admin-level-user-password-changed-email-alert.adoc

Send email alert on successful admin-level user log in.

Task: fire an email alert to admin@yurisk.info each time admin-level user’s password is changed.

Note	Make sure you have SMTP mail server configured under config system email-server

Replace admin@yurisk.info and fgt@yurisk.info values with your own.

• Trigger:

config system automation-trigger
    edit "AdminPasswdChanged"
        set event-type event-log
        set logid 44547
        config fields
            edit 1
                set name "cfgpath"
                set value "system.admin"
            next
            edit 2
                set name "cfgattr"
                set value "password[*]"
            next
        end
    next
end

• Action to send email:

config system automation-action
    edit "AdminPassChange_email"
      set action-type email
        set email-to "admin@yurisk.com"
        set email-from "fgt@yurisk.com"
        set email-subject "Admin user %%user%% password was changed"
        set message "Source IP: %%ui%%
        Time: %%time%%"
    next
end

• Stitch:

config sys automation-stitch
    edit "AdminLogin_stitch"
        set trigger "AdminPasswdChanged"
        config actions
            edit 1
                set action "AdminPassChange_email"
                set required enable
            next
        end
    next
end

• Example email alert:

Subject: Admin user secretuser password was changed

Source IP: GUI(82.6.18.28)
Time: 12:22:08