To set up the SMTP recipients, perform the following subtasks:
Add the SMTP recipients.
Configure the SMTP recipient listing for email notifications,
Go to CLI configuration mode:
hostname > enablehostname # configure terminalEnable email notifications:
hostname (config) # fenotify email enableAdd a recipient for email notifications:
hostname (config) # fenotify email recipient <rname>Select a recipient to receive email notifications (one recipient per command):
hostname (config) # fenotify email recipient <rname> enableSpecify the email address for a recipient who will receive email notifications:
hostname (config) # fenotify email recipient <rname> email-address <email_address>Save the configuration:
hostname (config) # write memory
Go to CLI configuration mode:
hostname > enablehostname # configure terminalEnable email notifications:
hostname (config) # fenotify email enableSelect one of the XML, JavaScript Object Notation (JSON), or Text options for the format of the notifications received by a specified recipient:
Note
The json_legacy-concise, json_legacy-extended, and json_legacy-normal formats are deprecated.
To send notifications in XML Concise format containing basic information such as alert type, ID, source IP, malware name, hostname, and alert URL, enter:
hostname (config) # fenotify email recipient <rname> prefer message format xml-conciseTo send notifications in XML Extended format containing detailed information and abstracts including data-theft information (if any) and static-analysis details (XML Extended provides all details about files and objects modified during analysis.), enter:
hostname (config) # fenotify email recipient <rname> prefer message format xml-extended
To send notifications in XML Normal format containing detailed information and abstracts such as alert type, ID, source IP, malware name, hostname, and alert URL without any redundant information, enter:
hostname (config) # fenotify email recipient <rname> prefer message format xml-normal
To send notifications in JSON Concise format containing basic information such as alert type, ID, source IP, malware name, hostname, and alert URL, enter:
hostname (config) # fenotify email recipient <rname> prefer message format json-conciseTo send notifications in JSON Extended format containing detailed information and abstracts including data-theft information (if any) and static-analysis details (JSON Extended provides all details about files and objects modified during analysis.), enter:
hostname (config) # fenotify email recipient <rname> prefer message format json-extendedTo send notifications in JSON Normal format containing detailed information and abstracts such as alert type, ID, source IP, malware name, hostname, and alert URL without any redundant information, enter:
hostname (config) # fenotify email recipient <rname> prefer message format json-normalTo send notifications in Text Concise format containing basic information such as alert type, ID, source IP, malware name, hostname, and alert URL, enter:
hostname (config) # fenotify email recipient rname prefer message format text-conciseTo send notifications in Text Extended format containing detailed information and abstracts including data-theft information (if any) and static-analysis details (Text Extended provides all details about files and objects modified during analysis.), enter:
hostname (config) # fenotify email recipient rname prefer message format text-extendedTo send notifications in Text Normal format containing detailed information and abstracts such as alert type, ID, source IP, malware name, hostname, and alert URL without any redundant information, enter:
hostname (config) # fenotify email recipient rname prefer message format text-normal
Specify how email notifications are delivered to the specified recipient:
To deliver the notification as an email attachment, enter:
hostname (config) # fenotify email recipient rname prefer message send-as attachmentTo deliver the notification in the email body (the default), enter:
hostname (config) # fenotify email recipient rname prefer message send-as in-line
Enable email notifications for specified recipients when ATI alert updates are detected:
hostname (config) # fenotify email recipient <rname> alerts-update enableSpecify the delivery frequency for email notifications:
Note
Trellix recommends using
per-eventnotifications.To receive information about all events detected in the past 24 hours, enter:
hostname (config) # fenotify email delivery daily-digestTo receive a daily notification for each entity that was the source of the event, enter:
hostname (config) # fenotify email delivery daily-per-sourceTo receive an hourly notification for each entity that was the source of the event, enter:
hostname (config) # fenotify email delivery hourly-per-sourceTo receive a notification every minute for each entity that was the source of the event, enter:
hostname (config) # fenotify email delivery per-1min-per-sourceTo receive a notification every 5 minutes for each entity that was the source of the event, enter:
hostname (config) # fenotify email delivery per-5min-per-sourceTo receive information about each event, sent when the event is triggered, enter:
hostname (config) # fenotify email delivery per-event
Save the configuration:
hostname (config) # write memory