topic System Alert mails only for severity high/critical in General Topics

System Alert mails only for severity high/critical

Stephan_Lache — Thu, 11 Jan 2024 09:01:25 GMT

Hello Checkmates,

At the moment I get a ton of alert mails due to a rad event for a specific domain name.

I have two questions:

1) Does anyone know how to handle the rad error " Failed to decrypt CP site response"

2) Is there a way to only get alert mails for events with severity higher then 3 ( high/critical) ?

Gateways are on version R81.10 ( HFA Take 110)

Thanks in advance

Stephan

Re: System Alert mails only for severity high/critical

PhoneBoy — Fri, 12 Jan 2024 00:49:05 GMT

For the first issue, I would contact the TAC: https://help.checkpoint.com.
For the second issue, you'll probably have to write a script to run when "Alerts" occur to send email at the appropriate time.
The script will be sent the log entry as stdin, which you will have to parse.

Re: System Alert mails only for severity high/critical

the_rock — Fri, 12 Jan 2024 01:57:12 GMT

I would follow what Phoneboy said for 2nd issue, and for the 1st problem, yes, you should contact TAC, but also, based on some posts I had seen on this, seems to me you may need global exception under threat prevention policy.

Best,

Andy

Re: System Alert mails only for severity high/critical

Stephan_Lache — Mon, 15 Jan 2024 08:11:16 GMT

Thank you PhoneBoy !

Re: System Alert mails only for severity high/critical

Stephan_Lache — Mon, 15 Jan 2024 08:11:58 GMT

Hi Andy,

thanks for the idea with the exception.

Stephan

Re: System Alert mails only for severity high/critical

the_rock — Mon, 15 Jan 2024 13:08:23 GMT

No worries, let us know if it works.

Andy