Topics

Bob has left the company. However, it is suspected that his Notes ID file is still being used. The Notes administrator creates an Intrusion Detection Monitor to find out when Bob's user id will attempt to access the Domino Server

To create an Intrusion Detection Monitor for the above case:

1. Open the SecurTrac Configuration Database (SCTCFG.NSF).
2. In the left pane, select .
3. Click the button on the action bar.
4. In the section of the 'Basics' tab', select 'All in the domain'.
5. In the section of the 'Basics' tab', select 'Central Log Database'.
6. In the click the pre-defined event list and select "New User Session"
7. In the 'Event Description' field, a description will automatically be added.
8. In the 'Event Wording' field, the required syntax will automatically be added.
9. In the section on the 'Administration' tab, specify the Owner and Administrators for the monitor. Either type in user name directly or look-up from the Domino Directory. (To type in user names, multiple entries are allowed ONLY for the 'Administrators' field. You should separate the entries by using a comma ' , '.).
10. Click the button at the top of the form to save the configuration and to activate the Intrusion Detection monitor.

To view the log in Intrusion Detection Monitor for the above case:

1. Open the SecurTrac Central Log Database (SCTLOG.NSF).
2. In the left pane, select .
3. In the right side pane, a list of intrusion detection logs will be shown. These logs are sorted by date and time.
   
   
   
4. See if there is any event log beginning with "New User Session ".
5. Double click the event log to see the details of the log.