Email alerts,.

[Gururaj]

Hi All,.

Is it possible to generate email alert for particular event and send it to particular email id?

Example: If any data found (in attachment or in email) which is defined in DATA Pattern send alert to  ABC@test.com

              If any file is blocked then send alert to     XYZ@test.com

Regards,

Gururaj

[panos]

Not directly supported but can do other things like log forwarding traffic log hits that 2 specific rule written.

Also look at Email notification per specific threat

[kprakash · Accepted solution]

You can use the below method. The only difference is that you will not get the emails instantly, but only at the time the scheduled email reports are sent out.

create a custom report for the file blocking / data filtering events

add this custom report to a report group:

Use this report group under an email scheduler

You can play around with the override email addresses, depending upon who the recipient of the email shall be

BR,

Karthik

[Retired Member]

Doing it through reporting will require that you either run it every x minutes if you want the same day's data. When you run a scheduled report, the best you'll get is yesterday's data.

Here is how I did it years ago when we had several SMTP servers sending us malicious email attachments with the same message body.

1. What you could do is create a data filtering profile searching for a data pattern X in application SMTP.
2. Then create a firewall policy with SMTP as the application type and port 25 as the service port in the policy then apply your Data Filtering profile (and anything else SMTP should have for a profile like AV etc. too!). 
3.  Put this above your regular SMTP permit policies. 
4.  Don't forget you won't see a match if you aren't decrypting the SSL when using encrypted SMTP so add that also if needed.
5.  Now on that firewall policy make sure your logging destination includes an email forwarding profile so you get an alert everytime it is matched.