Configuring SmartVision alert notifications using the CLI

Make sure the notification services you want to use are globally enabled.

Use the show fenotify alerts command and check the Global row. See Globally enabled Trellix event notification services.

If an event notification service you want to use is globally disabled, enable it by using the following command:

fenotify <protocol> enable

Replace the <protocol> variable with email, http, rsyslog, or snmp.

The following example globally enables all Trellix event notification services:

hostname (config) # fenotify email enable
hostname (config) # fenotify http enable
hostname (config) # fenotify rsyslog enable
hostname (config) # fenotify snmp enable

Make sure the services and service consumers are configured and enabled.

For details, see “Configuring Event Notifications” in the Network Security User Guide.

Make sure the distribution of SmartVision alerts is globally enabled.

Use the show fenotify alerts command and check the Global column. See Globally Enabled Distribution of SmartVision alerts.

If SmartVision alerts are globally disabled, use the following command to enable them:

hostname (config) # fenotify alert smartvision-event enable

Enable SmartVision alert notifications for each service you want to use.

By manufacturing default, SmartVision alert notifications are disabled for all notification services. See SmartVision alerts enabled for individual notification services.

To enable SmartVision alert distribution by a Trellix event notification service, use the following command. Replace the <protocol> variable with the protocol for the notification service (email, http, rsyslog, or snmp).

fenotify <protocol> alert smartvision-event enable

The following example enables SmartVision alert distribution by all Trellix event notification services:

hostname (config) # fenotify email alert smartvision-event enable
hostname (config) # fenotify http alert smartvision-event enable
hostname (config) # fenotify rsyslog alert smartvision-event enable
hostname (config) # fenotify snmp alert smartvision-event enable

Verify that a test-fired SmartVision event triggers the expected notifications.

hostname (config) # fenotify test-fire smartvision-event
Sending test notification...

For details, including a Web UI procedure, see the Network Security User Guide.

View your changes.

hostname (config) # show fenotify alerts

(Optional) Filter Trellix event notifications for alerts by severity.

See Filtering SmartVision event notifications by severity.