topic Re: Harmony Browse Alerts in Browse

Harmony Browse Alerts

bzc — Tue, 24 Sep 2024 15:54:57 GMT

Apparently there is no way to have alerts (simple email notifications would do) for Harmony Browse ... so unless someone watches the logs all day we cannot know if a phishing or malware was detected.

TAC says I need the full Endpoint Client to be able to get alerts, which doesn't make sense at all as the data is already there in the logs even without the Endpoint Client ... there is no technical reason for it.

Such a basic feature missing seems crazy so checking the TAC didn't miss something here if someone managed to configure notifications?

Re: Harmony Browse Alerts

PhoneBoy — Wed, 25 Sep 2024 18:41:43 GMT

How are you managing Harmony Browse: Infinity Portal or on-premise management?

Re: Harmony Browse Alerts

bzc — Thu, 26 Sep 2024 07:21:06 GMT

I'm using the infinity portal

Re: Harmony Browse Alerts

PhoneBoy — Thu, 26 Sep 2024 11:47:15 GMT

Can you provide examples of the kind of alerts you want to configure and who should receive them for what purpose?

Re: Harmony Browse Alerts

bzc — Thu, 26 Sep 2024 12:00:46 GMT

The two main notifications I'd like to have is when a phishing or malicious download is blocked. This would allow for example to follow up on the source of the phishing (probably an email that wasn't caught by the antispam so we need to find who it was addressed to and delete it etc).

Generally speaking it seems quite normal to have notifications about security incidents and really it's already all there https://sc1.checkpoint.com/documents/Infinity_Portal/WebAdminGuides/EN/Harmony-Endpoint-Admin-Guide/Topics-HEP/Advanced-Alerts.htm?tocpath=Deploying%20Endpoint%20Clients%7CConfiguring%20Alerts%7CAdvanced%20Alerts%7C_____1#Configuring_Advanced_Alerts but for some reason this is not available to Harmony Browse only (without the full endpoint client) even if it's already in the logs.

Re: Harmony Browse Alerts

PhoneBoy — Thu, 26 Sep 2024 12:22:25 GMT

If the end user is supposed to receive the alerts, then I can maybe understand why the full Endpoint Client is needed.
For an administrator, though… @AdiGH any thoughts?