Cisco FTD Mail Events

[Irakli Gvishiani]

Hello,

We have Cisco FTD and FMC, version is 7.0.1

I Would like to configure FTD in such way:

When Endpoint device will be compromised then FMC must notify to me by Email. Is it possible?

[Irakli Gvishiani · Accepted solution]

As I understand need to create Correlation Policy.

As condition I use "IOC Tag", am I correct?

[Irakli Gvishiani]

As a result, I received mail from FMC:

But is it possible to somehow edit mail body? Not very informative right now

[Irakli Gvishiani]

As I figured out configuration is a correct, FMC sends alert after device was compromised, but I can't change email body