topic Re: IPS Update Email Alert in Firewall and Security Management

IPS Update Email Alert

RedPill15 — Mon, 07 Dec 2020 07:50:54 GMT

Hi,

May i know how can i setup an Email alert when IPS update is failed using SmartEvent?

Thank you.

Re: IPS Update Email Alert

G_W_Albrecht — Mon, 07 Dec 2020 08:57:10 GMT

See Logging and Monitoring Administration Guide R80.30 p.63ff !

Re: IPS Update Email Alert

RedPill15 — Mon, 07 Dec 2020 09:36:00 GMT

@G_W_Albrecht Thanks, so do you mean there's no default options for it but I need to create an external script instead?

Re: IPS Update Email Alert

G_W_Albrecht — Mon, 07 Dec 2020 11:18:29 GMT

No, you create an SE automatic reaction - look at the long description in Logging and Monitoring Administration Guide R80.30 p.63ff !

Re: IPS Update Email Alert

Amir_Senn — Mon, 07 Dec 2020 14:17:42 GMT

You need to create a custom event and find the logs that describe the failure to upgrade. It's not easy but I found something. Please note that this is the reason I created on my lab and your reason for failure may differ. This is why it's important to see a failure log in your env.

Try to set type Control and description/reason to "Could not download from "http://updates.checkpoint.com/WebService/services/DownloadMetaDataService?wsdl". Server error occurred."

After you're defined this correctly you can add auto-reaction for this.

Re: IPS Update Email Alert

G_W_Albrecht — Mon, 07 Dec 2020 14:37:04 GMT

Yes, that is a more detailed descripton of how to achieve that 8)

Re: IPS Update Email Alert

RedPill15 — Thu, 24 Dec 2020 09:48:12 GMT

Based on the log that I found, I tried to create the event as below to trigger the event however I didn't receive any email alert for this. Any advice? (checked mail alert configuration is fine)

thanks.

Re: IPS Update Email Alert

Amir_Senn — Thu, 24 Dec 2020 09:50:19 GMT

This is for a successful update.

SmartEvent has an issue creating new audit events. If you created it from scratch it won't work. If you want to create an audit event, go to an existing event, right click -> Properties , edit your event and save as a new event.

Re: IPS Update Email Alert

RedPill15 — Mon, 28 Dec 2020 05:04:23 GMT

Thank you Amir but unfortunately it couldn't solve the problem also. I tried to filter "Administrator equal to admin for Any product" only for the customized event but there's no any related email alert.

Any suggestions for the filter settings ?

Thanks.

Re: IPS Update Email Alert

Amir_Senn — Mon, 28 Dec 2020 09:39:31 GMT

I suggest going to an existing event, such as 'Check Point administrator login at irregular hours' (under 'Unauthorized Entry'), right click -> properties.

Under <Any>, change the 'Subject Equal' to 'IPS Update' and delete the 'General Information Equal' from filters. Also change radio button to 'Any Condition'.

If this doesn't work you can try same thing with 'Operation' 'IPS Update' instead/in addition to 'Subject Equal'.