Events and Alarms Created When a User's Status Changes

USM Anywhere enables you to configure alarms to alert you when a user's entity or account status changes. USM Anywhere generates monitoring events that display in the Events List View page. You can see two types of monitoring events related to UBA user status: user status changed and account status changed. From these events, you may configure alarm rules to alert you when these status changes trigger events.

To see events created when a user entity or account status changes

  1. Go to Settings > System Events.
  2. Locate the Event Name filter and select either User Status Changed or Account Status Changed.

    The result displays the filtered events.

  3. Click the event to see its details.

To create alarm rules when a user entity or account status changes

  1. Go to Settings > Rules and either
    • Click Create Orchestration > Create Alarm Rule.
    • Or click Alarm Rules, and then click Create Alarm Rule.
  2. Populate the new alarm rule as described in Alarm Rules.
  3. Under Rule Condition, use the Match dropdown to select system_events.
  4. Click Add Condition.

  5. Select Event Name, then Equals, and then either User Status Changed or Account Status Changed.

    Use the "Account Status Changed" and "User Status Changed" events to configure an alarm to trigger when a user's status changes.

  6. Click Save Rule.
  7. The alarm rule has been created. You can see it from Settings > Rules.