Best practices for configuring email alerts?

Forum|Forum|11 years ago
July 22, 2015
2 replies
8096 views

Here is an example below. How can I filter it out of the email alerts?

Message meets Alert condition The following intrusion was observed: IP.Land. date=2015-07-22 time=16:30:37 devname=FG1 devid=FG1K5D3 logid=0419016384 type=utm subtype=ips eventtype=signature level=alert vd="FW1" severity=low srcip=192.168.240.16 dstip=192.168.240.16 srcintf="DMZ" dstintf="DMZ" sessionid=4670609 action=detected proto=6 service=HTTP attack="IP.Land" srcport=51490 dstport=80 direction=outgoing attackid=12588 profile="DefaultIPS" ref="http://www.fortinet.com/ids/VID12588" user="" incidentserialno=45005085 msg="a-ipdf: IP.Land," crscore=5 crlevel=low

I need some suggestion here please. We have email alerts configured as screenshot. Email Alerts are working however the issue is that we are a little bit overwhelmed by the number of emails coming in ...

So my question: is there any other way I can further filter what to be sent in email as alerts?

I also tried using severity level (error and above) but that was even worse...

Screen Shot 2015-0_22 at 4_34_59 PM.jpg

5.2

gschmitt

New Member

personally I'd remove "Virus detected" and "Violation traffic detected" from the list.

Virus detected simply means "Your user clicked a link, the fortigate blocked it, nothing happend" it didn't even make it to the machine (this is the job of your anti-virus if something actually infected a machine)

syuAuthor

New Member

gschmitt wrote:
personally I'd remove "Virus detected" and "Violation traffic detected" from the list.
Virus detected simply means "Your user clicked a link, the fortigate blocked it, nothing happend" it didn't even make it to the machine (this is the job of your anti-virus if something actually infected a machine)

Thanks. Is there any best practice doc for logging with Fortigate? We do not have Fortianalyser.

Sign up

Login with SSO

Login to the community

Login with SSO