Notification Profiles

What Are Notification Profiles?

Notification Profiles are the profiles that define the thresholds at which an alarm is produced for the operator from the access statistics of a vService with AGS enabled and the channels to which the alarms are carried. Four thresholds are monitored: the number of failed logins per minute, the number of failed MFAs per minute, the number of accounts with an active lock and the number of verified sessions; each threshold is turned on with its own switch and a threshold that is off is not monitored. The alarms are sent to the e-mail addresses and the SMS numbers listed in the profile, as an SNMP trap and as an interface notification. The profile also manages the status alarm of the access engine and the e-mail to be sent to the user on every login.

The profile is selected from the Notification Profile field in the AGS settings of the vService; each vService uses a single profile and the alarms are produced on a vService basis. This screen has no built-in profile; on the vServices for which no profile is selected, only the engine status alarm works, as an interface notification.

4

Thresholds

Failed logins/min · Failed MFAs/min · Active locks · Verified sessions

4

Channels

E-mail · SMS · SNMP Notification · UI Notification

60 s

The Rate Window

The failed login and MFA rates are calculated with the total of the last 60 seconds

Engine

The Engine Status Alarm

It works as an interface notification even if no profile is selected; if a profile is selected, it is sent with the channels of the profile

How does it work?

1. The profile is defined on this screen: the thresholds to be monitored are turned on, the recipient e-mail addresses and SMS numbers are entered and the SNMP and interface notifications are selected.
2. The profile is selected from the Notification Profile field in the AGS settings of the vService.
3. TR7 evaluates the access statistics of the vService continuously: the rate thresholds are compared with the total of the last 60 seconds and the counter thresholds with the instantaneous value. When the threshold is exceeded, an alarm is produced, and when the value returns to normal, a return-to-normal notification is sent.
4. The notifications are carried to the channels in the profile; the interface notifications are listed on the Notification Logs screen.

Operational Best Practices

• The thresholds according to the traffic. The failed login rate must be selected above the ordinary wrong password volume of the organization and at a level that catches brute force attempts; the suggested values that come when the threshold is turned on are 30/min for the failed logins and MFAs, 10 for the locks and 1000 for the sessions.
• Channel redundancy. On critical services e-mail or SNMP must be used in addition to the interface notification; SMS is not sent between 22:00 and 08:00 if the Mute Night Notifications setting on the Notification Management screen is on.
• The recipients in the profile. The recipients are taken not from the contact groups on the Notification Management screen but directly from the E-mail and SMS lists in the profile; the address changes must be made in the profile.
• The sign-in e-mail to the user. When E-mail User on Sign-in is turned on, the accounts must have an e-mail address; no e-mail is sent to the users who have no address.
• The vServices before deleting. The delete confirmation does not show the usage locations; the vServices that use the profile must be checked on the Used in tab in the preview.

How to Add?

A new Notification Profiles profile is added through the TR7 web management interface with the following steps:

1. The Configuration Menu is opened by clicking the TR7 logo at the bottom left.
2. The AGS → Integrations → Notification Profiles → Add steps are followed.
3. A unique and descriptive name is entered for the profile.
4. The thresholds to be monitored are turned on and their values are determined; the recipients and the channels are selected.
5. The profile is added by clicking the Add button.

TIP

Reaching the page via quick search

Instead of navigating the menu step by step, the related page is reached directly by using the search bar in the bottom left corner of the screen. The search bar opens with the Alt + T shortcut on Windows and Opt + T on macOS; typing the name of the feature being searched for is then sufficient.

The created profile is used in the Notification Profile field of one or more vServices with AGS enabled. The profile is also defined without leaving the vService settings with the add icon next to this field; the created profile comes selected in the field.

Notification Profiles Listing Screen

The list of all Notification Profiles profiles that are added on the TR7 device is reached by following the AGS → Integrations → Notification Profiles path. Profile adding, editing and deleting operations are performed on this screen.

