Approve or Deny SmartResponse Actions in the Client Console

SmartResponse actions are approved or denied from the Alarm List accessed via the Alarm Viewer or Personal Dashboard.

To approve or deny an action:

1. Access the SmartResponse action with one of the following:

   • Alarm Viewer

     1. On the Tools menu, click Monitor, and then click Alarm Viewer.

     2. Specify your criteria to open the Alarm Viewer window.

   • Personal Dashboard

     1. On the main toolbar, click Personal Dashboard.

     2. Click the Alarm List tab.

2. Review the Action Status, which can have one of the following values:

   • Approve/Deny. The action needs to be either approved or denied.

   • Pending. The action has been scheduled and is pending review. Individuals with a valid email address specified in their person record will be emailed the pending approval notification.

   • Executed. The action has been executed.

   • Denied. An Approver denied the action.

   • Failed to Execute. LogRhythm was unable to run the action. See the LogRhythm ARM logs for details.

   • [blank]. The rule does not have an action specified and therefore is not valid for the rule.

3. Approve or deny an action for an alarm:

   1. Check the Action check box for the alarm or alarms.

   2. From the context menu, select Action, click SmartResponse Action, and then:

      • To approve the action, select Approve.

      • To deny the action, select Deny.

   The Action Status changes as appropriate. If an individual has a valid email address within their contact method in their person record, an email notification is sent.