There are two ways:
1) Basic Alerting - Anywhere you see a Track option (in a rule, IPS signature, etc.) set it for Mail instead of Log. Then set up the mail parameters like subject, SMTP server and recipient in the Global Properties as defined here: sk25941: Configuring 'Mail Alerts' using 'internal_sendmail' command.
2) SmartEvent Automatic Reactions - If you have a license for SmartEvent you can set up Automatic Reactions in response to a event being declared by SmartEvent; one of the options is to send an email.
Keep in mind that if a Mail alert is selected, it is a superset of action "Log". So even if the alert was
lost or missed by the administrator, there will always still be a log entry that can be reviewed after the event.
Also note that the email alert will be fired from the Log Server (which is usually the SMS) and not the gateway! As such
make sure that the receiver of the email is configured to accept traffic from the IP address of the SMS/Log
The mail feature for basic alerts and SmartEvent Automatic Reactions does not currently support using SMTP Authentication.
Updated 2023 IPS/AV/ABOT R81.20 Course now
available at maxpowerfirewalls.com