# Issue policies

## Definition

Soffid has defined automatic events by default. For each of these events, it is possible to define the tasks to be performed and configure them.

You can find this functionality in the following path:

`<span class="link" id="bkmrk-main-menu">Main Menu</span><span id="bkmrk-%C2%A0%3E%C2%A0"> > </span><span class="link" id="bkmrk-administration">Administration</span><span id="bkmrk-%C2%A0%3E%C2%A0-0"> > </span><span class="link" id="bkmrk-configuration">Configuration</span><span id="bkmrk-%C2%A0%3E%C2%A0-1"> > </span><span class="link" id="bkmrk-security-settings">Security settings</span><span id="bkmrk-%C2%A0%3E%C2%A0-2"> > </span><span id="bkmrk-issue-policies">Issue policies</span>`

The default events are the following;

<table border="1" id="bkmrk-issue-type-descripti" style="border-collapse: collapse; width: 100%; height: 908.2px;"><tbody><tr style="height: 29.6px;"><td class="align-center" style="width: 27.4345%; height: 29.6px;">**Issue Type**</td><td class="align-center" style="width: 72.5408%; height: 29.6px;">**Description**</td></tr><tr style="height: 30.6px;"><td style="width: 27.4345%; height: 30.6px;">account-created</td><td style="width: 72.5408%; height: 30.6px;">This issue is created when the Sync Server detects when a new account is created. This may occur after the Reconciliation process has been executed.

</td></tr><tr style="height: 29.6px;"><td style="width: 27.4345%; height: 29.6px;">disconnected-system</td><td style="width: 72.5408%; height: 29.6px;">This issue is created when the Sync Server detects that some target system is offline. </td></tr><tr style="height: 46.4px;"><td style="width: 27.4345%; height: 46.4px;">discovered-host</td><td style="width: 72.5408%; height: 46.4px;">This issue is created when the Sync Server detects a new host in the network. This only occurs after the Network Discovery process has been executed.

</td></tr><tr style="height: 46.4px;"><td style="width: 27.4345%; height: 46.4px;">discovered-system</td><td style="width: 72.5408%; height: 46.4px;">This issue is created when the Sync Server detects a new system in a host. This only occurs after the Network Discovery process has been executed.

</td></tr><tr style="height: 46.4px;"><td style="width: 27.4345%; height: 46.4px;">duplicated-user</td><td style="width: 72.5408%; height: 46.4px;">This issue is created the system detects that there are duplicate users, or when the task is generated manually from the user management.

</td></tr><tr style="height: 46.4px;"><td style="width: 27.4345%; height: 46.4px;">enabled-account-on-disabled-user</td><td style="width: 72.5408%; height: 46.4px;">This issue is created when an enabled account is detected on a disabled user. This may occur after the reconciliation process has been executed.</td></tr><tr style="height: 46.4px;"><td style="width: 27.4345%; height: 46.4px;">failed-job</td><td style="width: 72.5408%; height: 46.4px;">This issue is created when the system detects job failures. This may occur by running any scheduled task.

</td></tr><tr style="height: 46.4px;"><td style="width: 27.4345%; height: 46.4px;">global-failed-login</td><td style="width: 72.5408%; height: 46.4px;">This issue is created when the number of session start failures exceeds the threshold of 0.8.</td></tr><tr style="height: 29.6px;"><td style="width: 27.4345%; height: 29.6px;">integration-errors</td><td style="width: 72.5408%; height: 29.6px;">This issue is created when the Sync Server detects an integration error between Soffid and an end system. You can check the task in the Monitoring &amp; Reporting. </td></tr><tr style="height: 63.2px;"><td style="width: 27.4345%; height: 63.2px;">locked-account</td><td style="width: 72.5408%; height: 63.2px;">This issue is created when an account has been blocked for exceeding the maximum number of login attempts. You can configure the property *Lock after failures* in the Password policies settings. Even if it is temporarily locked, the incident will be generated.

</td></tr><tr style="height: 29.6px;"><td style="width: 27.4345%; height: 29.6px;">login-different-country</td><td style="width: 72.5408%; height: 29.6px;">This issue is created when Soffid detects a new login from a different country. It only works with the Identity Provider and it is necessary to have the geolocation database updated.

</td></tr><tr style="height: 29.6px;"><td style="width: 27.4345%; height: 29.6px;">login-from-new-device</td><td style="width: 72.5408%; height: 29.6px;">This issue is created when Soffid detects a new login from a new device. It only works with the Identity Provider.

</td></tr><tr style="height: 46.4px;"><td style="width: 27.4345%; height: 46.4px;">login-not-recognized</td><td style="width: 72.5408%; height: 46.4px;">This issue is created when Soffid detects a login not recognized (disabled user or user does not exist) in the Soffid Console or in Soffid as an Identity Provider.</td></tr><tr style="height: 46.4px;"><td style="width: 27.4345%; height: 46.4px;">otp-failures</td><td style="width: 72.5408%; height: 46.4px;">This issue is created when an OTP is blocked for exceeding the number of attempts. Currently blocked with 10 unsuccessful attempts.</td></tr><tr style="height: 63.2px;"><td style="width: 27.4345%; height: 63.2px;">pam-violation</td><td style="width: 72.5408%; height: 63.2px;">This issue is created when any of the rules of the PAM are violated. You can define the PAM rules and the PAM policies. Be in mind, that you must check the "Open issue" option in the PAM policies you wish to control.</td></tr><tr style="height: 46.4px;"><td style="width: 27.4345%; height: 46.4px;">password-changed</td><td style="width: 72.5408%; height: 46.4px;">This issue is created when a Password change is detected. These changes come from the end system (Active Directory or Soffid OpenLDAP) and Soffid has been notified. The issue is not created if it is the operator or a script that changes the password in Soffid.

