INTOUCH^® INSA
Network Security Agent

8.6 Maintaining Page Distribution Lists

A page distribution list can be used to page several persons. For example, you can specify an alert action of "PAGE @distribution_list" (distribution_list is the name of a page distribution list) to cause INTOUCH INSA to page multiple persons when an alert incident occurs.

You can create new page distribution lists and/or maintain current lists. To create or maintain page distribution lists, select the Page Distribution Lists option from the Maintenance menu.

When you select the Page Distribution Lists option, the following screen is displayed:

INTOUCH INSA Page Distribution List Maintenance 08-Mar-1997 +--------------------------------------------------+ | New List | |--------------------------------------------------| | Exit | +--------------------------------------------------+ EXIT = Exit INTOUCH INSA \ = Back HELP = Help

Click on New List to create a new page distribution list.

After lists are created, they are also displayed on this menu and you can select the page distribution list you want to edit.

8.6.1 New List

The New List option allows you to create a new page distribution list. When you select this option, the following is displayed:

INTOUCH INSA Page Distribution List Maintenance 08-Mar-1997 Distribution list name : Distribution list description: Distribution list name? ____________________ EXIT = Exit INTOUCH INSA \ = Back HELP = Help

List Name

Enter the name of the page distribution list you want to create. The name can be up to 20 characters in length.

Enter the name portion only. Do NOT enter a device, directory or type. For example:

Distribution list name? admin_______________

After you enter a list name, the name is displayed in the top section of the screen.

List Description

Enter a short description of the new page distribution list you are creating. The description can be up to 40 characters in length.

Distribution list description? Page list for Administration____________

The description is displayed in the top section of the screen.

Proceed

You are asked if you want to proceed with the file creation.

+-Proceed-+ | Yes | | No | |---------| | Exit | +---------+

Select Yes to create the new page distribution list.

Select No to return to the file description prompt.

Select Exit to abandon the file creation and return to the Maintenance menu.

If you select Yes, you are placed into the INTOUCH INSA editor. The first few lines of the new text file have been created and are displayed. You can use the editor to add names to the list. For example:

!** To exit the editor, while holding down the Ctrl key, press the Z key. !** This will get you to the "Command:" prompt. Type EXIT to exit the !** editor. Type HELP for help. ! ! Page list for Administration fred rocky molly ginger [End of file]

Comments can be included in the page distribution list. Comments are identified with an exclamation mark (!).

When you exit from the editor, you will return to the page maintenance options menu.

NOTE: Each page name in the page distribution list must exist in the page file or an error message will be displayed as shown in the following example:

INTOUCH INSA Page Distribution List Maintenance 08-Mar-1997 Checking distribution list file... The following page names exist in the page distribution list file but do NOT exist in the Page master file: ROCKY MOLLY GINER Press the RETURN key to continue EXIT = Exit INTOUCH INSA \ = Back HELP = Help

8.6.2 Editing Page Lists

If you want to change data in a page distribution list, use the mouse to select the list you want to change. For example, you could select "ADMIN" from the following menu:

+---------------------------------------------------+ | New List | | ADMIN Page list for Administration | | ENGING Allen's Engineering paging dist list | |---------------------------------------------------| | Exit | +---------------------------------------------------+

After you select the distribution list to be changed, you are placed in the INTOUCH INSA editor and the lines of the text file are displayed. You can use the editor to add, change or delete names in the list. You can also use the editor to change the file description.

When you exit from the editor, you are returned to the page distribution list menu.

Deleting a Distribution List

To delete a page distribution list, delete all lines in the file.

8.7 Purge and Archive Records

Over time, as incidents are detected, recordings are created, etc., the INTOUCH INSA files become larger and larger and, at some point, the files need to be purged and, optionally, the records archived. To purge and/or archive incident, recording and/or audit records, select the Purge and Archive Records option from the Maintenance menu.

