topic Re: Email alerts,. in General Topics

Email alerts,.

Gururaj — Wed, 28 Aug 2013 11:40:41 GMT

Hi All,.

Is it possible to generate email alert for particular event and send it to particular email id?

Example: If any data found (in attachment or in email) which is defined in DATA Pattern send alert to ABC@test.com

If any file is blocked then send alert to XYZ@test.com

Regards,

Gururaj

Re: Email alerts,.

Retired Member — Wed, 28 Aug 2013 12:30:08 GMT

Not directly supported but can do other things like log forwarding traffic log hits that 2 specific rule written.

Also look at Email notification per specific threat

Re: Email alerts,.

kprakash — Wed, 28 Aug 2013 13:02:50 GMT

You can use the below method. The only difference is that you will not get the emails instantly, but only at the time the scheduled email reports are sent out.

create a custom report for the file blocking / data filtering events

add this custom report to a report group:

Use this report group under an email scheduler

You can play around with the override email addresses, depending upon who the recipient of the email shall be

BR,

Karthik

Re: Email alerts,.

Retired Member — Tue, 24 Jan 2017 19:20:17 GMT

Doing it through reporting will require that you either run it every x minutes if you want the same day's data. When you run a scheduled report, the best you'll get is yesterday's data.

Here is how I did it years ago when we had several SMTP servers sending us malicious email attachments with the same message body.

What you could do is create a data filtering profile searching for a data pattern X in application SMTP.
Then create a firewall policy with SMTP as the application type and port 25 as the service port in the policy then apply your Data Filtering profile (and anything else SMTP should have for a profile like AV etc. too!).
Put this above your regular SMTP permit policies.
Don't forget you won't see a match if you aren't decrypting the SSL when using encrypted SMTP so add that also if needed.
Now on that firewall policy make sure your logging destination includes an email forwarding profile so you get an alert everytime it is matched.