Configure the following event notification to notify administrators when a spyware/grayware included in the list of monitored spyware/grayware threats has been detected.
-
Go to Detections > Notifications > Event Notifications.
The Event Notifications screen appears.
-
Click Known Threat
Activity.
A list of events appears.
-
In the Event column, click Special spyware/grayware alert.
The Special Spyware/Grayware Alert screen appears.
- Type the names of the spyware/grayware to monitor.
-
Specify the following notification settings.
Settings
Description
Period
Specify the period of time.
-
Select recipients for the notification.
- From the Available Users and Groups list, select contact groups or user accounts.
-
Click >.
The selected contact groups or user accounts appear in the Selected Users and Groups list.
-
Enable one or more of the following notification methods.
Method
Description
Email message
To customize the email notification template, use supported token variables or modify the text in the Subject and Message fields.
For more information, see Standard Token Variables and Known Threat Activity Token Variables.
Windows event log
To customize the notification template, use supported token variables or modify the text in the Message field.
For more information, see Standard Token Variables and Known Threat Activity Token Variables.
Trigger application
Specify the full path of the application file and any parameters for the command.
Syslog
Apex Central can direct syslogs to supported third-party products, including Cisco Security Monitoring, Analysis and Response (MARS).
- To test if recipients can receive the event notification, click Test.
- Click Save.