Excessive Activity Report - Who to email

[Justin]

I have been searching for a way to limit who gets these emails. I don't want every Security Administrator regardless of what they have access to as a Security Administrator to get these emails. This is for this event:

System Settings -> email alerts & options:

Alert Security Administrators if there are an excessive number of events (from a single user) for Viewing, Copying or Exporting Passwords. Alert if the following condition is met:

 

Is there a way to be able to setup a specific group of administrators that can be sent these emails?

[DOF]

Did you ever get any feedback from this?

The templates have “Also send emails To” but they also need to have “Only send emails To”. I am in the same boat, I only want emails to go to a shared email address, not all the security administrators.

[Justin]

No, I didn't get any feedback about this yet 😓. It's annoying when 20 people get an email individually, instead of going directly to our security team to investigate. 

[Scott McInness]

@Justin You should be able to use Email Notification Groups to do this. Email Notification Groups are cumulative, with disabled winning over enabled, so they'll work with existing Notification Groups if you already use them. Try creating a Notification Group with the excessive activity report disabled, leaving everything else enabled, then assign it to the administrators whom you don't wish to receive the notifications and that should achieve what you're after.

 

@DOF You should be able to do the same thing, by creating a Notification Group with the excessive activity report disabled but assign it to your administrators group or all of your groups (since All Users and Security Groups isn't an option), then enter the shared email address in the Also send emails To field.