Knowledge Packs

RSA SecurID

OverviewResources

EventTracker monitors all the RSA SecurID events which are given below.

Security – Admin login failure, a user authentication details, critical system events like (system shutdown, user accessed with insufficient privilege and DOS attack detection, etc.)
Operation – Admin activities, configuration update, policy changes.
Compliance: User authentication success, admin role modification.

Compliance

Reports

RSA SecurID - Admin login activities – This report gives detailed information on console admin login and logout.
RSA SecurID - User authentication activities – This report gives detailed information on authentication user along with the agent and policy.

Operations

Alerts

RSA SecurID: Replication failed - This alert is generated when the port shuts down due to replication failed event occurs.
RSA SecurID: System state change – This alert is generated when the system starts, or shutdown event occurs.

Reports

RSA SecurID - Admin activities – This report gives information about the administrative activity events occurred on RSA authentication manager.
RSA SecurID - Policy details – This report gives detailed information on policy changes, new polices added or deleted.

Security

Alerts

RSA SecurID: Account lockout - This alert is generated when an account lockout event occurs.
RSA SecurID: Authentication failed - This alert is generated when an authentication failure event occurs.
RSA SecurID: Database or directory access failure - This alert is generated when a database access failure event occurs.
RSA SecurID: Passcode reuse - This alert is generated when a passcode reuse event occurs.
RSA SecurID: PIN changed attempt failed - This alert is generated when PIN changed attempt failed event occurs.
RSA SecurID: SMS passcode reuse - This alert is generated when an SMS passcode reuse event occurs.
RSA SecurID: Denial of service attack detected – This alert is generated when RSA detects the DOS attack.
RSA SecurID: Console admin logged in – This alert is generated when the console admin logged event occurs.
RSA SecurID: Console admin logged in – This alert is generated when console admin login failure event occurs.

Reports

RSA SecurID - User authentication failed – This report gives detailed information on user authentication failed with agent details.
RSA SecurID - User account lockout details – This report gives information on user details which were locked due to lockout policy.
RSA SecurID - Critical events-This report gives information on the most critical or important events noticed that occurred in the RSA authentication manager (i.e.) DOS attack detected, the command executed.

Scope

The configuration details are consistent with EventTracker version 9.x and later, and RSA Authentication Manager v8.x or later should be installed.

Documentation:

For more information please refer the RSA SecurID Integration guide

To configure RSA SecurID to send logs to EventTracker, refer the How to Guide.