Trying to set up a FORTI-WEB email policy to only send mails of Critical attacks
I created a new EMAIL POLICY under Log&Report -> Email Policy and named it WAF-CRITICAL, set the log level to Critical , set up the SMTP sender and myself as the recipient and saved it.
I then went to Trigger Policy, Create New gave it a name and under email policy drop down i selected WAF-CRITICAL which is the email policy.
I started receiving emails but not for Critical level attacks but for low level attacks instead , basically every single event is being emailed to me instead of only Critical Attacks.
I am running FORTI-WEB v7.2.10 build409 (GA)
These are the kind of alert emails im receiving:
Alert details
________________________________________
Date 2025-04-10
Time 09:25:14
Log ID 20000008
MSG ID 000042044972
Time Zone (GMT+2:00)Harare,Pretoria
Type attack
Main Type Signature Detection
Sub Type Information Disclosure
Level alert
Severity Level Low
Protocol tcp
Service https/tls1.2
Action Alert
How do i set this up to only mail CRITICIAL attacks and not overwhelm my emails with low level attacks?
Also under Log&Report -> Log Config -> Global Log Settings i have enabled "Alert Mail" slider and set log level to "Critical" on the drop down.
FortiWeb
