Dear all. I configured IPS on firepower and configured it to send me email when it is being triggered. I configured it on Policy-Action->Alert->Intrusion Email. All IPS rules has been selected. Approximately two days later of configuring IPS notification, i observed that Select All box unchecked like on attachment. could you please tell me why it is unchecked by itself.
Do you think it is normal that IPS email notification rules changes automatically every time Firepower Recommendation being updated?
I'm not positive but it is the only thing I could think would change it without you having done it yourself.
You could open a TAC case to confirm.