Security Event Notifications Using Event Juggler

The information on this page is updated in accordance with the 00.07.24.2 firmware version .

Introduction

Event Juggler is a great automation tool available on Teltonika Networks devices that allows predefined actions to be triggered automatically when specific events occur. It can be used to automate various device management tasks, notifications, and responses without requiring manual intervention.

This article provides an example of using Event Juggler for security monitoring by detecting authentication events on the device, such as successful or unsuccessful login attempts to the SSH and WebUI interfaces. The detected events can then trigger actions such as sending SMS or email notifications, allowing users to stay informed about access to their devices.

Configuration overview and prerequisites

• A SIM card with an active SMS service must be inserted into the router to enable SMS notifications.

• An SMTP email account must be configured on the router. Go to System → Administration → Recipients → Email Users → Email accounts and configure the required email account. A Gmail account with an App Password generated for SMTP authentication can be used.

• A PC or laptop is required to access the router's WebUI, configure Event Juggler, and test the setup.

Event Juggler Configuration

Event Juggler is used here to detect login attempts on the router and trigger a notification (SMS and/or email) whenever one occurs. This is done by creating an Event that watches the relevant log source, and an Action attached to that event that defines how the notification is sent.

This is configured on the router's WebUI, under Services → Event Juggler. Press Add to create a new instance, configure the Event (e.g. SSH or WebUI login attempts), press Next, configure the Action (SMS or Email notification), then press Finish to save the instance.

Two events are configured in this example - one triggered by SSH login attempts, and one triggered by WebUI login attempts - each with a corresponding SMS and Email notification action. Since each instance links one event to one action, a separate instance (repeat of Add → Next → Finish) is required for each notification type.

SSH login attempts

This event is triggered whenever a login attempt is made via SSH.

1. Enabled - on
2. Event name - <Preferred name for the event>
3. Event type - Log
4. Events log type - SSH
5. Events log subtype - All

Note: The Events log subtype field filters which type of login attempts trigger the event. Available options are All (any login attempt), Successful authentication (only successful logins), and Unsuccessful authentication (only failed logins). All is used in this example to capture every attempt regardless of outcome.

SMS Notification

This action sends an SMS to the specified recipient whenever the login event above is triggered.

1. Action name - <Preferred name for the action>
2. Action type - Send SMS
3. Phone number - <Your phone number>

Note: The Text message field can be modified to include any information you'd like the SMS to contain.

Note: SMS notifications can also be sent to multiple phone numbers at once by using a Phone Group instead of a single number. Phone Groups can be configured under System → Administration → Recipients.

Email Notification

This action sends an email to the specified recipient whenever the login event above is triggered.

1. Action name - <Preferred name for the action>
2. Action type - Send email
3. Subject - <Preferred subject line for the email>
4. Sender's email account - <Your configured email account>
5. Recipient's email address - <your_email_address>@gmail.com

Note: The Text message field can be modified to include any information you'd like the SMS to contain.

WebUI login attempts

This event is triggered whenever a login attempt is made via the router's WebUI.

1. Enabled - on
2. Event name - <Preferred name for the event>
3. Event type - Log
4. Events log type - Web UI
5. Events log subtype - All

Note: The Events log subtype field filters which type of login attempts trigger the event. Available options are All (any login attempt), Successful authentication (only successful logins), and Unsuccessful authentication (only failed logins). All is used in this example to capture every attempt regardless of outcome.

SMS Notification

Configuration is identical to the SMS Notification section described above under SSH login attempts.

Email Notification

Configuration is identical to the Email Notification section described above under SSH login attempts.

Testing the setup

If Email Notification was configured, you should receive an email from the configured account shortly after a login attempt on your device:

Similarly, if SMS Notification was configured, you should receive a text message on the configured phone number:

See also

• Email Relay Configuration Example
• Sending emails via command line
• SMS Utilities