Email laerts for just zone protection alerts

[MostafaSafari]

Hello all,

I have applied a zone protection profile to the outside zone on my firewall. I am wondering how I can configure the firewall to receive email notifications just for alerts for this zone protection profile. Like every time an IP address is blocked by the firewall.

Thank you

[BPry]

@MostafaSafari,

I'm not sure you can actually do something like this easily to be honest. The ZPP creates a number of different subtype events in your threat logs whenever the policy is violated, but they aren't universally only present in ZPP violations and will also show up in DoS/DDoS events as well.

[Claw4609]

Hello,

Depends on exactly what you are looking for but here is an example. On your log filtering profile your can add on a threat filter, add the filter for logs you're looking for (in my example Im using "( subtype eq 'packet' ) and ( action eq 'drop' )". Then create and an email profile. When you create the email profile you can send a test from it as well to ensure the profile works. If you use Strata Logging Service (previously Cortex Data Lake) you can do something like the second image.

[MostafaSafari]

Thank you @Claw4609. I think I need to do some tests as you suggested.