Hey Guys this is Jelan from Sophos Support and today we’re taking a look at Sophos
Central Alert Email settings
We’ll be walking through the configuration options for the Alert Emails, and giving some
examples of different scenarios you may want to configure for.
We’ll go through section by section starting with
Administrators
Distribution Lists
Frequency
Custom Rules
And Exceptions
Check out the time stamps in the Video Description if you need to Skip ahead to a certain section,
or rewind while watching.
Let’s jump in.
Let’s start by going to Global Settings, and clicking Configure email Alerts.
Now right off that bat you should see this page.
if you’re seeing this page:
This means your alert email settings are managed by your sophos Partner or Enterprise Admin.
So the first tab we see here is administrators.
This tab is straight forward.
You can select which administrators receive alert emails and which don’t.
You can toggle the slider on or off per Admin.
Let’s move over to the distribution Lists tab
Now here we can add emails that may not exist in your sophos Central account.
This can be convenient if you need to alert people that don’t actually need admin access
to sophos central.
You can just hit Add Email Address, and you can add in the emails you need one at a time
with an optional description.
Now let’s move over to the frequency tab, here it gets a little more configurable.
You can choose to send alert emails based on severity, product or category, but not
all three simultaneously.
Once you define one of the 3, you can then define the frequency of each subcategory.
Now under send alert you can choose either Immediately, hourly, daily, or never.
Immediately will send out an email as soon as an alert is generated in central.
Now with the Hourly and Daily settings, Alert emails will be sent out immediately upon the
alert being created in central, but with a max of 1 email per device per hour/day.
So for example if we set Medium Alerts to Hourly and we have 5 devices that all generate
a Medium alert at 11 AM, let’s say it’s an update failure.
Now once central receives the alert, it will immediately send out an alert email for each
one of those devices, so you’ll receive 5 emails.
Now if those machines all generate that exact same Medium Alert at 11:24, central will not
send out an email for those alerts.
If a different alert is generated it may send an email, but not for the same alert.
If the machines then generate that original Update failure Medium alert at 12:01, then
Central will send another email since it’s now over the 1 hour period.
The same applies for daily, but with a 24 hour period.
Note:
One thing to note here is that we’re talking about “Alerts”, not events.
The endpoint will always send “events” to central, so you’ll see them in the device's
events page like here, but Central may delay promoting that “event” to an alert in
certain situations.
For example, let's look at this malware detection.
We can see that malware was detected at 4:41 that day and immediately cleaned up.
In this instance there was no need for this event to be promoted to an alert since the
endpoint resolved the issue itself.
No alert was created, meaning no email would be sent.
Now if this detection event was not able to be cleaned up within 24 hours, it will then
become an alert which will be displayed in the dashboard.
At that point the alert will be subjected to your alert email setting.
Now keep in mind that not all alerts are delayed, and not all delayed alerts are delayed for
24 hours, the time varies per alert.
Both events and alerts can have informational, medium and High severities, but only once
an event is promoted to an alert can an email be sent out.
More info on this can be found in the Alerts FAQ which we’ve linked in the video description
If you want to revert your frequency settings back to default, you can always do so by clicking
the Restore Sophos Defaults Button on the right.
The next option we have to configure is custom rules
Now these can be great for getting more specific with what you do and don’t wanna send.
Something to keep in mind, as soon as you use a custom rule, the other configurations
in the Administrators and Distribution list sections will be bypassed.
Since Custom rules can be more granular, having both Custom and non-custom configurations
would cause conflicts for the system.
When configuring a custom rule you start by selecting which role in central you’d like
the rule to apply to.
You can only select 1 role per rule, or select none if you just wanna use a distribution
list.
Let’s select Admin for now, and click next
Here we’ll see the available users with the admin role and choose who we’d like
the rule to apply to.
We can also add a distribution list address here based on what’s in your existing distribution
list or add new emails.
Next we’ll get to the Alert Types section.
Here we can set the types of alerts we want to send and which we don’t.
Now this is strictly on/off, so you can’t configure additional frequency settings that
differ from what you set in the frequency tab.
This can be useful if for example:
certain admins needed to know about only firewall alerts, but not any other products.
Then You can get even more specific and only send High and Medium severity alerts, for
firewall products, with only the Connectify category.
There’s lots of options here so be careful when configuring custom rules.
If you do make sure you have enough custom rules that cover all your admins that in fact
need to receive alert emails, AND make sure you don’t end up suppressing potentially
important alerts.
Make sure you name your rules meaningfully, and put in good descriptions so the scope
and intentions are clear.
Now once you create your custom rule we’ll see that rule in the custom rules tab and
we’ve got a few options.
The first option is to pause the rule.
If you just have the one rule, this will bring the alert email settings back to the settings
defined in the Administrators and Distribution lists section.
Keep in mind if you have multiple custom rules, you’d need to pause all of the rules in
order for it to revert back to those settings
The key thing here is you can either use Custom rules, OR the Administrators and distribution
list configuration.
Not both simultaneously.
For example if you had 5 custom rules and paused 4, everything in the Administrators
and Distribution list will still be bypassed, and only the 1 custom rule would be active.
You can also click the pencil to edit a rule, the trash can to delete a rule, or click the
down arrow here to view the content of the rule.
The last tab we have is the exceptions tab
This section is for specific Alerts that you’ve set the send frequency for from the Alerts
page.
You can see here that I have a Real-time protection disabled alert for endpoint here that I’ve
set the send frequency to immediately.
Let’s take a look at how I did that in the Alerts section
From the Dashboard I clicked view all alerts
Then I went into that alert and opened the drop down
Under email alert, I set the frequency to Immediately, and now it’ll show up in the
Exceptions tab in Configure email alerts
From there you can also change the frequency of the exception
So that's all for me today folks, but if you have any further questions take a look at
the alert emails FAQ, or the Documentation links the in video description.
As always, safe out there.