group notified are also set in the server configuration.
An alert never contains a password, a code or any content: only the rule, the date, the accounts, groups or addresses concerned, and counters.
Review and acknowledge
The Security alerts screen is in the Administration › Instance and operations › Audit menu. It is reserved for Administrators by default.
It first shows the alerts To review; the All filter also shows those already acknowledged. For each alert: the date, the rule, the severity (Information, Warning or Critical), the source module and the details.
Once the alert has been reviewed, type in the What was done field what you found or decided (for example "address blocked at the firewall" or "expected addition, requested by management"), then click Acknowledge. The comment is required. The acknowledgment, with its date, author and comment, remains displayed and can no longer be changed.