topic Re: Alerts in General Topics

Alerts

aguley — Tue, 11 Nov 2014 21:31:41 GMT

I have my Palo Alto setup to send emails out on critical alerts. If someone tries attacking an outside IP I will get 60 alerts sometimes all in a row. Is there anyway to get the email alert just once that the outside IP was hit 60 times as opposed to getting 60 email alerts?

Thanks

Re: Alerts

ssharma — Tue, 11 Nov 2014 21:37:06 GMT

Hi aguley ,

With current feature set, if you configure device to send you Critical alerts, it will send you critical alerts each time it is generated. In your case 60 times or more in row. There is a feature request filed for your requirement of selective alerts. You can contact your local sales / system engineer to pursue feature request. He will be glad to file it on your behalf. Hope this helps. Thank you.

Re: Alerts

HULK — Tue, 11 Nov 2014 21:40:59 GMT

Hello aguley,

I am not sure, if this will suppress system logs or not ( works with threat logs), But, You may try this command:

> set system setting logging log-suppression yes

Thanks

Re: Alerts

aguley — Tue, 11 Nov 2014 21:44:23 GMT

Hulk,

Thanks. I think this is exactly what I am looking for. I Googled the command you sent and here is a PA article:

How Log Suppression Works