topic Re: How to send a Security Alert from Smart-1 in General Topics

How to send a Security Alert from Smart-1

TSOL — Tue, 10 Dec 2024 09:34:09 GMT

Hello ALL

I understand from reading SK25941 and other resources that email alerts can be sent using methods like SmartEvent or SmartDashboard.

However, is it possible to send alerts detected by Threat Prevention on Smart-1 to chat tools like Microsoft Teams?

Thank You in Advance

Re: How to send a Security Alert from Smart-1

G_W_Albrecht — Tue, 10 Dec 2024 10:30:01 GMT

No, this uses sendmail.

Re: How to send a Security Alert from Smart-1

Chris_Atkinson — Tue, 10 Dec 2024 12:29:45 GMT

Explore Infinity Playblocks for this type of requirement.

https://sc1.checkpoint.com/documents/Infinity_Portal/WebAdminGuides/EN/Playblocks-Admin-Guide/Content/Topics-PlayBlocks-AG/Introduction.htm

Re: How to send a Security Alert from Smart-1

PhoneBoy — Tue, 10 Dec 2024 19:27:50 GMT

In the Threat Prevention policy, you can set the Track field to something other than Log (e.g. Alert).
Those log types can execute a script, which must exist on the management.
You specify the full path to the script in Global Properties:

For an example script, see: https://community.checkpoint.com/t5/Management/SmartEvent-External-Script-for-Mail/m-p/78994
It references SmartEvent here, but the script format is the same.

Or, as @Chris_Atkinson said, look at Infinity Playblocks.

Re: How to send a Security Alert from Smart-1

Tomer_Noy — Wed, 11 Dec 2024 09:27:12 GMT

Indeed, Playblocks has Teams and Slack integration.

Very soon, we'll add customization for playbooks that will allow you to further customize on which specific events you want to alert.