topic Re: Receive an email when an HIP rules not match in General Topics

Receive an email when an HIP rules not match

vbe — Mon, 18 Sep 2017 13:55:06 GMT

Hello,

I m going to enable HIP on our global protect so i m testing it and it works very well but i can t find how i can receive an email when a hip profile is not match. I have enabled the log transfer in device -> log settings. So i receive emai even hip match or not but i can find how send eamil on hip not match only

Can you help me

Thanks

Vincent

Re: Receive an email when an HIP rules not match

bmorris1 — Mon, 18 Sep 2017 14:33:10 GMT

Hi vbe,

In order to achieve this, what you'll need to do is created a 'not equal to' type of HIP object/profile and create a seperate deny rule for this.

On this new rule create a log forwarding profile and have it email you when this rule it matched.

hope this helps,

Ben

Re: Receive an email when an HIP rules not match

vbe — Mon, 18 Sep 2017 15:31:38 GMT

Thanks for your Answer,

Your solution works i have created a rule with neq of my hip object

but i receive a lot of email just for one global protect whitch hips not match