Creating event notifications

You can create event notifications that the user will see on their Android or iOS device. Notifications are sent via push notification, SMS, or email, and only apply to app compliance policy violations.

In the context of MTD threat detection, notifications for server-initiated compliance events are governed and controlled by MTD console. When MTD console detects a non-compliant event, it generates a compliance action, and sends a message to the affected devices. This is a separate process from compliance notification for Local Actions policy.

Before you begin 

Be sure you have completed Defining an MTD security policy in Ivanti EPMM.

Procedure 

  1. In the Ivanti EPMM Admin Portal, select Logs > Event Settings.
  2. Select Add New > Policy Violations Event. The New Policy Violations Event dialog box opens.
  3. Enter a descriptive name in the Name field, such as MTD – ExploitDetected.

  4. Scroll down to the Security Policy Triggers section. Select the following fields under the App Control - All Platforms heading:

    1. Disallowed app found
    2. App found that is not in Allowed Apps list.
    3. Required app not found

  5. For iOS devices, scroll down to the iOS section. Select the following fields:

    1. Disallowed iOS model found
    2. Disallowed iOS version found
    3. Compromised iOS device detected
    4. iOS Configuration not compliant
    5. Restored Device connected to server
    6. iOS Location-Based Wakeups disabled by user
    7. Device MDM deactivated (iOS 5.0 or later)

  6. For Android devices, scroll down to the Android section. Select the following fields:

    1. Disallowed Android OS version found
    2. Compromised Android device detected
    3. Device administration not activated for DM client or agent
    4. Attestation Failed

  7. For both iOS and Android devices, scroll down to the Actions section. Under the Alert Configuration heading, configure the following options:

    1. Select the radio button next to Limited under Maximum Alerts.
    2. Select the 1 day pull-down menu under Alert Every.
    3. Select None or User Only for the Send SMS field.
    4. Select User only or User + Admin for the Send Through Push Notification field.
    5. Move a label, such as "MTD--ExploitedDetected," from the Available to the Selected columns in the Apply to Labels field.

  8. Click the Create button next to the Template field. The Add New Event Center Template dialog box opens. Enter the following fields:

    1. Enter a name for the template in the Name field. For example, use MTD-ExploitedDetected as a template name.

    2. Select a language with the pull-down menu for the Edit Template For field.

      Figure 1. Add New Event Center Template window

  9. (Optional) In the Message field, enter text for alerts generated by violations of the compliance policy rule.

    Table 10.   Event Center Variables Support
    Type Variables Supported

    Email Subject

    Email Body

    SMS

    APNS

    $SEVERITY - The defined severity of the system event, for example, Information, Warning, or Critical.

    $PHONE_NUMBER - The phone number used by the device.

    $USER_NAME - The display name of the user associated with the device.

    $DEFAULT_POLICY_VIOLATION_MESSAGE - The hard-coded message associated with the policy violation that triggered the alert.

    Custom attribute variable substitutions are not supported.

  10. Click Save to save the template. The New Policy Violations Event page displays.
  11. Click Save.

Next steps 

Proceed to Configuring the MTD console Mobile Threat Response Policy.