"
Is there a way to send an email alert when a Firewall is triggered?
I realize this can lead to a lot of spam, but if the alerts are properly throttled, it can be handled.
The rule is set up to block outbound communications to known bad actors. If an internal computer actually attempts to contact the bad actor, then there is something bad going on with that computer. It would be prudent to check that machine for malware.
The email would be like:
There would be an option to send the message only once until the alert is cleared. Possibly with reminders until the alert is cleared.
Or perhaps just send a summary message hourly/daily about machines that violated the rule.
I realize this can lead to a lot of spam, but if the alerts are properly throttled, it can be handled.
The rule is set up to block outbound communications to known bad actors. If an internal computer actually attempts to contact the bad actor, then there is something bad going on with that computer. It would be prudent to check that machine for malware.
The email would be like:
Code Select
"<computer name|ip> violated the known_abusers outbound firewall rule."There would be an option to send the message only once until the alert is cleared. Possibly with reminders until the alert is cleared.
Or perhaps just send a summary message hourly/daily about machines that violated the rule.
