How to get notified realtime by email when infected items is detected ?

[John Santana]

Hi Folks,

How can I get email notification when there is infeceted items in the drive ?

[Mithun Sanghavi]

Hello,

Yes, you can create notification for the same. Check these steps:

• SEPM >> Monitors page >> Notifications >> Notification Conditions
• Add >> and you have two options here
• You can select "New Risk Detected" or "Single Risk event"
• Edit each as you see fit and save them.

However, SEPM has few notifications which are preconfigured.

In your case, SEPM has the "New risk detected", "Risk outbreak" and "Single risk event" preconfigured.

Check this Article:

About the preconfigured notifications

http://www.symantec.com/docs/HOWTO55128

Hope that helps!!

[Migration User]

Hi John ,

 

Check this thread may help you.

https://www-secure.symantec.com/connect/forums/configure-instant-email-notification-detected-threat-sep11#comment-3724661

[Rafeeq]

Check this article

Creating notifications in the Symantec Endpoint Protection Manager

http://service1.symantec.com/SUPPORT/ent-security.nsf/2326c6a13572aeb788257363002b62aa/d28e5621b64d9ddb88257543007672ff

[Migration User]

You need to use a specific notification conditions - have a look here:

About the preconfigured notifications

Article:HOWTO55128

|

Created: 2011-06-29

|

Updated: 2011-12-16

|

Article URL http://www.symantec.com/docs/HOWTO55128

...particular of interest in this case would be:

 

New risk detected

This notification triggers whenever a new risk is detected by virus and spyware scans.

Risk outbreak

This notification alerts administrators about security risk outbreaks. You set the number and type of occurrences of new risks and the time period within which they must occur to trigger the notification. Types of occurrences include occurrences on any computer, occurrences on a single computer, or occurrences on distinct computers.

This notification condition is enabled by default

Single risk event

This notification triggers upon the detection of a single risk event and provides details about the risk. The details include the user and the computer involved, and the actions taken by the management server.

[Migration User]

Agree with the above postings.

However, keep in mind that SEPM is only able to trigger a notification/e-mail if it has received the client logs with the virus incident. Client logs are always sent in the heartbeat interval, so depending on your heartbeat interval it may take several minutes (or in extreme cases even hours) until the SEPM gets the virus alert message and can trigger the notification/e-mail.

There are a lot of parameters to calibrate the heartbeat interval. To get quick notifications is one of them.

[AjinBabu]

Hi,

Email Server configurations

Option	Description
Server Address	IP address, host name, or domain name of the email server.
Port Number	Port number for the email server that sends the notifications.
Sender email address	Specify the email address from which notifications should be sent. If this text box is left blank, SEPM_Server@computer name sends the notifications.
User name	User name of the account on the email server.
Password	Password of the account on the mail server. This field is mandatory if the email server requires authentication.
Require the server to use a secure connection (SSL)	Check this box if your email server requires a secure connection.

 

Then you can log on to SEPM à Monitor Tabà Notificationsà Notification conditions

Add a new condition and e-mail address.

# note in case of Pull communication You may not get an real time notifications (depends up on the heart beat interval) 

Regards

Ajin

 

[John Santana]

Cool,

Let me test it first guys.

Thanks for the suggestion !

[Migration User]

try this, http://www.symantec.com/business/support/index?page=content&id=HOWTO55128

[Migration User]

Hi

Please refer the article below

http://www.symantec.com/docs/HOWTO55128

Regards