https://community.cisco.com/t5/network-security/fmc-disable-email-notification-for-specific-blocked-intrusions/m-p/4429290#M1082046 <P>Well, seems there are multiple sources and configurations for notifications on FMC - and I failed to identify this. The notifications I'm receiving were set by the Policies / Actions / Alerts section, which are then sent whenever matched from the policies themselves. Therefore, by disabling the email alerts from the Alerts section, and enabling only those SIDs I want from the Intrusion Email configuration page, FMC can email me only what I'm after.</P> Wed, 07 Jul 2021 14:28:43 GMT HQuest 2021-07-07T14:28:43Z https://community.cisco.com/t5/network-security/fmc-disable-email-notification-for-specific-blocked-intrusions/m-p/4428917#M1082032 <P>Running FMC 7.0.0-64, I have email notifications (Policies / Actions / Alerts / Intrusion Email) turned on for intrusion policies (Snort 3, if that makes any difference), and there are only a few of those notifications that are enabled (as set on Email Alerting per Rule Configuration). Yet, emails are also delivered for the unchecked notifications.</P><P>&nbsp;</P><P>I have followed the support configuration (<A href="https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/external_alerting_for_intrusion_events.html#ID-2212-00000254" target="_blank">https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/external_alerting_for_intrusion_events.html#ID-2212-00000254</A>).</P><P>&nbsp;</P><P>Since I do want these SIDs taking action but I do not need all the email notifications but only a handful, am I missing the correct configuration or is this just another FMC bug?</P> Wed, 07 Jul 2021 02:08:28 GMT https://community.cisco.com/t5/network-security/fmc-disable-email-notification-for-specific-blocked-intrusions/m-p/4428917#M1082032 HQuest 2021-07-07T02:08:28Z https://community.cisco.com/t5/network-security/fmc-disable-email-notification-for-specific-blocked-intrusions/m-p/4429290#M1082046 <P>Well, seems there are multiple sources and configurations for notifications on FMC - and I failed to identify this. The notifications I'm receiving were set by the Policies / Actions / Alerts section, which are then sent whenever matched from the policies themselves. Therefore, by disabling the email alerts from the Alerts section, and enabling only those SIDs I want from the Intrusion Email configuration page, FMC can email me only what I'm after.</P> Wed, 07 Jul 2021 14:28:43 GMT https://community.cisco.com/t5/network-security/fmc-disable-email-notification-for-specific-blocked-intrusions/m-p/4429290#M1082046 HQuest 2021-07-07T14:28:43Z