Adding a user has never been simpler. Just click on Settings from the menu and then Users.

Then click on "ADD USER" and fill in all the fields, you can also Delete or Edit Users in this Section. Please keep in mind that the actual username must be an email address.

The password can also be changed directly from the Web UI, modify the User, send the Password Reset email and delete the User. 

The email settings relate to ACSIA server-side notifications via emails. This setting can be found in the Settings menu, in the Email tab.

Here you can set the sender's email and the name for it. For instance, if your organization's domain is called example.com you can set the email as no-reply@example.com and the name as Acsia Alerts and whitelist the accounts on your anti-spam filters to ensure you receive notifications from that email account.

As soon as you set this up, you will start receiving notification emails as per the setup.

If you experience issues in receiving email, the recommended action is to set up an actual real email account and configure Under the email notification, instead of setting a simple email and label, you can enable the SMTP and the Authentication methods where you can fill in the details of the email you wish to use as sender.

If you have trouble setting this up, you can check the following troubleshooting article: Set and Configure a real email account as a sender V5.0+.

On the left side menu, Live Notifications contains a list of all live events that are not being actioned yet. All incoming security alerts will be listed in this section and by clicking on the Details arrow on each notification you can browse and explore the full details of a single incident/alert generated by ACSIA.

There are also filters where the events can be displayed and searched by client IP, severity, category, and type of event.

The IP Blacklist contains all those source IP addresses that have been marked as malicious and unauthorized and therefore blacklisted (banned by hosts). You can undo an action if an IP address is mistakenly banned by a user. If the autoban feature is enabled, ACSIA will automatically handle all potential attacks and threats originating from outside of the organization (from the internet for example) whereas internal threats will always be notified for the ACSIA administrator to make the final decision.

The IP Whitelist contains all those source IP addresses that have been marked as trusted. Note that whitelisting an IP address does not include web requests (due to giving sensitivity to web application-level accesses). Therefore, when an IP address is whitelisted the whitelisting does NOT APPLY to web applications. Therefore traffic originating from that specific IP address is identified asa potential threat it will be subject to notification and alert.

The Locked Users contains specific users that are marked to be locked. They can be legitimate users who attempt to gain access to non-authorized areas. Alternatively, they may be malicious users that have compromised the legitimate account details of a user and have therefore been locked. ACSIA does not automatically block legitimate users, it always requires user input so it will be at the ACSIA administrator’s discretion to make that decision.

The Access Location refers to those security events where legitimate access originates from a geographical location or an IP address that wasn’t authorized on ACSIA. These access requests need to be authorized or denied manually. If you authorize a location-based IP address for a user it is like whitelisting that user only for that IP address. On the other hand, if you mark a user unauthorized, that user will still be able to access and make attempts but you will be notified every time. So the Access Location is different from blacklisting an IP unless you add the IP manually to the blacklist.

The Muted Notifications refers to those security events that have been acknowledged legitimately by ACSIA administrators and/or security analysts. Once an incident is marked to be muted ACSIA will no longer notify that type of incident. All muted events can be unmuted at any time.