Firesight traffic notification

[krjohnson]

at the moment, we have a 5545X /SFR setup in monitor mode so we can see the traffic breakdown in Firesight. What I'd like to do is have Firesight send a notification (via email?) if a certain type of traffic or a specific application is seen. I can do this in other IPS systems but I don't see how this might work on the ASA/Firesight setup (this is a new service for us).

If this is possible could someone give me a quick short description of what I need to look at to get me started.

thanks

kj

[Marvin Rhoads]

First make sure you have an email server setup and working. You will find this under System > Configuration > Email Notification.

Then setup a policy to send emails based on the type of traffic you're interested in. This is under Policy > Action > Alerts > Intrusion Email. Click on the "Email filtering per Rule configuration" link there to select all or specific types of traffic you want to trigger an alert.