Configuring the Security Risk Outbreak Criteria and Notifications

  1. Go to Administration > Notifications > Outbreak.
  2. In the Criteria tab:
    1. Go to the Virus/Malware and Spyware/Grayware sections:
    2. Specify the number of unique sources of detections.
    3. Specify the number of detections and the detection period for each security risk.
    Tip:

    Trend Micro recommends accepting the default values in this screen.

    OfficeScan sends the notification after 10 different types of virus/malware detections have reported a total of 101 security risks within a 5-hour period. If one agent has 101 virus/malware detections of any type within a 5-hour period, OfficeScan also sends an outbreak notification

  3. In the Criteria tab:
    1. Go to the Shared Folder Sessions section.
    2. Select Monitor shared folder sessions on your network.
    3. In Shared folder sessions recorded, click the number link to view the endpoints with shared folders and the endpoints accessing the shared folders.
    4. Specify the number of shared folder sessions and the detection period.

    OfficeScan sends a notification message when the number of shared folder sessions is exceeded.

  4. In the Email tab:
    1. Go to the Virus/Malware Outbreaks, Spyware/Grayware Outbreaks, and Shared Folder Session Outbreaks sections.
    2. Select Enable notification via email.
    3. Specify the email recipients.
    4. Accept or modify the default email subject and message. You can use token variables to represent data in the Subject and Message fields.
      Table 1. Token Variables for Security Risk Outbreak Notifications

      Variable

      Description

      Virus/Malware outbreaks

      %CV

      Total number of viruses/malware detected

      %CC

      Total number of endpoints with virus/malware

      Spyware/Grayware outbreaks

      %CV

      Total number of spyware/grayware detected

      %CC

      Total number of endpoints with spyware/grayware

      Shared folder session outbreaks

      %S

      Number of shared folder sessions

      %T

      Time period when shared folder sessions accumulated

      %M

      Time period, in minutes
    5. Select additional virus/malware and spyware/grayware information to include in the email. You can include the agent/domain name, security risk name, date and time of detection, path and infected file, and scan result.
    6. Accept or modify the default notification messages.
  5. In the SNMP Trap tab:
    1. Go to the Virus/Malware Outbreaks and Spyware/Grayware Outbreaks sections.
    2. Select Enable notification via SNMP trap.
    3. Accept or modify the default message. You can use token variables to represent data in the Message field. See Table 1 for details.
  6. In the NT Event Log tab:
    1. Go to the Virus/Malware Outbreaks and Spyware/Grayware Outbreaks sections.
    2. Select Enable notification via NT Event Log.
    3. Accept or modify the default message. You can use token variables to represent data in the Message field. See Table 1 for details.
  7. Click Save.
Parent topic: Security Risk Outbreak Criteria and Notifications