Alerts

This page covers the two modules driving Bastion alerts: alert configuration, which defines the trigger / action pairs applied during sessions, and the history of triggered alerts, which records each occurrence and lets you purge it. It targets the administrator who needs to detect risky behaviors automatically inside sessions and instrument a response (stop, pause, notification, account lock, process kill).

---

Configured alerts

The Alerts module lists the existing alerts. Each alert is made of one or more triggers (conditions evaluated in the session) and one or more actions (the reaction when triggered).

Grid column	Description
Label	Name of the alert.
Triggers	Number of configured conditions.
Enabled by default	Indicates whether the alert is automatically applied to all contracts and direct recording configurations.

Three further columns, grouped under the Actions header, use a tick to show the nature of the actions attached to the alert:

Column	Ticked when the alert holds
Trace	At least one action — every one of them records the trigger in the alert history.
Notify	A Notification Message or Warning Message action.
Act	An action that intervenes on the session: Session Shutdown, Session Pause, Kill process or Lock account.

The grid is paginated (15, 25 or 50 rows per page). Expanding a row displays a textual summary of the triggers.

Add an alert

1. Click the + button.
2. Fill in the Label, optionally check Enabled by default, then add at least one trigger and at least one action.
3. Validate.

Main field	Description
Label	Required. Name shown in the console and in notifications.
Enabled by default	When checked, a confirmation asks whether to apply the alert to every existing contract and direct recording configuration.

Triggers panel

Button	Effect
+	Add a condition.
Edit	Edit the selected condition.
×	Delete the selected condition.

The trigger form exposes a type and a parameter:

Trigger type	Expected parameter
Idle delay	Integer duration in seconds or minutes (unit selectable). Format: non-zero integer.
Process start	Executable name. Forbidden chars: ^ < > " / \| ? * and control chars.
Process end	Executable name only (paths not allowed; \ : also forbidden).
Window appearance	Window title or pattern.
Copy-paste block	No parameter — the condition is binary.
File copy	File path (chars ? * \| < > : " are forbidden).
Key stroke	Keyed text to detect.
URL	URL or pattern to observe. Web-compatible.
SSH action	Command to detect in an SSH session.

Per-session-type compatibility

The form dynamically shows, in a Compatibility banner, the session types compatible with the chosen triggers: RDP, VNC, web or SSH. The URL and ssh_action triggers exclude standard RDP compatibility.

Actions panel

Button	Effect
+	Add an action.
Edit	Edit the selected action.
×	Delete the selected action.

Only one stop / pause action and one notification action may coexist.

Action type	Parameters
Session Shutdown	None.
Session Pause	None.
Notification Message	Message field required (free text).
Warning Message	Message field required (free text).
Kill process	Executable field required.
Lock account	None.

Edit an alert

Select the alert and click the Properties icon (or double-click the row). The form is identical to the add form.

Toggling 'enabled by default'

During an edit, when Enabled by default changes from unchecked to checked, a confirmation offers to force activation on existing contracts and direct recording configurations. Conversely, going from checked to unchecked offers a force deactivation. Without these forcings, only new targets pick up the new state.

Delete an alert

Select one or more alerts and click ×. Deletion requires a confirmation (the message adapts to singular vs plural).

Enable / disable for all

Two toolbar buttons apply a transverse action on the selection:

Button	Effect
Enable for all	Attaches the alert to all existing access contracts and direct recording configurations.
Disable for all	Detaches the alert from all existing contracts and direct recording configurations.

A confirmation is systematically requested. The request is then sent to the server.

---

History of triggered alerts

The History of triggered alerts module records every effective alert trigger. It is reachable from the Alerts toolbar through the History of triggered alerts button.

Column	Description
Date	Trigger timestamp (dd/mm/yyyy - HH:MM format).
Label	Name of the triggered alert.
IP	IP address of the user.
User	Account involved.

Filter the list

A collapsible Filters panel exposes:

Filter	Description
Label	Combo populated with the labels found in the history.
User	Combo populated with the users found in the history.
Start date	Defaults to seven days before the current date.
End date	Defaults to the current date.

The Search and Clear buttons apply or reset the filters.

Purge the history

Clicking × Purge alerts opens a confirmation window with three exclusive options:

Option	Description
Delete all history	Empties the table entirely.
Delete history between	Deletes entries between a start and an end date (defaults: last seven days).
Delete history older than	Deletes entries older than the entered duration. The unit is chosen from the list: hours, days, weeks, months, years.

The Validate button triggers the purge; after confirmation the history and the filter list are reloaded.