</td></tr><tr style="height: 46.4px;"><td style="width: 27.4345%; height: 46.4px;">permissions-granted</td><td style="width: 72.5408%; height: 46.4px;">This issue is created when it is detected that permissions have been given to a user on the end system. This may occur after the reconciliation process has been executed.

</td></tr><tr style="height: 46.4px;"><td style="width: 27.4345%; height: 46.4px;">risk-increase</td><td style="width: 72.5408%; height: 46.4px;">This issue is created when it is detected the risk level of a user is increased. You can configure the risks in the Segregation of Duties option.</td></tr><tr style="height: 46.4px;"><td style="width: 27.4345%; height: 46.4px;">robot-login</td><td style="width: 72.5408%; height: 46.4px;">This issue is created when it is detected is detected that someone who has not passed the CAPTCHA is trying to log in to the Identity Provider.</td></tr><tr style="height: 46.4px;"><td style="width: 27.4345%; height: 46.4px;">security-exception</td><td style="width: 72.5408%; height: 46.4px;">This issue is created when unauthorized access to the console via WebService or admin console occurs.</td></tr></tbody></table>

## Screen Overview

[![image-1689689114657.png](https://bookstack.soffid.com/uploads/images/gallery/2023-07/scaled-1680-/image-1689689114657.png)](https://bookstack.soffid.com/uploads/images/gallery/2023-07/image-1689689114657.png)

[![image-1686554911612.png](https://bookstack.soffid.com/uploads/images/gallery/2023-06/scaled-1680-/image-1686554911612.png)](https://bookstack.soffid.com/uploads/images/gallery/2023-06/image-1686554911612.png)

## Related Objects

1. [**Roles**](https://bookstack.soffid.com/books/soffid-3-reference-guide/page/roles "Roles")

## Standard attributes

- **Issue type**: by default, some issues type are defined in Soffid Console.
- **Description**: a brief description of the issue.
- **Action**: 
    - **Ignore**: the action will be ignored, and no additional actions will be run.
    - **Record**: the action will be recorded and an issue with the status Acknowledged will be created. The actions configured for the Acknowledged status will be run.
    - **Manage**: a new issue will be created in the New status and the action configured for this status will be run.
- **Assigned role**: the role who will be the owner of the created issues.
- **Actions list**: list of actions to be taken when this issue occurs. You can choose one or more actions from the list and configure them: 
    - **Issue status**: it is used to determine the point when the action will be launched. 
        - New.
        - Acknowledged.
        - Solved.
        - Solved - Not a duplicate.
    - **Actions**: 
        - **Notify affected user**: this allows you to configure an email that will be sent to the affected users.
        - **Send custom email:** this allows you to configure a custom email that will be sent to specific users.
        - **Run script**: allows you to type a script that will be performed
        - **Look affected accounts**: allows you to configure an email that will be sent to the owner user.
        - **Look affected host**.
        - **Notify issue owner by email**.
        - **Acknowledge**.
        - **Start new process**.: allows you to configure the workflow that will be run.
    - **Description**: a brief description of the action you are defining.

<p class="callout info">Note that it will be necessary to restart the Sync Server when changing the action of an issue.</p>

## Actions

#### Issue policies query action

<table border="1" id="bkmrk-query-allows-to-sear-0" style="width: 99.1358%;"><tbody><tr><td style="width: 25.4916%;">**Download CSV file**</td><td style="width: 74.472%;">Allows you to download a CSV file with the issue policies data.</td></tr></tbody></table>

#### Issue policy detail

<table border="1" id="bkmrk-apply-changes-allows" style="width: 100%;"><tbody><tr><td style="width: 14.4552%;">**Add new**</td><td style="width: 85.5201%;">Allows you to add a new action to the issue policy. You can choose the action from the action list. Depending on the selected action, you must fill in different information.

Once the information will be filled in, you need to close the window and Apply the changes.

</td></tr><tr><td style="width: 14.4552%;">**Delete**</td><td style="width: 85.5201%;">Allows you to delete one or more actions from the actions list.

</td></tr><tr><td style="width: 14.4552%;">**Apply changes**</td><td style="width: 85.5201%;">Allows you to update the changes made to the issue policy.</td></tr><tr><td style="width: 14.4552%;">**Undo**</td><td style="width: 85.5201%;">Allows you to quit without applying any changes.</td></tr></tbody></table>

<div class="pointer-container" id="bkmrk-%C2%A0-0"><div class="pointer anim is-page-editable"><svg class="svg-icon" data-icon="link" role="presentation" viewbox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"></svg><div class="input-group inline block"> <button class="button outline icon" data-clipboard-target="#pointer-url" title="Copy Link" type="button"><svg class="svg-icon" data-icon="copy" role="presentation" viewbox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"></svg></button></div><svg class="svg-icon" data-icon="edit" role="presentation" viewbox="0 0 24 24" xmlns="http://www.w3.org/2000/svg"></svg></div></div>