topic Email laerts for just zone protection alerts in General Topics

Email laerts for just zone protection alerts

MostafaSafari — Fri, 03 May 2024 18:12:26 GMT

Hello all,

I have applied a zone protection profile to the outside zone on my firewall. I am wondering how I can configure the firewall to receive email notifications just for alerts for this zone protection profile. Like every time an IP address is blocked by the firewall.

Thank you

Re: Email laerts for just zone protection alerts

BPry — Fri, 03 May 2024 18:29:02 GMT

@MostafaSafari,

I'm not sure you can actually do something like this easily to be honest. The ZPP creates a number of different subtype events in your threat logs whenever the policy is violated, but they aren't universally only present in ZPP violations and will also show up in DoS/DDoS events as well.

Re: Email laerts for just zone protection alerts

Claw4609 — Fri, 03 May 2024 18:35:14 GMT

Hello,

Depends on exactly what you are looking for but here is an example. On your log filtering profile your can add on a threat filter, add the filter for logs you're looking for (in my example Im using "( subtype eq 'packet' ) and ( action eq 'drop' )". Then create and an email profile. When you create the email profile you can send a test from it as well to ensure the profile works. If you use Strata Logging Service (previously Cortex Data Lake) you can do something like the second image.

Re: Email laerts for just zone protection alerts

MostafaSafari — Fri, 03 May 2024 21:13:35 GMT

Thank you @Claw4609. I think I need to do some tests as you suggested.