Creating and Configuring ISA Server 2004 Alerts - Dr. Tom Shinderamp;#039;s Configuring ISA Server 1002004 [Electronic resources] نسخه متنی

Creating and Configuring ISA Server 2004 Alerts

ISA Server's alerting function means you can be notified of important ISA-related events as soon as they are detected. Rather than coming in to work to find that a hacker attempted to access or attack the system hours earlier, you can find out about it immediately. Or if one of ISA Server's services unexpectedly stops, you can be notified and take the appropriate action to minimize any loss of functionality.

Alert-triggering Events

Alerts can be configured to notify you of any of the following events (the official event name is in parentheses):

An action associated with an alert fails (alert action failure)

The cache container fails to initialize (cache container initialization error)

A cache container is recovered (cache container recovery complete)

An attempt to resize the cache file fails (cache file resize failure)

Cache fails to initialize (cache initialization failure)

Cache content is restored (cache restoration complete)

There is an error in writing cache content (cache write error)

A cached object is discarded (cached object discarded)

An extension component fails to load (component load failure)

There is an error during the reading of configuration data (configuration error)

The connection limit is exceeded by a user or IP address (connection limit exceeded)

The connection limit for a rule (the number of connections per second) is exceeded (connection limit for rule exceeded)

The DHCP anti-poisoning intrusion detection feature is disabled (DHCP anti-poisoning intrusion detection disabled)

A busy line or failure to answer causes a dial-on-demand connection to fail (dial on demand failure)

There is a DNS zone transfer attack (DNS zone transfer intrusion)

Information cannot be logged to the system event log (event log failure)

The Firewall client and the ISA Server service fail to communicate (firewall communication failure)

The FTP filter fails to parse the allowed FTP commands (FTP filter initialization warning)

An attempted intrusion/attack from an outside user is detected (intrusion detected)

A CRL is invalid, expired, or missing (invalid CRL found)

DHCP offers an invalid IP address (invalid DHCP offer)

ISA Server detects invalid dial-on-demand credentials (invalid dial-on-demand credentials)

Credentials for the ODBC database are invalid (invalid ODBC log credentials)

The source address on an IP packet is not valid (IP spoofing)

Configuration changes have been made which require the ISA Server computer to be rebooted (ISA Server computer restart is required)

A log fails (log failure)

A log reaches its storage limits (log storage limits)

The configuration of the network has been changed in a way that affects the ISA Server (network configuration changed)

There are no ports available, resulting in a failure to establish a network socket (no available ports)

The ISA Server is unable to connect to a requested server (no connectivity)

One of the operating system components (NAT, ICS or Routing and Remote Access) presents a conflict with the ISA Server (OS component conflict)

A UDP packet is greater than the maximum size specified in the registry, causing the ISA Server to drop it (oversized UDP packet)

A buffer overflow exploiting the Post Office Protocol (POP) is detected (POP intrusion)

A user is removed from the Quarantined VPN Clients network (Quarantined VPN Clients network changes)

An error occurs while the report summary was being generated (report summary generation failure)

A resource allocation failure, such as insufficient system memory, occurs (resource allocation failure)

A routing (chaining) failure occurs (routing/chaining failure)

A routing (chaining) recovery occurs (routing/chaining recovery)

The RPC filter is unable to use the defined port, which is already being used (Bind failure)

The RPC filter connectivity changes (RPC filter-connectivity changed)

A server publishing rule is not configured correctly (server publishing failure)

A server publishing rule cannot be applied (server publishing not applicable)

A service cannot start (service initialization failure)

A service stops unexpectedly (service not responding)

A service stops properly (service shutdown)

A service starts properly (service started)

The ISA Server's connection to a requested server is slow (slow connectivity)

An SMTP rule is violated (SMTP filter event)

The SOCKS configuration fails because the port is being used by another protocol (SOCKS configuration failure)

There is a SYN attack detected (SYN attack)

An unregistered event occurs (unregistered event)

Upstream chaining credentials are not correct (Upstream chaining credentials)

A VPN client attempts to make a connection and fails (VPN connection failure)

The alert service determines when an event occurs and whether an alert is configured to provide notification or perform some other action. It then initiates the specified notification or other action.

Viewing the Predefined Alerts

You can see the predefined alert definitions by clicking the Alerts tab and opening the task pane if it is not already open. Click Configure Alert Definitions under Alerts Tasks on the task pane Tasks tab. This will open the Alerts Properties dialog box, as shown in Figure 12.11.

Figure 12.11: The Alerts Properties Dialog Box

The Alerts Properties dialog box gives you a graphical representation of the severity of the alert, that is, whether it is an Error, Warning, or Information. You can modify the severity and other properties of the alert from this dialog box. You can also assign a level of severity to any new alert you create.

Creating a New Alert

To define a new alert, click the Add button. This will invoke the New Alert Configuration Wizard, as shown in Figure 12.12.

Figure 12.12: The New Alert Configuration Wizard

As you can see, you'll need to give the new alert a name. Then click Next.

On the next page of the wizard, you need to select an event and any additional conditions that will trigger the alert. The list of events from which you can select matches the list of events we described earlier in this section.

For example, as shown in Figure 12.13, you can select the Log Failure event and then select for the alert to be triggered by the log failure of any ISA Server service, the ISA Server Firewall service, or the ISA Server Web filter.

