Configuring alert settings for intrusion prevention objects

Configure alert settings for intrusion prevention objects to notify you about suspect activity. Alert settings include configuring notifications about events through email, SNMP, and remote syslog alerts.

Configuring SNMP alert objects
Create Simple Network Management Protocol (SNMP) notification alerts for the Network Access, Intrusion Prevention, IPS Event Filter, Advanced Threat Policy, and OpenSignature policies. The SNMP notifications alerts identify certain values and send them to an SNMP Manager. You can also configure SNMP alert objects to enable the appliance to send system alerts to an SNMP Manager.
Configuring email alert objects
You can create email alert objects to send an email notification to specified users or to administrators when specified events occur on your network. You can also select the event parameters to include in the message so that important information about detected events is provided.
Configuring remote syslog alert objects
Create remote system log alert objects to add a record to the remote log file when a network access policy rule, an intrusion prevention rule, an IPS event filter rule, an advanced threat policy, or an OpenSignature policy is triggered. You can also configure remote syslog alert objects to enable the appliance to record system events in a remote log file.
Configuring quarantine response objects
Create quarantine response objects for the Intrusion Prevention policy, the IPS Event Filter policy, the Advanced Threat Policy, and the OpenSignature Policy in response to Advanced Threat or IPS events that are detected by the Network Security appliance.

Parent topic: Inspection objects