System Alert mails only for severity high/critical

[Stephan_Lache]

Hello Checkmates,

At the moment I get a ton of alert mails due to a  rad event for a specific domain name.

I have two questions:

1) Does anyone know how to handle the rad error " Failed to decrypt CP site response"

2) Is there a way to only get alert mails for events with severity higher then 3 ( high/critical) ?

Gateways are on version R81.10 ( HFA Take 110)

Thanks in advance

Stephan

[PhoneBoy]

For the first issue, I would contact the TAC: https://help.checkpoint.com.
For the second issue, you'll probably have to write a script to run when "Alerts" occur to send email at the appropriate time.
The script will be sent the log entry as stdin, which you will have to parse.

[Stephan_Lache]

Thank you PhoneBoy !

[the_rock]

I would follow what Phoneboy said for 2nd issue, and for the 1st problem, yes, you should contact TAC, but also, based on some posts I had seen on this, seems to me you may need global exception under threat prevention policy.

Best,

Andy

[Stephan_Lache]

Hi Andy,

thanks for the idea with the exception.

Stephan

[the_rock]

No worries, let us know if it works.

Andy