Define Alert Actions
Define alert actions that you can then select
to Enable
Alerts by Tag Type. Defining alert actions includes choosing
to receive the alert as an email or HTTP/HTTPS notification and
setting the alert frequency. You only receive notifications for
samples matching the alert criteria (the tag) in the digest period
you select; if AutoFocus does not detect matching samples during
the digest period, it does not send out an alert.
The default
alert action
none
cannot be edited or deleted.
Use this alert action to disable alerts for tags.Create
an alert for Unit 42 tags to receive notifications based on new
threats and attacks identified by the Unit 42 threat intelligence
research team.
- Select .
- Scroll to the bottom of theSettingstab, and clickAdd Alert Action:
- Give the alert action a descriptive name.
- Define the type of alert you want to receive:Email,HTTP, orHTTPS.
- Set the alert destination (email address or server URL).For email alerts:Enter the email address where you would like to receive Email Alerts.
For HTTP/HTTPS alerts:Enter theURLof your server that you have configured to receive HTTP/HTTPS Alerts. You can test the connectivity of the server by clicking onTest URL. If the connection is valid, (
) displays
next to the Test URLbutton.Self-signed server certificates are not supported. Server certificates must be signed by one of the pre-installed root certificate authorities (CAs). Refer to AutoFocus Portal Settings for more information on viewing trusted AutoFocus CAs. - Set the alert digest to5 MinutesorDaily.Digest sets the frequency with which AutoFocus checks for samples that match the alert criteria. AutoFocus collects all samples that match the alert criteria during the digest period and sends them in a single notification.
- (HTTPS alerts only) Define the authentication method.
For HTTPS alerts using basic authentication:Enter the user credentials of a service account on the server that you configured to receive the AutoFocus alerts.
- ClickSave Changes.The Action drop-down contains all saved alert actions, which you can apply to samples matched to Unit 42, public, and private tags.
