Use the CLI commands in this topic to set up the default configuration for HTTP notifications.
Enable the CLI configuration mode:
hostname > enablehostname # configure terminalEnable HTTP notifications:
hostname (config) # fenotify http enableSpecify the default delivery schedule for HTTP notifications:
Note
Trellix recommends using
per-eventnotifications.To send a daily notification of all malware objects detected the past 24 hours in the selected format and level of details (default is Concise), enter:
hostname (config) # fenotify http default delivery daily-digest
To send a notification each time a malware object is detected, enter:
hostname (config) # fenotify http default delivery per-event
Specify the default service provider. The default service provider is
generic.Note
Trellix recommends using the
genericservice provider.To select Aruba as the provider, enter:
hostname (config) # fenotify http default provider aruba
To select the generic provider, enter:
hostname (config) # fenotify http default provider generic
Select one of the XML, JavaScript Object Notation (JSON), or Text options for the default format of the notification where
service_nameis the name of the HTTP server that posts the notification:Note
The json_legacy-concise, json_legacy-extended, and json_legacy-normal formats are deprecated.
To post notifications in JSON Concise format containing basic information such as alert type, ID, source IP, malware name, hostname, and alert URL, enter:
hostname (config) # fenotify http service service_name provider generic message format json-conciseTo post notifications in JSON Extended format containing detailed information and abstracts including data-theft information (if any) and static-analysis details (JSON Extended provides all details about files and objects modified during analysis.), enter:
hostname (config) # fenotify http service service_name provider generic message format json-extendedTo post notifications in JSON Normal format containing detailed information and abstracts such as alert type, ID, source IP, malware name, hostname, and alert URL without any redundant information, enter:
hostname (config) # fenotify http service service_name provider generic message format json-normalTo post notifications in Text Concise format containing basic information such as alert type, ID, source IP, malware name, hostname, and alert URL, enter:
hostname (config) # fenotify http service service_name provider generic message format text-conciseTo post notifications in Text Extended format containing detailed information and abstracts including data-theft information (if any) and static-analysis details (Text Extended provides all details about files and objects modified during analysis.), enter:
hostname (config) # fenotify http service service_name provider generic message format text-extended
To post notifications in Text Normal format containing detailed information and abstracts such as alert type, ID, source IP, malware name, hostname, and alert URL without any redundant information, enter:
hostname (config) # fenotify http service service_name provider generic message format text-normal
To post notifications in XML Concise format containing basic information such as alert type, ID, source IP, malware name, hostname, and alert URL, enter:
hostname (config) # fenotify http service service_name provider generic message format xml-conciseTo post notifications in XML Extended format containing detailed information and abstracts including data-theft information (if any) and static-analysis details (XML Extended provides all details about files and objects modified during analysis.), enter:
hostname (config) # fenotify http service service_name provider generic message format xml-extendedTo post notifications in XML Normal format containing detailed information and abstracts such as alert type, ID, source IP, malware name, hostname, and alert URL without any redundant information, enter:
hostname (config) # fenotify http service service_name provider generic message format xml-normal
Select one of the XML, JavaScript Object Notation (JSON), or Text options for the default format of the notification where
service_nameis the name of the HTTP server that posts the notification:Note
The json_legacy-concise, json_legacy-extended, and json_legacy-normal formats are deprecated.
To post notifications in XML Concise format containing basic information such as alert type, ID, source IP, malware name, hostname, and alert URL, enter:
hostname (config) # fenotify http service service_name provider generic message format xml-conciseTo post notifications in XML Extended format containing detailed information and abstracts including data-theft information (if any) and static-analysis details (XML Extended provides all details about files and objects modified during analysis.), enter:
hostname (config) # fenotify http service service_name provider generic message format xml-extendedTo post notifications in XML Normal format containing detailed information and abstracts such as alert type, ID, source IP, malware name, hostname, and alert URL without any redundant information, enter:
hostname (config) # fenotify http service service_name provider generic message format xml-normal
To post notifications in JSON Concise format containing basic information such as alert type, ID, source IP, malware name, hostname, and alert URL, enter:
hostname (config) # fenotify http service service_name provider generic message format json-conciseTo post notifications in JSON Extended format containing detailed information and abstracts including data-theft information (if any) and static-analysis details (JSON Extended provides all details about files and objects modified during analysis.), enter:
hostname (config) # fenotify http service service_name provider generic message format json-extendedTo post notifications in JSON Normal format containing detailed information and abstracts such as alert type, ID, source IP, malware name, hostname, and alert URL without any redundant information, enter:
hostname (config) # fenotify http service service_name provider generic message format json-normalTo post notifications in Text Concise format containing basic information such as alert type, ID, source IP, malware name, hostname, and alert URL, enter:
hostname (config) # fenotify http service service_name provider generic message format text-conciseTo post notifications in Text Extended format containing detailed information and abstracts including data-theft information (if any) and static-analysis details (Text Extended provides all details about files and objects modified during analysis.), enter:
hostname (config) # fenotify http service service_name provider generic message format text-extendedTo post notifications in Text Normal format containing detailed information and abstracts such as alert type, ID, source IP, malware name, hostname, and alert URL without any redundant information, enter:
hostname (config) # fenotify http service service_name provider generic message format text-normal
Save the configuration:
hostname (config) # write memory