Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Joshua
Contributor

SmartEvent Mail Alert for Threat Emulation

Hello everybody,

is there any way to have a mail alert sent for Threat Emulation Events with High Severity that were only detected, but not prevented?
In SmartEvent, there seems to be only an option to choose Severity.
Threat_Emulation_Alert.png

I already looked at the 'Global Exclusions' filter. The description states, that it 'discards logs whose properties match the values in the filter fields. These logs will not participate in any event processing.' Since I don't want to exclude the prevented Threat Emulation incidents from my Smart Event correlations, and this page does not offer the option to exclude by action, this is no help.

Any suggestions or new insights are very welcome.


Joshua

3 Replies
G_W_Albrecht
Legend
Legend

Did you try to define a User Defined Event for this ? On the other hand, i would never set Threat Emulation Events with High Severity to be only detected - even when an email alert is sent at the same time as the detected malware attached to an email, chance is high that your user gets infected. During the first period when TP is put into production, detect makes much sense, but later, it only takes CPU from GWs without any protection. I suggest to use prevent or disable only...

CCSE CCTE SMB Specialist
Joshua
Contributor

I did not try a User Defined Event, but I will look into it, thanks!

There seem to be cases in which the Threat Emulation Blade does not prevent a File with Critical Severity and High Confidence Level from getting to the user, even with prevent enabled for these files. 
Having this alert allows for a quicker response time in such cases.

G_W_Albrecht
Legend
Legend