SDWAN alerts email notifications

[PeteRunyan]

Hello - can anyone point me to the steps to send email notifications for when SDWAN devices and sites generate alerts?     We have hunted all over Strata Cloud Manager, and have successfully sent test emails via the "Incidents" configuration area, but we cannot figure out how to tie the SDWAN ION devices and SDWAN sites (both branch and data center sites) to alerts to an email notification.   I see some indications that alert notifications for SDWAN might be tied to notifications/logging for the NGFW, but that doesn't make much sense to me.  Hopefully I am simply missing something simple here.  Thanks.

[nikoolayy1]

Have you tested AI to give you the answer?

AI Generated:

-------------------------

To forward logs or receive critical alert notifications via email from your Palo Alto Prisma SD-WAN ION devices sending data to the Strata Logging Service, you have two main options depending on whether you want to forward raw security/network logs or just receive operational system alerts.

---

Option 1: Forward Raw Logs via Email (Strata Logging Service)

If you want Strata Logging Service to package incoming ION traffic/security logs and email them to a specific destination (e.g., your security team or a ticketing inbox), you must configure email forwarding directly within the logging infrastructure: [1]

1. Log into the Palo Alto Networks Hub.
2. Select the specific Strata Logging Service instance that receives your ION device logs. [1]
3. Navigate to System Settings > Strata Logging Service > Log Forwarding. [1]
4. Select the Email tab and click Add to create an email destination.
5. Define your Log Filters (e.g., specific SD-WAN critical events or security rules) and specify the recipient email addresses.
   • Note: Strata Logging Service handles the email transit securely over TLS using Palo Alto's automated SMTP server ([email protected]). [1, 2]

---

Option 2: Setup Alerts for ION Device Outages/Events (Strata Cloud Manager)

If your goal is to be emailed when an ION device goes offline, changes HA states, or generates a system alarm, you can configure incident notification channels within Strata Cloud Manager (SCM): [1, 2]

• Open Strata Cloud Manager.
• Click on the Notifications (Bell Icon) or navigate to Incidents > Settings.
• Click Add Profile (you can use the Incidents Quickstart Template for easier setup).
• Under Notification Channel, check the box for Email Notification Channel.
• Input the email addresses of the administrators who should receive the operational network alerts.
• Save and toggle the profile status to Enabled. [1, 2]

---

[ecraig]

Try configuring the Email Notifications for Alarms-Alerts CloudBlade.
In SCM:
Configuration > Prisma  SD-WAN > CloudBlades
And look for the Email Notifications for Alarms-Alerts CloudBlade.
If it isn't assigned to your tenant, contact support and they can help.
===========================
Email Notifications for Alarms- Alerts is a CloudBlade application that provides email updates for Prisma SD-WAN incidents and alerts. Once the CloudBlade is enabled, the CloudBlade allows you to get notifications via emails for selected incidents and alerts. An email is sent when the event is raised or cleared.
Configure Notifications for Incidents and Alerts
1. To configure the email notifications, go to Strata Cloud Manager > Manage > Prisma SD-WAN >CloudBlades. You should see the Email Notifications for Alarm-Alerts CloudBlade. If you do not see this CloudBlade, contact Palo Alto Networks Support.
2. Click Configure to set up email addresses for incident and alert notifications.
a. Enter the Email Address for sending notifications. Multiple emails can be added, as comma-separated values, to send to various aliases and groups. The alerts are sent to the provided email addresses. The CloudBlade triggers an email notification every 1 minute. If an issue is resolved within that time frame, it will not generate an email notification.
b. (Optional) Select Include Suppressed Events in case you need notifications for events that are suppressed.
c. Use the drop-down to choose the Event Codes for which you want to receive notifications. You can receive notifications for multiple event codes.
d. Click Install to save your changes.
2. (Optional) Click Monitor to view the email notifications sent for an Event Code.
3. (Optional) Click Audit Log to view the audit logs for the CloudBlade.