Email alert message from FireSIGHT

[Ve Con]

Hello,

I receive this email alert sending from my fireSIGHT

<*- New Client From "SourcePower IP" at Mon May  2 20:04:14 2016 UTC -*>   IP Address: <internal server> HTTP Google Update 1.3.29.5

I am pretty sure this is one of the alert option that is selected but not sure which one to turns it off.  Can anyone tell me which one to turn off?  This kind of message/alert becomes annoying.

Is that mean the SourcePower sees the internal server updated google so it sent out the alert? Is that how i should understand the message?

Thanks!

[ankojha]

Hi,

Yes, it is the message alerting that internal server has encountered google update and that is why it is sending you alert. It depends on the setting you have done for email alerts if you want to turn it off.

Could you check if you check for which rules you have enabled alerting and then try to find out which intrusion /access policy is this traffic using and probably you can turn off alerting on that rule.

Rate if that helps!!

Thanks

Ankita