Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
nagaraja_cs
Contributor
Jump to solution

Can we configure mail alerts if the Endpoint Client detects or prevents any malware file ?

Hi Team,

We have a Sandblast Agent installed.

We want to setup mail alert if the user downloads any malicious file.

Is it possible to configure ?

0 Kudos
1 Solution

Accepted Solutions
RS_Daniel
Advisor

Hi,

We opened a case fot this, and TAC helped us to create notifications with Threat Hunting, so just possible for EPMaaS. Received mails are in my opinion better than smartevent mails. One advantage you can create a mail notification for any possible query. Steps to configure these mail notifications:

  1. Go to threat hunting menu, and choose “notifications” tab
  2. Enter the recipients list
  3. Create the required query (if you want just alert on new detections you query would be “detection event EXISTS”)
  4. Create a shared bookmark for that query and check the “email” checkbox

View solution in original post

10 Replies
nagaraja_cs
Contributor

Hi Team,

Is this requirement possible ?

0 Kudos
Adrian_Platero
Explorer

I'm also interested in this thread. I configured alerts in SmartEndpoint, but these alerts don't notify detects or prevents actions, just if the computer still infected.

I also did the steps of sk165614 but i didn't receive mails from detects or prevents, only received alerts from successfully endpoint updates or started/finalized/stopped scans and other things....

 

Any guide to configure mail alerts for detects or prevent malware??

 

Thx

0 Kudos
Kobie_Bendalak
Employee Alumnus
Employee Alumnus

@Adrian_Platero You are right, the SmartEndpoint OR Web alerts provide laconic information at this time; and not "crunched" information as you would expect.

We are working hard on extending it, and in the near future, you'll be able to gain more information out of these alerts.

As for the sk165614 configuration; at this time we have a limitation around it - but we are aiming to solve this issue soon.

I suggest you'll open a TAC ticket to have their assistance in configuring it, you may send me the ticket and I'll help you in escalating it quickly.

0 Kudos
Adrian_Platero
Explorer

@Kobie_Bendalak Thank you!

I just open a TAC ticket.

 

0 Kudos
Trey
Contributor

@Kobie_Bendalak ,

Has there been any progress on Web alerts? We have a new, large customer who is asking for this.

Thanks!

Kevin_T600
Contributor

Any update on this? We are looking to specifically get notified when a machine is infected. Thank you

0 Kudos
Julian_Sanchez
Collaborator

Hello guys, 

We have SBA Cloud and we are trying to configure the alerts too. Anyone can configure this? I have errors with the configuration. 

0 Kudos
Kobie_Bendalak
Employee Alumnus
Employee Alumnus

@Julian_Sanchez Please raise a TAC ticket and share the number w/ me; if possible also attach a few screenshots to speed up the process.

0 Kudos
Ted_Serreyn
Collaborator

I have been asking for this feature type for quite a while.  In our case complicated by separate endpoint and management on premise.

0 Kudos
RS_Daniel
Advisor

Hi,

We opened a case fot this, and TAC helped us to create notifications with Threat Hunting, so just possible for EPMaaS. Received mails are in my opinion better than smartevent mails. One advantage you can create a mail notification for any possible query. Steps to configure these mail notifications:

  1. Go to threat hunting menu, and choose “notifications” tab
  2. Enter the recipients list
  3. Create the required query (if you want just alert on new detections you query would be “detection event EXISTS”)
  4. Create a shared bookmark for that query and check the “email” checkbox

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events