Receive an email when an HIP rules not match

[vbe]

Hello,

I m going to enable HIP on our global protect so i m testing it and it works very well but i can t find how i can receive an email when a hip profile is not match. I have enabled the log transfer in device -> log settings. So i receive emai  even hip match or not but i can find how send eamil on hip not match only

Can you help me

Thanks

Vincent

[bmorris1]

Hi vbe,

In order to achieve this, what you'll need to do is created a 'not equal to' type of HIP object/profile and create a seperate deny rule for this.

On this new rule create a log forwarding profile and have it email you when this rule it matched.

hope this helps,

Ben

[vbe]

Thanks for your Answer,

Your solution works i have created a rule with neq of my hip object

but i receive a lot of email just for one global protect whitch hips not match