https://community.checkpoint.com/t5/Firewall-and-Security-Management/smartevent-correlation-unit-problem/m-p/233614#M63750 <P>actually it correlates and sends automatic reaction via email when i install the event policy but never correlates and sends notification again&nbsp;even though it exceeds the treshold values</P> Sun, 24 Nov 2024 16:33:59 GMT portfast 2024-11-24T16:33:59Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/smartevent-correlation-unit-problem/m-p/233498#M63746 <P>Hi all, i've been configuring for an event on my smartevent server that detects when 10 address spoofing logs in 20 seconds. But i can't get daily notification mails for specified ip addresses as i want with this settings, am i missing something? thanks,</P><DIV class="">&nbsp;</DIV><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="smartevent.png" style="width: 674px;"><img src="https://community.checkpoint.com/t5/image/serverpage/image-id/28527iD2BAA26701A66D28/image-size/large?v=v2&amp;px=999" role="button" title="smartevent.png" alt="smartevent.png" /></span></P> Fri, 22 Nov 2024 08:01:34 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/smartevent-correlation-unit-problem/m-p/233498#M63746 portfast 2024-11-22T08:01:34Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/smartevent-correlation-unit-problem/m-p/233549#M63747 <P>SmartEvent works with Session logs by default.<BR />For regular rules, you can turn them into Session logs with: <A href="https://support.checkpoint.com/results/sk/sk150452" target="_blank">https://support.checkpoint.com/results/sk/sk150452</A></P> <P>Not sure if you can do this with Anti-Spoofing since that’s a Connection log and there’s no explicit rule.<BR />Might require checking with TAC.</P> Fri, 22 Nov 2024 13:49:06 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/smartevent-correlation-unit-problem/m-p/233549#M63747 PhoneBoy 2024-11-22T13:49:06Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/smartevent-correlation-unit-problem/m-p/233595#M63748 <P>Does evstop; evstart help at all?</P> Sat, 23 Nov 2024 17:41:57 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/smartevent-correlation-unit-problem/m-p/233595#M63748 the_rock 2024-11-23T17:41:57Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/smartevent-correlation-unit-problem/m-p/233612#M63749 <P>The correlated event is generated and the issue is the email notification?</P> <P>Can you share the automatic reaction you attached to the event?</P> Sun, 24 Nov 2024 15:27:26 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/smartevent-correlation-unit-problem/m-p/233612#M63749 Amir_Senn 2024-11-24T15:27:26Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/smartevent-correlation-unit-problem/m-p/233614#M63750 <P>actually it correlates and sends automatic reaction via email when i install the event policy but never correlates and sends notification again&nbsp;even though it exceeds the treshold values</P> Sun, 24 Nov 2024 16:33:59 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/smartevent-correlation-unit-problem/m-p/233614#M63750 portfast 2024-11-24T16:33:59Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/smartevent-correlation-unit-problem/m-p/233954#M63751 <P>Is it out of the box event or something new that you created?</P> Wed, 27 Nov 2024 15:59:27 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/smartevent-correlation-unit-problem/m-p/233954#M63751 Amir_Senn 2024-11-27T15:59:27Z