INTOUCH INSA Purge and Archive Records 23-Jan-1997 +------------------------------------------------------------------------------+ |Records : | |Option : | |Archive name: | +------------------------------------------------------------------------------+ +----------------------------- Selection Criteria -----------------------------+ |Thru date : | |Date range : | |User names : | |Locations : | |Alert names : | +------------------------------------------------------------------------------+ +Select Records-+ | all | |---------------| | Incidents | | Recordings | | Audit Data | |---------------| | Exit | +---------------+ EXIT = Exit INTOUCH INSA \ = Back HELP = Help

Note

Selecting "Exit" from any of the menu prompts or entering "EXIT" at an input prompt stops the purge/archive procedure and returns you to the Maintenance menu.

To back up to previous prompts, use the \ (backslash) key.

Record Selection

When the Purge/Archive option is selected, the "Purge and Archive Records" input screen is displayed, and you are prompted for record selection.

all --- purges and/or archives records from all the files

Incidents --- purges and/or archives incident records

Recordings --- purges and/or archives recording records

Audit Data --- purges and/or archives audit records

A menu list of the record types is displayed.

+Select Records-+ | all | |---------------| | Incidents | | Recordings | | Audit Data | |---------------| | Exit | +---------------+

If you select all to include all of the record types, "ALL" is displayed in the top box, and the next prompt is displayed.

To select a specific record type, use the mouse to select the type you want from the menu of items. The selected record type is displayed in the top box. Select as many record types as you wish.

To remove one of the selected record types, select the Remove Record option. A menu list of the selected record types is displayed. Use the mouse to select the item you want to remove. The item is removed from the list in the top box. Remove as many record types as you wish.

Select the accept current default menu item when you are done selecting (and removing) record types.

Use the reset menu option to erase the current selections and start over.

Your selection is displayed in the box at the top of the screen.

Purge/Archive Processing Option

You can PURGE and/or ARCHIVE the selected records.

+--------Option--------+ | Purge and Archive | | Purge only | | Archive only | |----------------------| | Exit | +----------------------+

Select Purge and Archive to both purge and archive the selected records

Select Purge only to only purge the selected records

Select Archive only to only archive the selected records

Your selection is displayed in the box at the top of the screen.

+------------------------------------------------------------------------------+ |Records : Incidents | |Option : Purge and Archive | |Archive name: | +------------------------------------------------------------------------------+

Archive Name

If you select Purge and Archive or Archive Only, you are asked for an archive name.

Archive name? january96___________

Enter the name you want to use to reference the records you are going to archive. The name you enter is displayed at the top of the screen.

+------------------------------------------------------------------------------+ |Records : Incidents | |Option : Purge and Archive | |Archive name: JANUARY96 | +------------------------------------------------------------------------------+

Purge/Archive Selection Criteria

Before the purge and/or archive can be done, you need to tell INSA Manager which records you want processed. For example, you might want to purge and archive incident records for specific users for a certain time period.

You choose which records to purge and/or archive by providing selection criteria information. One or more of the following options can be selected:

Dates
- Thru Date--purge/archive records which have a date prior to or equal to a specific date
- Date Range--purge/archive records which have a date that falls within a range of specific dates
User Names --- purge/archive records for specific user names
Locations --- purge/archive records for specific locations
Alert names --- purge/archive records for specific alert names

Dates

If you select dates as a purge/archive option, you can specify a "thru date" or a date range, but not both. If you provide a "thru date", you will not be prompted for a date range. If nothing is entered at the "thru date" prompt, you will be prompted for a date range.

Thru Date

You are asked for a purge/archive "thru date".

Purge/Archive records dated thru (MMDDYYYY)? ________

If a purge/archive "thru date" is provided, INSA Manager compares the date to the date in the records. All records which have the same date or a date prior to the input date are selected. For example, if you enter a "thru date" of 01311996 (January 31, 1996), all records containing this date or a date prior to this date, are selected.

If you do NOT want to provide a "thru date", press [Return] and the next prompt is displayed.

The "thru date" is entered in MMDDYYYY format. For example:

Purge/Archive records dated thru (MMDDYYYY)? 01311996

If you enter a "thru date", it is displayed in the "Selection Criteria" box.

Date Range

NOTE: If you entered a purge/archive "thru date", you will NOT be asked for a date range.

Purge/Archive records beginning (MMDDYYYY)? ________

You can purge and/or archive records for a range of dates. If you provide a date range, INSA Manager compares the date in the records to the input dates, and all records which have the same date as the input dates or a date that falls between the two dates are selected. For example, if you enter 01011996 and 01311996, all records containing these dates or a date between these dates are selected.

If you do NOT want to provide a date range, press [Return] and the next prompt is displayed.

If you want to specify a date range, enter the beginning date of the date range. The beginning date is entered in MMDDYYYY format. For example:

Purge/Archive records beginning (MMDDYYYY)? 01011996

If you are specifying a date range, enter the ending date in the date range. The ending date is entered in MMDDYYYY format. For example:

Purge/Archive records ending (MMDDYYYY)? 01311996

If you enter a date range, it is displayed in the "Selection Criteria" box.

User Names

You can purge and/or archive records for specific user names.

User names (AAA,BBB,...)? _____________________________________________________

If you elect to enter user names, INSA Manager compares the user name in the records to the input name(s), and all records that match are selected.

You can enter a single user name or a comma-separated list of user names. You can also use the asterisk (*) character as a wildcard. Here are some examples:

To select user name ALAN, enter:

User names? ALAN

To select user names, ALAN, SUE and GEORGE, enter:

User names? ALAN,SUE,GEORGE

To select the user names that:

begin with A
is DAN
begins with BI
has a Q in it anywhere
ends with T

enter:

User names? A*,DAN,BI*,*Q*,*T

If you do NOT want to specify any user names, press [Return] and the next prompt will be displayed.

If you DO want to specify user names, enter the user names you want to include. For example:

User names (AAA,BBB,...)? tester1,tester2______________________________________

If you enter any user names, they are displayed in the "Selection Criteria" box.

Locations

Locations (AAA,BBB,...)? ______________________________________________________

You can purge and/or archive records for specific locations.

If you elect to specify locations, INSA Manager compares the location in the records to the input location(s), and all records that match are selected.

You can enter a single location/address, or a list of locations separated by commas. You can use the asterisk (*) character as a wildcard. Here are some examples:

To select LAT addresses that begin with LAT 1, enter:

Locations? LAT 1.*

To select IP domain names that end in .COM and IP addresses that end in .3, enter:

Locations? *.COM,IP *.3

For example, if *.COM is entered, all locations ending in ".COM" would be selected.

If you do NOT want to provide any locations, press [Return] and the next prompt will be displayed.

If you DO want to specify locations, enter the locations you want to include. For example:

Locations (AAA,BBB,...)? ax.utw.com___________________________________________

If you enter any locations, they are displayed in the "Selection Criteria" box.

Alert Names

You can purge and/or archive records for specific alert names. A menu list of the alert names is displayed. The alert names come from the alert file.

If you select any of the alert names, INSA Manager compares the alert name in the records to the selected alert names, and all records that match are selected.

+Select Alert Names+ | none | |------------------| | INVALID_LOGIN | | MGMT | | PAYROLL | | PRIV | | URGENT | |------------------| | Exit | +------------------+

If you do NOT want to select any alert names, select the none option and the next prompt will be displayed.

To select an alert name, use the mouse to select the name you want from the menu of alert names. The name is displayed in the "Selection Criteria" box. Select as many names as you wish.

To remove one of the selected names, select the Remove Alert Name option. A menu list of the selected alert names is displayed. Use the mouse to select the name you want to remove. The name is removed from the list in the "Selection Criteria" box. Remove as many names as you wish.

+--Select Alert Names--+ | ... +Remove Alert Name-+ | Remove Alert Name | INVALID_LOGIN | |--------------------| MGMT | | Exit | PRIV | +--------------------+------------------+

Select the accept current default menu item when you are done selecting (and removing) alert names.