Get an email alert from CPPM when we see "n" failed auth within "x" minutes
This article talks about alerting admin ( vai email) if we see "n" number of auth failures within a defined interval.
This has been tested on CPPM 6.4 and older.
First we need to add SMTP host to insight module for the email alerting to work. Please refer to this article for more information about this.
Then navigate to Alerts tab and click on "add Alerts"
In the above screen capture, please enter the necessary details.
We can select the default template for WebAuth failures also.
Make sure that we use "AND" condition as combination algorithm.
The above alert will send an email if CPPM sees 500 radius authentication failures in span of 5 minutes.