To set up the SMTP recipients, perform the following subtasks:
Add the SMTP recipients
Configure the SMTP recipient listing for email notifications
Enable the CLI configuration mode:
hostname > enable hostname # configure terminal
Enable email notifications:
hostname (config) # fenotify email enable
Add a recipient for email notifications:
hostname (config) # fenotify email recipientrname
Select a recipient to receive email notifications (one recipient per command):
hostname (config) # fenotify email recipientrnameenable
Specify the email address for a recipient who will receive email notifications:
hostname (config) # fenotify email recipientrnameemail-addressemail_address
Save the configuration:
hostname (config) # write memory
Enable the CLI configuration mode:
hostname > enable hostname # configure terminal
Enable email notifications:
hostname (config) # fenotify email enable
Select one of the XML, JavaScript Object Notation (JSON), or Text options for the format of the notifications received by a specified recipient:
Note
The json_legacy-concise, json_legacy-extended, and json_legacy-normal formats are deprecated.
To send notifications in XML Concise format containing basic information such as alert type, ID, source IP, malware name, hostname, and alert URL, enter:
hostname (config) # fenotify email recipientrnameprefer message format xml-concise
To send notifications in XML Extended format containing detailed information and abstracts including data-theft information (if any) and static-analysis details (XML Extended provides all details about files and objects modified during analysis.), enter:
hostname (config) # fenotify email recipientrnameprefer message format xml-extended
To send notifications in XML Normal format containing detailed information and abstracts such as alert type, ID, source IP, malware name, hostname, and alert URL without any redundant information, enter:
hostname (config) # fenotify email recipient rnameprefer message format xml-normal
To send notifications in JSON Concise format containing basic information such as alert type, ID, source IP, malware name, hostname, and alert URL, enter:
hostname (config) # fenotify email recipientrnameprefer message format json-concise
To send notifications in JSON Extended format containing detailed information and abstracts including data-theft information (if any) and static-analysis details (JSON Extended provides all details about files and objects modified during analysis.), enter:
hostname (config) # fenotify email recipientrnameprefer message format json-extended
To send notifications in JSON Normal format containing detailed information and abstracts such as alert type, ID, source IP, malware name, hostname, and alert URL without any redundant information, enter:
hostname (config) # fenotify email recipientrnameprefer message format json-normal
To send notifications in Text Concise format containing basic information such as alert type, ID, source IP, malware name, hostname, and alert URL, enter:
hostname (config) # fenotify email recipientrnameprefer message format text-concise
To send notifications in Text Extended format containing detailed information and abstracts including data-theft information (if any) and static-analysis details (Text Extended provides all details about files and objects modified during analysis.), enter:
hostname (config) # fenotify email recipientrnameprefer message format text-extended
To send notifications in Text Normal format containing detailed information and abstracts such as alert type, ID, source IP, malware name, hostname, and alert URL without any redundant information, enter:
hostname (config) # fenotify email recipient rnameprefer message format text-normal
Specify how email notifications are delivered to the specified recipient:
To deliver the notification as an email attachment, enter:
hostname (config) # fenotify email recipientrnameprefer message send-as attachment
To deliver the notification in the email body (the default), enter:
hostname (config) # fenotify email recipientrnameprefer message send-as in-line
Specify the delivery schedule for email notifications to a specific recipient:
Note
Trellix recommends using
per-eventnotifications.To receive information about all malware objects detected in the past 24 hours, enter:
hostname (config) # fenotify email recipientrnameprefer message delivery daily-digest
To send a notification each time a malware object is detected, sent when the event is triggered, enter:
hostname (config) # fenotify email recipientrnameprefer message delivery per-event
Save the configuration:
hostname (config) # write memory