Figure 12.13: Selecting Events and Conditions to Trigger an Alert

Next, you can assign a category for the alert from the following choices:

Security

Cache

Routing

Firewall Service

Other

On the same page, as shown in Figure 12.14, you need to select a severity level (Error, Warning or Information).

Figure 12.14: Assigning a Category and Selecting a Severity Level for your New Alert

The next page allows you to define what action (if any) will be taken when the specified event and conditions occur. ISA Server can be configured to do any or all of the following when the conditions specified for an alert have been met: :

Send an e-mail notification to yourself or another administrator(s)

Run a program

Log the event to the Windows event log (this option is enabled by default)

Stop selected services on the ISA Server computer

Start selected services on the ISA Server computer

You can select multiple actions. For example, you can select to send an e-mail message and report the event to the Windows event log, as we've done in Figure 12.15.

Figure 12.15: Defining Actions to be Performed when the Alert is Triggered

If you have selected to send an e-mail message, you will be asked to provide the name of the SMTP server to be used and enter 'From' and 'To' addresses for the message. You can send the message to multiple recipients using the CC: field, as shown in Figure 12.16.

Figure 12.16: Sending E-Mail Notification Messages

Similarly, if you select to run a program, you'll be asked to provide a path to the program's executable file and an account to use in running the program, as shown in Figure 12.17.

Figure 12.17: Running a Program when an Alert is Triggered

If you select to stop or start a service, you will be asked to choose the service(s) to stop or start, as shown in Figure 12.18.

Figure 12.18: Stopping or Starting a Service when an Alert is Triggered

When you have configured all the properties for the new alert, the last page of the wizard summarizes the information you entered, as shown in Figure 12.19. Check it over and use the Back button to make any corrections, then click Finish.

Figure 12.19: Completing the New Alert Wizard

The new alert will now show up in the Alerts Properties dialog box, in the Alerts Definitions window, as shown in Figure 12.20.

Figure 12.20: New Alerts Show Up in the Alerts Definitions Window

You can disable an alert here by unchecking its checkbox. You will notice that some alerts are predefined but disabled by default. These include:

Cached object discarded

Event log failure

Network configuration changed

Quarantined VPN Clients network changed

Server publishing is not applicable

SMTP filter event

The rest of the predefined alerts are enabled by default.

You can remove an alert completely by highlighting it and clicking the Remove button. You can refresh the view of the configured alerts after making a change by clicking the Refresh button.

You can rearrange the order of the alerts in the window by clicking the title of the column. For example, clicking the top of the Alerts column will rearrange the alerts in ascending or descending alphabetical order. Clicking the top of the Categories column will rearrange the alerts by category, in ascending or descending alphabetical order.

Modifying Alerts

You can modify the properties of your new alert, or those of any of the predefined alerts, by highlighting the alert you want to modify and clicking the Edit button. This will allow you to change the category and/or severity and disable or enable the alert from the General tab. On the Events tab, you can change the event and additional conditions.

When you modify an alert, you can specify the number of times that the event should occur before an alert is triggered, and/or you can specify the number of times per second that the event should occur before triggering the alert. You can also specify whether, when these time thresholds are met, the alert should be triggered immediately, only if the alert was manually reset, or only if a specified number of minutes have passed since the last execution of the alert. This is shown in Figure 12.21.

Figure 12.21: Modifying an Alert to Specify Time Thresholds

On the Actions tab, you can change, remove or add actions to be performed when the alert is triggered, just as you did when you originally created the alert.

Viewing Triggered Alerts

When you click the Alerts tab in the Monitoring node, the alerts that have been triggered are displayed in the middle pane, as shown in Figure 12.22.

Figure 12.22: Viewing Alerts that have been Triggered

The display shows the alert name, the date and time it occurred, the status, and the category to which the alert has been assigned. Alerts are grouped together by alert type (such as 'Service started'). Click the small square with a + sign to expand a group.

If you click on an individual alert, a detailed description will be displayed in the Alert Information window below the list of recent alerts. Again, this same information appears in the Event Viewer's application log, as shown in Figure 12.23.

Figure 12.23: Event Viewer Application Log Entry Showing Information Displayed in Alerts Windows

The alerts window is automatically refreshed by default at periodic intervals. You can set the refresh rate to one of the following:

None

Low

Medium

High

This is done in the right task pane. You can also force a manual refresh at any time by clicking the Refresh Now icon (refer back to Figure 12.23).

In addition to configuring alert definitions, you can perform the following Alerts Tasks:

Reset selected alerts: You can reset alerts to remove them from the Alerts display. In the middle pane, highlight the alert that you want to reset, and click Reset selected alerts in the right task pane. You will be asked if you're sure you want to reset the alert. Click Yes to do so. The alert will then disappear from the middle pane. You can also reset a whole group of alerts by highlighting the group heading.

Acknowledge selected alerts: You can acknowledge an alert to remove it from the Dashboard view. It will remain in the Alerts window on the Alerts tab, but its status will be shown as 'Acknowledged.' You can use this to indicate that you have seen the alert and are handling it. In the middle pane, highlight the alert(s) you want to acknowledge, and click Acknowledge selected alerts in the right task pane.