Complete. Simple. Affordable Copyright 2014 AlienVault. All rights reserved.
AlienVault, AlienVault Unified Security Management, AlienVault USM, AlienVault Open Threat Exchange, AlienVault OTX, Open Threat Exchange, AlienVault OTX Reputation Monitor, AlienVault OTX Reputation Monitor Alert, AlienVault OSSIM and OSSIM are trademarks or service marks of AlienVault.
CONTENTS 1. INTRODUCTION... 4 2. CONCEPTS... 4 3. REQUIREMENTS... 4 4. HOW TO RECEIVE AN EMAIL WHEN A NORMAL EVENT OCCURS... 4 5. HOW TO RECEIVE AN EMAIL WHEN A DIRECTIVE EVENT OCCURS... 12 DC-00153 Edition 00 Copyright 2014 AlienVault. All rights reserved. Page 3 of 17
1. INTRODUCTION This document describes how AlienVault USM sends emails that include alerts previously defined. These alerts are events that arrive to the user through an email and the events always meet the requirements defined in a created policy. 2. CONCEPTS In AlienVault, one normalized log file entry corresponds to a single Event. There are 2 types of events: normal event and directive event. Normal events. Events generated by external Data Sources. Directive events. Events generated by the AlienVault Server. Policy. A set of rules defined by a user to specify the behavior of events. 3. REQUIREMENTS The following requirements are necessary for receiving emails when an event occurs: 1. Create a new policy. 2. Select or create a new DS Group. 3. Create an action. 4. HOW TO RECEIVE AN EMAIL WHEN A NORMAL EVENT OCCURS 1. Choose Configuration > Threat Intelligence : 2. This window includes 2 parts. The upper part Default Policy Group refers to normal events and the bottom part Policies for events generated in server refers to directive events. DC-00153 Edition 00 Copyright 2014 AlienVault. All rights reserved. Page 4 of 17
3. Click on New to create a new policy and enter a policy rule name. Then, enter the conditions and the consequences. When you click on a condition or on a consequence, the tab that corresponds to it will be opened. DC-00153 Edition 00 Copyright 2014 AlienVault. All rights reserved. Page 5 of 17
4. Select one or more DS Group or insert a new one if it is not yet created. Remove the mark ( ) on ANY to have the possibility of selecting specific DS Groups. A DS Group can be created from Configuration > Threat Intelligence > Data Source or clicking on INSERT NEW DS GROUP?. DC-00153 Edition 00 Copyright 2014 AlienVault. All rights reserved. Page 6 of 17
It is recommended to define a suitable policy in order to avoid a large number of emails. It can happen that a DS Group cannot be selected, as it is displayed in the image: DC-00153 Edition 00 Copyright 2014 AlienVault. All rights reserved. Page 7 of 17
This case happens when a DS Group includes normal events and directive events. That DS Group cannot be selected and displays this icon ( ). 5. Click on Actions and insert a new action: DC-00153 Edition 00 Copyright 2014 AlienVault. All rights reserved. Page 8 of 17
6. Click on INSERT NEW ACTION?. An action can be also created from Configuration > Threat Intelligence > Actions. DC-00153 Edition 00 Copyright 2014 AlienVault. All rights reserved. Page 9 of 17
7. Fill the fields out and click on SAVE, then click on UPDATE POLICY. DC-00153 Edition 00 Copyright 2014 AlienVault. All rights reserved. Page 10 of 17
8. Select the policy and click on Reload Policies to add the created policy. Once this button is clicked, the emails begin to be sent. DC-00153 Edition 00 Copyright 2014 AlienVault. All rights reserved. Page 11 of 17
Check the Spam filter if there are no emails in your mailbox. 5. HOW TO RECEIVE AN EMAIL WHEN A DIRECTIVE EVENT OCCURS 1. Choose Configuration > Threat Intelligence : 2. This window includes 2 parts. The upper part Default Policy Group refers to normal events and the bottom part Policies for events generated in server refers to directive events. DC-00153 Edition 00 Copyright 2014 AlienVault. All rights reserved. Page 12 of 17
3. Click on New to create a new policy and enter a policy rule name. Then, enter the Event Type (DS Group) and the consequences. When you click on the conditions or on consequences, the tab that corresponds to it will be opened. 4. Select one or more DS Group or insert a new one if is not yet created. A DS Group can be created from Configuration > Threat Intelligence > Data Source or clicking on INSERT NEW DS GROUP?. Make sure that only Directive events have been selected for a DS Group. If not, this new DS Group would not appear in the selector. DC-00153 Edition 00 Copyright 2014 AlienVault. All rights reserved. Page 13 of 17
It is recommended to define a suitable policy in order to avoid a large number of emails. 5. Click on Actions and insert a new action by clicking on INSERT NEW ACTION?. An action can be also created from Configuration > Threat Intelligence > Actions. DC-00153 Edition 00 Copyright 2014 AlienVault. All rights reserved. Page 14 of 17
6. Fill the fields out and click on SAVE. DC-00153 Edition 00 Copyright 2014 AlienVault. All rights reserved. Page 15 of 17
7. Click on UPDATE POLICY. 8. Click on Reload Policies to add the created policy. Once this button is clicked, the emails begin to be sent. DC-00153 Edition 00 Copyright 2014 AlienVault. All rights reserved. Page 16 of 17
Check the Spam filter if there are no emails in your mailbox. DC-00153 Edition 00 Copyright 2014 AlienVault. All rights reserved. Page 17 of 17