Alert on Policy Rule Modification

[Valentino]

Hello Everybody,

I would like to know if there is a possibility to be alerted in case of modification of a rule.
For example: if a rule is modified, an email is automatically sent to a specific person

Thank you

Valentino

[Mudhireddy]

Hi Valentino,
Yes, it's possible to configure Configuration log settings with an EMAIL server. You can send a log to email for every policy config change as a notification.

[Valentino]

Thank you for your answer.
Thus, my need is to alert by mail when modifying specific rules.

Indeed, I have a hundred sensitive rules which must be monitored more precisely than the three thousand other rules.

I have a column "modified" and I thought to create an alert from Splunk with this data. But this column is not shown in Splunk.

If you have any idea, you're welcome

[LAYER_8]

Ah, splunk is easier! You would create an HTTP server profile instead of email. 

See an example for slack here. So you would then just use a predefined format for config logs, but change the parameters to only be for the rules you are referencing. A little HTML copy-paste, but a big automation improvement in monitoring.