Can we configure mail alerts if the Endpoint Client detects or prevents any malware file ?

[nagaraja_cs]

Hi Team,

We have a Sandblast Agent installed.

We want to setup mail alert if the user downloads any malicious file.

Is it possible to configure ?

[nagaraja_cs]

Hi Team,

Is this requirement possible ?

[Adrian_Platero]

I'm also interested in this thread. I configured alerts in SmartEndpoint, but these alerts don't notify detects or prevents actions, just if the computer still infected.

I also did the steps of sk165614 but i didn't receive mails from detects or prevents, only received alerts from successfully endpoint updates or started/finalized/stopped scans and other things....

Any guide to configure mail alerts for detects or prevent malware??

Thx

[Kobie_Bendalak]

@Adrian_Platero You are right, the SmartEndpoint OR Web alerts provide laconic information at this time; and not "crunched" information as you would expect.

We are working hard on extending it, and in the near future, you'll be able to gain more information out of these alerts.

As for the sk165614 configuration; at this time we have a limitation around it - but we are aiming to solve this issue soon.

I suggest you'll open a TAC ticket to have their assistance in configuring it, you may send me the ticket and I'll help you in escalating it quickly.

[Adrian_Platero]

@Kobie_Bendalak Thank you!

I just open a TAC ticket.

[Trey]

@Kobie_Bendalak ,

Has there been any progress on Web alerts? We have a new, large customer who is asking for this.

Thanks!

[Kevin_T600]

Any update on this? We are looking to specifically get notified when a machine is infected. Thank you

[Julian_Sanchez]

Hello guys, 

We have SBA Cloud and we are trying to configure the alerts too. Anyone can configure this? I have errors with the configuration. 

[Kobie_Bendalak]

@Julian_Sanchez Please raise a TAC ticket and share the number w/ me; if possible also attach a few screenshots to speed up the process.

[Ted_Serreyn]

I have been asking for this feature type for quite a while.  In our case complicated by separate endpoint and management on premise.

[RS_Daniel · Accepted solution]

Hi,

We opened a case fot this, and TAC helped us to create notifications with Threat Hunting, so just possible for EPMaaS. Received mails are in my opinion better than smartevent mails. One advantage you can create a mail notification for any possible query. Steps to configure these mail notifications:

1. Go to threat hunting menu, and choose “notifications” tab
2. Enter the recipients list
3. Create the required query (if you want just alert on new detections you query would be “detection event EXISTS”)
4. Create a shared bookmark for that query and check the “email” checkbox