High SMTP Auth Failure alert

[PeterM]

Hi,

I was wondering if anyone has any experience in creating a custom alert in Fortimail upon high SMTP Auth Failures.

I checked the guide, but i couldn't figure out of this was possible at all.

I found how to create custom alerts, but i can't seem to figure out if this can be applied to high SMTP auth failures.

What i would like to do is get an alert when smtp auth failures are high from ip x.x.x.x

Thanks p

[khassan_FTNT · Accepted solution]

Hi Peter,

Using firmware 6.0.7, under Security menu > Authentication Reputation you can monitor or block too many authentication attempts.

To trigger alerts you'd need FortiAnalyzer.

Thanks,

Khaled.

[PeterM]

Hi Khaled,

This is exactly what i was looking for, thank you for the information.

We do have fortianalyzer but not linked to our Fortimail (cloud service).

I will look into that however!

Much appreciated.

Peter

[Hosemacht]

hey there,

you could also disable smtp auth via cli:

config system mailserver - set smtp-auth disable

Regads