Notification Profiles Profiles Listing Form

The table opens with the following columns by default:

Column	Description
Notification Profile Name	The name of the profile.
E-mail	The number of the e-mail recipients in the profile (Total of N); - if there is no recipient.
UI Notification	The state of the interface notification: Enabled or Disabled.
SNMP Notification	The state of the SNMP trap sending: Enabled or Disabled.
E-mail User on Sign-in	The state of the sign-in e-mail to the user: Enabled or Disabled.

There is no column that is hidden by default. The table is not sorted when it opens; when a column header is clicked, first a descending and then an ascending sort is applied, and on the third click the sort is removed.

The items in the toolbar are arranged from left to right in the following order; the last two items (Page Information and Page Size) are located in the information strip below the table.

Columns

Which columns are shown in the table is selected; all five of the columns come on. In the same panel the columns are reordered by dragging and the alignment is selected per column; the row height is fitted to the page with the Fit rows to the page button and the column layout is returned to the default with the Reset button. When the width badge next to a manually widened column is clicked, the column returns to the automatic width.

Filter

The Filter button is used to filter the profiles shown in the list according to certain criteria. There are four cards in the filter strip; the number next to the card name shows how many different values are found for that card in the profiles in the list:

Card	What it filters
UI Notification	By the state of the interface notification (Enabled / Disabled).
SNMP Notification	By the state of the SNMP trap sending (Enabled / Disabled).
E-mail User on Sign-in	By the state of the sign-in e-mail to the user (Enabled / Disabled).
Used in	The vServices that use the profiles and the Unused Entries value, which lists the profiles that are not used anywhere.

Export

The table is exported as Excel, CSV or PDF by clicking the Export button. In the window that opens, the Filename, Format and Data Source, together with the Columns to be exported, are determined; the remaining fields are displayed according to the format: CSV Separator for CSV, Excel Sheet Name for Excel, and Page Orientation and Page Size for PDF.

Add

By clicking the Add button, the form for creating a new profile opens in the Add tab.

Edit

By clicking the Edit button, the edit form of the selected profile opens in the Edit tab. The button becomes enabled only when a single profile is selected.

The edit form is the same as the add form; all the fields including the name are changed and the button at the bottom of the form carries the name Edit. The change is saved without asking for confirmation.

Delete

When one or more profiles are selected and the Delete button is clicked, the related profiles are deleted. Before deleting, the "Are you sure?" confirmation is asked for.

WARNING

A profile that is in use can also be deleted and the confirmation window does not show the usage locations.

The Notification Profile reference is not cleared automatically on the vServices that use the profile; since the profile cannot be found, the threshold alarms stop and the engine status alarm continues only as an interface notification. The settings canvas shows the sentence "No notification profile is selected — the engine-status alarm still fires"; when the AGS settings of the vService are opened again, the invalid selection is cleared. The delete operation is written to the user operation record.

Search

Used to search all information in the table.

RegExp Search

Used to search all the information in the table with a regular expression (RegExp). While the usage filter is active, this button is hidden.

Column Based Search

Used to perform a column-based search on the information in the table.

Usage Filter

Used to filter to which vServices the profiles are bound. While the filter is active, a selector takes the place of the search box; when the icon is clicked again, the search box returns.

Page Information

Contains information about the total number of defined profiles and the number of profiles displayed in the list: Showing N-M of T records and the number of selected profiles (N selected, or Nothing selected when there is no selection).

Page Size

The maximum number of profiles to be displayed on the page is selected. On this screen the default is 100; the options are 5, 10, 20, 50, 100, 200, 500 and All.

Right-Click Menu

When a row is right-clicked, a menu with the profile's name in its title opens. Both operations in the menu apply only to the right-clicked profile; a selection made in the list does not affect the menu.

Operation	What it does
Edit	Opens the editing form of the profile in the Edit tab; it is the same as the form opened by the Edit button in the toolbar.
Delete	Deletes the right-clicked profile; the same confirmation question as the deletion in the toolbar is displayed.

Preview of the Selected Profile

When a row in the list is clicked, the preview of the profile opens on the right of the screen; when the selected row is clicked again, the panel closes. The header contains the bell icon, the name of the profile and the Notification Profile subtitle, and the single operation is at the top right.

