topic Re: How to handle email alerts in General Topics

How to handle email alerts

bbarrett_hollister — Fri, 21 Mar 2014 18:10:38 GMT

Hi Everyone,

After firing up my new Palo Alto IDS, I turned on the ability to send emails for medium, high and critical threats. However, when hundreds of threats are detected in a short window, I get hundreds of emails. All of them are about the same event (a brute force event in this case.) Is there a way to configure alerting so that a specific threat only sends an email every so often? Eventually I would like these types of alerts to generate an email to my ticketing system, but the last thing I want is 900 tickets for what turns out to be one thing I need to investigate.

Thanks in advance,

Re: How to handle email alerts

tshiv — Tue, 25 Mar 2014 03:46:53 GMT

Hello,

Email alerts can only be triggered on severity (low, medium, high and critical) basis. It is not provisioned on the PA to send an email alert for specific threats. This will have to go down as a feature request which can be filed by your Sales Engineer.

It would be better if email alerts are used only for critical and high severity threats as too much alerts can be irritating some times ...:smileylaugh:.

Hope this helps.

Thanks

Re: How to handle email alerts

tshiv — Tue, 25 Mar 2014 03:49:27 GMT

Also, some of these earlier discussions might be of help to you :

Email alert on a specific vulnerability

Virus only email alerts?