topic Re: Mail alert for when a certain rule has been hit in Firewall and Security Management

Mail alert for when a certain rule has been hit

Nadav_Hellman — Thu, 19 Mar 2020 12:10:42 GMT

Hello friends,

I need to set up a client's gateway/management so that when a certain rule has been hit(a packet was accepted\dropped on that rule), he will receive a mail about it.

How can I configure the above requirement ?

Re: Mail alert for when a certain rule has been hit

Benedikt_Weissl — Thu, 19 Mar 2020 14:35:40 GMT

add "mail" to the "Track" field of the rule

Re: Mail alert for when a certain rule has been hit

Nadav_Hellman — Sun, 22 Mar 2020 05:36:51 GMT

Thanks for the reply,

But how do I fill in where and to who to send the email to ?

Re: Mail alert for when a certain rule has been hit

Danny — Sun, 22 Mar 2020 06:04:47 GMT

You configure this in Global Properties. Here his how.

Re: Mail alert for when a certain rule has been hit

Nadav_Hellman — Sun, 22 Mar 2020 07:09:36 GMT

Hi Danny,
Thanks for the quick reply.
I configured it like you said with the internal_sendmail, however, im not receiving any mails to my mailbox.
I configured it like sk25941 said, without the sender email address.(The SK says its not a must)
internal_sendmail -s "Rule X has been hit" -t 10.160.4.11 nadavh@bynetsec.com
That's what I have configured, and I cant see anything on nadavh@bynetsec.com mailbox.
Test mails from my gmail worked and received.

Re: Mail alert for when a certain rule has been hit

Nadav_Hellman — Sun, 22 Mar 2020 07:21:37 GMT

I also tried it exactly like you typed on your post:
internal_sendmail -s 'SmartView Monitor Threshold Alert' -t MAILSERVER -f SENDER_EMAIL_ADDRESS RECEIVER_EMAIL_ADDRESS
I did: internal_sendmail -s 'Test Mail' -t 10.160.4.11 -f checkpoint@bynetsec.com nadavh@bynetsec.com

Re: Mail alert for when a certain rule has been hit

Timothy_Hall — Sun, 22 Mar 2020 12:45:37 GMT

The email alert is fired from the SMS, so you need to ensure the IP address of the SMS is authorized to relay mail through your MX 10.160.4.11.

Re: Mail alert for when a certain rule has been hit

Eduardo_Pereira — Tue, 24 Mar 2020 17:30:42 GMT

To achieve that, I usually do:

Configure the sendmail:

Exemple: $FWDIR/bin/sendmail -s ALERTA -t 192.168.102.2 -f mail@checkpoint.com.br user1@unknown300.com

Here is one attack exemple to trigger the email action: