Email alert in case of no observed traffic behavior

[AMINET]

Hi,

Can I receive emails if I don't receive traffic from a specific source for 1 hour for example?

Fortigate or FortiAnalyzer

Thanks.

[saleha]

Hi AMINET,

Thank you for reaching out. The email alerts can be setup based on specific logs or severity level of logs for example:

https://docs.fortinet.com/document/fortigate/7.4.3/administration-guide/526019/email-alerts

In the case of no traffic there are no logs specific to this event to be use a trigger or a critiria to send the email alert. If you are talking about an ipsec tunnel in this case the vpn event log does have Dead Peer Detection DPD logs which can be used with automation stitches to send email when ever the specific event shows up in logs:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-configure-an-automation-stitch-to-p...

Thank you,

saleha

[smkml]

Hi @AMINET ,

From FortiAnalyzer, it can be configured under event handler, but first need to setup the email alert profile.

https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-How-to-configure-email-alerts-for-conf... 

For specific event like you mentioned, you can use generic-text-filter:
https://community.fortinet.com/t5/FortiAnalyzer/Technical-Note-How-to-configure-an-Event-Handler-wit...

Here are few examples event handler KB, you can use as reference:

https://community.fortinet.com/t5/FortiAnalyzer/Technical-Note-Generate-an-alert-email-on-FortiAnaly...

https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-How-create-event-handler-in-FortiAnalz...

https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-How-to-create-Event-Handler-for-FortiA...

https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-How-to-create-Event-handler-in-FortiAn...