topic Threat Alerts in General Topics

Threat Alerts

sjturner66 — Thu, 06 Jul 2017 19:35:37 GMT

I have configured Threat alerts to be emailed. This is working, however I'm getting information level alerts. I have setup a filter to only mail critical or high. I built this filter under objects/log forwarding, then log type threat. Is this the correct location? I would like to not see any log lower the medium level. How do I stop getting information alerts?

Thanks,

Re: Threat Alerts

BPry — Thu, 06 Jul 2017 19:38:49 GMT

@sjturner66,

Can you post a screenshot of the way you have the log-forwarding configured. If configured correctly you shouldn't be getting anything that you haven't specified unless it's matching something else in your log-forwarding policy.

Re: Threat Alerts

sjturner66 — Thu, 06 Jul 2017 19:41:39 GMT

Re: Threat Alerts

BPry — Thu, 06 Jul 2017 20:51:20 GMT

That's interesting, I don't see any reason why you would be getting informational alerts from what's on the screenshot. I might try reaching out to TAC and seeing if they can get it to mimic with their equipment.

Re: Threat Alerts

sjturner66 — Thu, 06 Jul 2017 22:05:34 GMT

Ok...that is what I was thinking as well. Below is a shot of the alerts I'm getting.