Email alert in case of no observed traffic behavior

Hi AMINET,

Thank you for reaching out. The email alerts can be setup based on specific logs or severity level of logs for example:

https://docs.fortinet.com/document/fortigate/7.4.3/administration-guide/526019/email-alerts

In the case of no traffic there are no logs specific to this event to be use a trigger or a critiria to send the email alert. If you are talking about an ipsec tunnel in this case the vpn event log does have Dead Peer Detection DPD logs which can be used with automation stitches to send email when ever the specific event shows up in logs:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-configure-an-automation-stitch-to-provide/ta-p/285861

Thank you,

saleha

Hi @AMINET ,

From FortiAnalyzer, it can be configured under event handler, but first need to setup the email alert profile.

https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-How-to-configure-email-alerts-for-configuration/ta-p/194727 

For specific event like you mentioned, you can use generic-text-filter:
https://community.fortinet.com/t5/FortiAnalyzer/Technical-Note-How-to-configure-an-Event-Handler-with-a-generic/ta-p/196868

Here are few examples event handler KB, you can use as reference:

https://community.fortinet.com/t5/FortiAnalyzer/Technical-Note-Generate-an-alert-email-on-FortiAnalyzer-when-ISP/ta-p/194682

https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-How-create-event-handler-in-FortiAnalzyer-for/ta-p/190399

https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-How-to-create-Event-Handler-for-FortiAnalyzer/ta-p/192921

https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-How-to-create-Event-handler-in-FortiAnalyzer-for/ta-p/190917