Harmony Browse Alerts

[bzc]

Apparently there is no way to have alerts (simple email notifications would do) for Harmony Browse ... so unless someone watches the logs all day we cannot know if a phishing or malware was detected.

TAC says I need the full Endpoint Client to be able to get alerts, which doesn't make sense at all as the data is already there in the logs even without the Endpoint Client ... there is no technical reason for it.

Such a basic feature missing seems crazy so checking the TAC didn't miss something here if someone managed to configure notifications?

[PhoneBoy]

How are you managing Harmony Browse: Infinity Portal or on-premise management?

[bzc]

I'm using the infinity portal

[PhoneBoy]

Can you provide examples of the kind of alerts you want to configure and who should receive them for what purpose?

[bzc]

The two main notifications I'd like to have is when a phishing or malicious download is blocked. This would allow for example to follow up on the source of the phishing (probably an email that wasn't caught by the antispam so we need to find who it was addressed to and delete it etc).

Generally speaking it seems quite normal to have notifications about security incidents and really it's already all there https://sc1.checkpoint.com/documents/Infinity_Portal/WebAdminGuides/EN/Harmony-Endpoint-Admin-Guide/... but for some reason this is not available to Harmony Browse only (without the full endpoint client) even if it's already in the logs.

[PhoneBoy]

If the end user is supposed to receive the alerts, then I can maybe understand why the full Endpoint Client is needed.
For an administrator, though… @AdiGH any thoughts?