Mail Server
The Mail Server page allows you to configure email alerts and create custom delivery rules, ensuring timely and precise notifications of security incidents. This flexibility enhances your security monitoring by allowing you to tailor alerts based on specific criteria.
Incident alerts
Enable and configure email alerts for immediate notification of security events.
To send incident alerts:
- Go to System > Mail Server. The Mail Server page opens.
- Click Mail server configuration. The Configure Mail Server Settings page opens.
- Configure the mail server settings.
Send Incidents Alerts
Enable to send incident alerts.
SMTP Server Address
SMTP server address.
Port
SMTP server port number.
From
The mail server email account. This is the "from" address.
Login User
The mail server login account.
Login Password
Enter and confirm the password.
- (Optional) Click Send Test Email to send a test email to one or more email addresses. If an error occurs, the error message appears at the top of the page and is recorded in the System Logs.
- Click Save.
-
Click Back to return to the Mail Server page.
Alert delivery rules
Set detailed criteria for alerts, including severity, type, and attacker information, to ensure relevant alerts are sent to the right recipients.
To create an alert delivery rule:
- Go to System > Mail Server. The Mail Server page opens.
- Click Create alert delivery rule. The Create Alert Rule pane opens.
- Configure the rule settings.
Enable
When enabled, FortiDeceptor sends email alerts to the Receiver Email List based on the specified rule.
Name
Enter a name for the rule.
Incident URL
When enabled, the device hostname is used instead of the management IP.
For the Incident URL link to work, your DNS server must be able to resolve the device hostname.
Alert Severity
Select Low, Medium, High, or Critical.
Alert Type
Select Connection, Reconnaissance, Interaction, and Infection.
Binary Infection
This options is available when the Alert Type is Interaction or Infection.
Select Yes to be alerted when an attacker drops or downloads suspicious files into decoys.
Incident Alert Section
Select All, Interaction Events Only, IPS events only, or Web filter events only.
Attacker IP/Subnet
Enter one or more values for the attacker IP address or attacker IP network.
Attacker User
Enter one or more attacker usernames. The rule is triggered only if the username entered by the attacker matches the value for Attacker Userexactly, including case sensitivity.
Attacker Password
Enter one or more attacker passwords. The rule is triggered only if the password entered by the attacker matches the value for Attacker Password exactly, including case sensitivity.
Operation Content
Enter one or more keywords that will trigger the rule. Operation Content supports both exact and partial matches. For example, if the keyword is "Monkey" and the attacker enters "Key," the rule is triggered. However, it will not trigger if the attacker only enters "ey." Operation Content is not case sensitive.
Victim Decoy Name
Select one or more deployed decoys from the Select Entries pane that slides open.
Victim Decoy Port
Enter one or more decoy service port numbers.
Recipients
Enter one or more receiver email addresses.
Display Original Recipient
Enable to view the original recipient of the alert email message.
Condition operators:
- And: All the values must be met to trigger the rule. For example, the rule is not triggered if the value for Attacker IP/Subnet is met, but the value for Attacker User is not.
- Or: Only one of the values must be me to trigger the rule. For example, if the values for Attacker User are Admin and Administrator, the rule is triggered if only Admin is entered.
- Click Save.