Are you a member of CheckMates?
×
Sign in with your Check Point UserCenter/PartnerMap account to access more great content and get a chance to win some Apple AirPods! If you don't have an account, create one now for free!
I've enabled Anti-Bot email alerts in SmartEvent - all default settings, as follows:
The email alerts I get have very little detail in them. They don't contain any source/destination/attack details, so the emails are zero use to me. E.g:
However the corresponding log card for the issue contains all of the detail, as expected. E.g:
Does anyone know why the emails don't contain the same detail as the logs? Or how to fix it to make the emails useful?
I have a hunch for you to try...
The email that you showed has "Log ID = 2000" and "Type = Correlated". That means that the automatic reaction was triggered on a correlated log, instead of on the original Anti-Bot log. The correlated log has only partial information, not the full info of the original log.
Correlated logs aren't meant to be used for automatic reactions or further correlation (it can become recursive...). That's why in SmartEvent Event Policy there is a definition for "Global Exclusions" and the default is to exclude events with "Log ID = 2000" (see screenshot).
Is it possible that you deleted this default filter or deactivated it?
After trying anything. I gave up set mail alert at SmartEvent.
I wrote a mail alert script and set track action to User Defined at rule and at global properties mail alert.
look like below, it has better visibility than original. I think RD can try to make original mail alert look more better.
Hi @biskit ,
Per the attached screenshot, the "Log Count" value is 1, which means that the correlated event was created by a single update that doesn’t contain all relevant data as the unified log.
My suggestion is to modify the advanced settings of "Bot Incident" event, so the event will kept opened for couple seconds before sending the mail, then we will have more data in the email.
For example :
Let me know if it resolve the issue for you.
Hi @shovalm and @Chris_Atkinson, thanks for your suggestions. Neither seem to apply though. See below. The filter is already set on the custom alert... And originally the Log Count was set to 39600 by default. Last night I changed this to 10 as suggested above. As you can see though, I'm still getting emails this morning with no detail in them, and see the times too - it's not like I'm getting a bunch of emails all at the same time, each containing a different bit of the information...
