Mapping event types using the CLI

Enable the CLI configuration mode.

hostname > enable
hostname # configure terminal

Check which notification methods and event types are already enabled for notifications:

hostname (config) # show fenotify alerts

FireEye Notification Enabled: yes

FireEye Alerts:
                          email  http    rsyslog snmp    
                          --------------------------------
                  Global  yes    no      yes     no      
                          ----   ----    ----    ----    
domain-match        yes  |yes    yes     yes     yes     
infection-match     yes  |yes    yes     yes     yes     
ips-event           yes  |no     no      yes     no      
lnec-alert          no   |no     no      yes     no      
malware-callback    yes  |yes    yes     yes     yes     
malware-object      yes  |yes    yes     yes     yes     
riskware-callback   yes  |no     yes     yes     yes     
riskware-object     no   |no     yes     yes     yes     
web-infection       yes  |no     yes     yes     yes     

    Digest notification:
                 Time    : 12:00
                 Enabled : yes
					

Enable notifications using the fenotify enable command. By default, notifications are enabled. This command only enables notifications for enabled protocols.

hostname (config) # fenotify enable

Enable or disable the desired notification methods:

hostname (config) # fenotify <notification method> enable

or

hostname (config) # no fenotify <notification method> enable

For example, to enable SMTP notifications:

hostname (config) # fenotify smtp enable

Enable or disable the desired event types globally:

hostname (config) # fenotify alerts <alert type> enable

or

hostname (config) # no fenotify alerts <alert type> enable

For example, to enable the event type lnec-alert globally:

hostname (config) # fenotify alert lnec-alert enable

Map the desired event types to specific notification methods:

hostname (config) # fenotify <notification method> alert <event type> enable

or

hostname (config) # no fenotify <notification method> alert <event type> enable

For example, to enable the lnec-alert event type to use the rsyslog notification method:

hostname (config) # fenotify rsyslog alert lnec-alert enable

Send a test message to all enabled recipients:

hostname (config) # fenotify <notification method> send-test

For example, to send a test notification using email:

hostname (config) # fenotify email send-test

Note

• Before you can test notifications, you need to add one or more recipients. To add an email recipient, see Adding email (SMTP) recipients using the CLI.

• Test messages generated for event notifications appear on the Alerts tab for five minutes.

Save the configuration:

hostname (config) # write memory