To set up the SMTP recipients, perform the following subtasks:
Add the SMTP recipients
Configure the SMTP recipient listing for email notifications
Enable the CLI configuration mode:
hostname > enablehostname # configure terminalEnable email notifications:
hostname (config) # fenotify email enableAdd a recipient for email notifications:
hostname (config) # fenotify email recipient rnameSelect a recipient to receive email notifications (one recipient per command):
hostname (config) # fenotify email recipient rname enableSpecify the email address for a recipient who will receive email notifications:
hostname (config) # fenotify email recipient rname email-address email_addressSave the configuration:
hostname (config) # write memory
Enable the CLI configuration mode:
hostname > enablehostname # configure terminalEnable email notifications:
hostname (config) # fenotify email enableSelect one of the XML, JavaScript Object Notation (JSON), or Text options for the format of the notifications received by a specified recipient:
Note
The json_legacy-concise, json_legacy-extended, and json_legacy-normal formats are deprecated.
To send notifications in XML Concise format containing basic information such as alert type, ID, source IP, malware name, hostname, and alert URL, enter:
hostname (config) # fenotify email recipient rname prefer message format xml-concise
To send notifications in XML Extended format containing detailed information and abstracts including data-theft information (if any) and static-analysis details (XML Extended provides all details about files and objects modified during analysis.), enter:
hostname (config) # fenotify email recipient rname prefer message format xml-extended
To send notifications in XML Normal format containing detailed information and abstracts such as alert type, ID, source IP, malware name, hostname, and alert URL without any redundant information, enter:
hostname (config) # fenotify email recipient rname prefer message format xml-normalTo send notifications in JSON Concise format containing basic information such as alert type, ID, source IP, malware name, hostname, and alert URL, enter:
hostname (config) # fenotify email recipient rname prefer message format json-conciseTo send notifications in JSON Extended format containing detailed information and abstracts including data-theft information (if any) and static-analysis details (JSON Extended provides all details about files and objects modified during analysis.), enter:
hostname (config) # fenotify email recipient rname prefer message format json-extendedTo send notifications in JSON Normal format containing detailed information and abstracts such as alert type, ID, source IP, malware name, hostname, and alert URL without any redundant information, enter:
hostname (config) # fenotify email recipient rname prefer message format json-normalTo send notifications in Text Concise format containing basic information such as alert type, ID, source IP, malware name, hostname, and alert URL, enter:
hostname (config) # fenotify email recipient rname prefer message format text-conciseTo send notifications in Text Extended format containing detailed information and abstracts including data-theft information (if any) and static-analysis details (Text Extended provides all details about files and objects modified during analysis.), enter:
hostname (config) # fenotify email recipient rname prefer message format text-extended
To send notifications in Text Normal format containing detailed information and abstracts such as alert type, ID, source IP, malware name, hostname, and alert URL without any redundant information, enter:
hostname (config) # fenotify email recipient rname prefer message format text-normal
Specify how email notifications are delivered to the specified recipient:
To deliver the notification as an email attachment, enter:
hostname (config) # fenotify email recipient rname prefer message send-as attachment
To deliver the notification in the email body (the default), enter:
hostname (config) # fenotify email recipient rname prefer message send-as in-line
Specify the delivery schedule for email notifications to a specific recipient:
Note
Trellix recommends using
per-eventnotifications.To receive information about all malware objects detected in the past 24 hours, enter:
hostname (config) # fenotify email recipient rname prefer message delivery daily-digestTo send a notification each time a malware object is detected, sent when the event is triggered, enter:
hostname (config) # fenotify email recipient rname prefer message delivery per-event
Save the configuration:
hostname (config) # write memory