Preview of the Selected Profile

Operation	What it does
Edit	Opens the editing form of the profile in the Edit tab.

There are three tabs in the panel; Used in is displayed only if the profile is used on at least one vService:

Details

Lists the settings of the profile row by row (the table below).

Log

Lists the user operations on the profile (adding, editing, deleting) as a timeline.

Used in

Lists the vServices that use the profile. The badge next to the tab name shows the usage count.

The rows in the Details tab are as follows, in order:

Row	Description	Visibility condition
Notification Profile Name	The name of the profile.	Always
Engine Status Alarm	The state of the access engine status alarm: Enabled or Disabled.	Always
Failed Authentication Threshold (per Min)	The failed login threshold per minute.	If the threshold is on
Failed MFA Threshold (per Min)	The failed MFA threshold per minute.	If the threshold is on
Active Lockout Threshold	The threshold of the accounts with an active lock.	If the threshold is on
Authenticated Session Threshold	The verified session threshold.	If the threshold is on
E-mail	The e-mail recipients.	If the list is filled
SMS	The SMS recipients.	If the list is filled
SNMP Notification	Enabled or Disabled.	Always
UI Notification	Enabled or Disabled.	Always
E-mail User on Sign-in	Enabled or Disabled.	Always
Sign-in E-mail Subject	The subject line of the sign-in e-mail.	If it is filled

Profile Add Form

A new Notification Profiles profile is added on the TR7 device by following the AGS → Integrations → Notification Profiles → Add steps.

Notification Profiles Profile Add Form

INFO

Notification Profile Name Required

The name of the profile; it identifies the profile in the selection in the vService settings and in the logs. The name must be unique on the device; a second profile with the same name is not saved and the Name is used warning is displayed. When it is left empty, the Required field warning is displayed.

INFO

Failed Authentication Threshold (per Min) Default: Disabled

When the switch is turned on, a number field is displayed and comes with the value 30; an integer of at least 1 is entered. When the number of failed logins in the last 60 seconds on the vService exceeds this value, an alarm is produced. While the switch is off, the failed login rate is not monitored.

INFO

Failed MFA Threshold (per Min) Default: Disabled

When the switch is turned on, a number field is displayed and comes with the value 30; an integer of at least 1 is entered. When the number of failed MFAs in the last 60 seconds on the vService exceeds this value, an alarm is produced. While the switch is off, the failed MFA rate is not monitored.

INFO

Active Lockout Threshold Default: Disabled

When the switch is turned on, a number field is displayed and comes with the value 10; an integer of at least 1 is entered. When the number of accounts with an active lock reaches this value, the alarm is turned on and stays on until the number drops below the threshold.

INFO

Authenticated Session Threshold Default: Disabled

When the switch is turned on, a number field is displayed and comes with the value 1000; an integer of at least 1 is entered. When the number of verified sessions reaches this value, the alarm is turned on and stays on until the number drops below the threshold.

INFO

E-mail Default: Disabled

When the switch is turned on, the e-mail addresses to which the alarms are sent are entered row by row. The address format is checked on saving; an invalid address is not saved. The recipients are specific to the profile; the contact groups are not used.

INFO

SMS Default: Disabled

When the switch is turned on, the phone numbers to which the alarms are sent are entered row by row. The number format is checked on saving; an invalid number is not saved. If the Mute Night Notifications setting on the Notification Management screen is on, SMS is not sent between 22:00 and 08:00; the e-mail, SNMP and interface notifications are not affected by this setting.

INFO

SNMP Notification Default: Disabled

When it is turned on, the alarms are sent as an SNMP trap.

INFO

UI Notification Default: Enabled

When it is turned on, the alarms are shown as an interface notification and are listed on the Notification Logs screen.

INFO

E-mail User on Sign-in Default: Disabled

When it is turned on, a "new sign-in to your account" e-mail is sent in the language of the user to the user's own e-mail address on every successful login. The sending uses the e-mail settings of the system; the users whose e-mail address is not known are skipped.

Sign-in E-mail Subject Default: Disabled

Displayed while E-mail User on Sign-in is on. When the switch is turned on, the subject line of the sign-in e-mail is entered; when it is left off, the built-in subject translated into the language of the user is used.

