topic Re: SmartEvent Alerting in Firewall and Security Management

SmartEvent Alerting

Raj_Khatri — Fri, 23 Feb 2018 16:33:45 GMT

I am trying to setup email alerts for threats as they are detected (Anti-virus, Anti-bot, etc.) and configured Automatic Reactions within SmartEvent R80.10. While I am able to get email alerting working, the email content provides no value as there the Attack Details is empty and having UserID information would be useful. Also, I don't see a way to create alerts according to various severity levels.

If anyone has any insight as to how best to configure/customize these alerts, it would be helpful.

Re: SmartEvent Alerting

PhoneBoy — Fri, 23 Feb 2018 18:52:17 GMT

Have you applied this fix for the blank UserID?: In E-mail alerts sent by SmartEvent, the user name field contains '*** Confidential ***' instead of real data

Can you provide some examples of what kinds of alerts you would like to see based on what kind of severity?

Re: SmartEvent Alerting

Raj_Khatri — Mon, 26 Feb 2018 16:18:30 GMT

Thanks for providing the SK to address the blank UserID. With respect to an example, a simple alert such as any threat prevention blade (IPS, AV, AB) with Critical Severity should trigger an automatic reaction and include attack details.

Re: SmartEvent Alerting

PhoneBoy — Mon, 26 Feb 2018 20:44:31 GMT

Have you tried to follow the steps in this SK?

Trying to create mail reaction based on specific event severity, but receive Alerts with all severities