INFO

Add

The profile is added by clicking the Add button; the tab closes and the profile is displayed in the list.

Operating Mechanism

INFO

• The evaluation. The profiles are evaluated in the TR7 management process. The rate thresholds (Failed Authentication Threshold, Failed MFA Threshold) are compared every 15 seconds with the total of the last 60 seconds of the failed login and wrong OTP statistics of the vService and an alarm is produced when the total exceeds the threshold; the counter thresholds (Active Lockout Threshold, Authenticated Session Threshold) are compared with the instantaneous value on every statistics update and the alarm is turned on when the value reaches the threshold and is turned off when it drops below it.
• The notification texts. The alarm and return-to-normal notifications are produced with the vService name and the values, for example Failed login rate is high for vService "…": 45/min > 30/min, Failed MFA rate is high for vService "…": 40/min > 30/min, Locked-out account count is high for vService "…": 12 >= 10, Authenticated session count is high for vService "…": 1200 >= 1000 and … is back to normal …. The rate thresholds return to normal when the 60-second total is equal to or below the threshold and the counter thresholds when the value drops below the threshold. If the rate statistics have not formed yet on a new vService, the rate thresholds are not evaluated. The alarms are monitored separately per vService; even if the same profile is used on several vServices, each one produces its own alarm.
• The channels. The interface notification is sent while UI Notification, the e-mail to the E-mail list, the SMS to the SMS list and the SNMP trap while SNMP Notification is on; the SMS sending is not performed between 22:00 and 08:00 if the Mute Night Notifications setting on the Notification Management screen is on. The e-mail and SNMP sending use the general e-mail and SNMP settings of the device. While the cluster connection is healthy, only the first device sends notifications.
• The engine status alarm. When the access engine (the Engine tab) becomes non-working or unresponsive (stopped, not responding, restarting continuously, not created or the session store cannot be reached), the Access Gateway engine of vService "…" is not healthy: …. Visitors are currently served the "Access Gateway is being prepared" page. alarm and, when the engine runs again, the … is running again notification is produced; the degraded and starting states do not produce an alarm. The alarm is sent as an interface notification on the vServices for which no profile is selected and with the channels of the profile if a profile is selected. The alarm is on by default in the profile record; it is not in the form and is turned off with the REST API. On the settings canvas of the vServices that use a profile whose alarm is off, the The engine-status alarm is Disabled warning is displayed.
• The sign-in e-mail to the user. It is sent by the access engine to the user's own address, independently of the administrator channels.
• The vService canvas. The thresholds of the profile are summarized as sentences in the monitoring row of the settings canvas (e.g. "More than 30 failed logins in a minute raise an alarm", "An alarm stays on while 10 or more accounts are locked", "An engine status change raises an alarm", "Users get an e-mail on every sign-in to their account").
• Cluster. The profiles are synchronized between the devices with the LB configuration.
• Logs. Adding, editing and deleting are monitored on the User Logs screen as the notification profile object.

Scope and Limits

INFO

• Permission. The AGS screens depend on the Load Balancer permission area; for a user who does not have the permission the You don't have access to this page card is displayed instead of the page.
• The name is unique. A second profile carrying the same name is not saved.
• There is no built-in profile.
• A single profile per vService; the thresholds are evaluated on a vService basis, there is no total counter.
• The engine status alarm is not in the form; it comes on in the profile record.
• The SNMP trap types. The four threshold alarms are sent with the notification types numbered 19–22 (the failed login 19, the failed MFA 20, the active lock 21, the verified session 22).
• The sending conditions of the sign-in e-mail to the user are not set on this screen.
• Deleting does not perform a reference check; a profile in use is deleted as well.

Usage Locations

Usage location	Field	Purpose
A vService with AGS enabled → AGS Management	Notification Profile	The alarm thresholds and channels of the vService; it is left empty
A vService with AGS enabled → the settings canvas	The monitoring and notification row	The threshold sentences of the selected profile
Settings → Notification Logs	The notification list	The display of the interface notifications