FireSight docsFireSight Firewall rules
Notifications
FireSight sends device health alerts by email and to Microsoft Teams, Slack or any webhook that accepts JSON. Administrators set them up under Settings, Notifications.
FireSight also emails people about rule requests: see Rule request emails.
| Setting | Default | Meaning |
|---|---|---|
| Send alerts by email | off | Turns email on. |
| SMTP server | empty | Your mail server or relay, such as smtp.corp.example. |
| Port | 587 | |
| Security | STARTTLS (port 587) | STARTTLS (port 587), TLS (port 465), or None (internal relay only). |
| Sender | empty | The From address, such as firesight@corp.example. |
| User name | empty | Leave empty for a relay that doesn't need a sign-in. |
| Password | empty | Stored encrypted; never shown again. Shows Set once saved; type a new one to change it. |
| Recipients | empty | Separate addresses with commas, such as the NOC mailbox. |
Email needs a server, a sender and at least one recipient. Messages have the subject FireSight: followed by the alert title.
Chat and webhooks
Click Add webhook for each channel:
| Field | Meaning |
|---|---|
| Name | Such as NOC channel. |
| Type | Microsoft Teams, Slack or Generic JSON. |
| URL | Must start with https://. Webhook URLs contain their own keys, so they're stored encrypted and never shown again. A saved webhook shows Saved: with the host name; type a new URL to replace it. |
| On | Untick to pause the webhook without removing it. |
Remove deletes a webhook.
| Type | How to get the URL | What FireSight sends |
|---|---|---|
| Microsoft Teams | Create a workflow "When a Teams webhook request is received" and paste its URL. | An Adaptive Card with the title (coloured by severity) and the message. |
| Slack | An incoming webhook URL. | The title in bold and the message. |
| Generic JSON | Any HTTPS endpoint you control. | A JSON object with source (FireSight), title, text, and the event: kind, severity, message, device, connection and at. |
What to send
| Setting | Default | Sends |
|---|---|---|
| A firewall goes down | on | Down alerts. |
| A firewall comes back up | on | Up alerts. |
| A link is congested | on | Congestion alerts. |
| An interface logs errors or drops | on | Interface error alerts. |
| CPU is high | on | CPU alerts. |
| Memory is high | on | Memory alerts. |
| Also say when congestion, errors, CPU or memory are back to normal | on | The matching "cleared" alerts. |
Thresholds are under Policies & schedules, Monitoring. Firewalls can be muted on the Device health page during maintenance.
Click Save. Every change is recorded in the audit log (without the secrets).
Rule request emails
With a mail server set up under Email, FireSight emails people about rule requests. It uses each person's own email address from Settings, Users; people without one aren't emailed.
| Who | When |
|---|---|
| Approvers | A stage they can decide opens: when the request is submitted, when the stage before it is approved, and when an emergency change's review opens after deployment. Named approvers get it for their stage; otherwise everyone with the stage's role who could decide it (never the requester). |
| The requester | Their request is approved, rejected (with the approver's comment), deployed, failed to deploy, or backed out. |
| Implementers | A request is approved and ready to deploy. |
Nobody is emailed about their own action. Each email has the request's reference (such as FS-00042), its title, the traffic and justification, and a link to the request when FIRESIGHT_PUBLIC_BASE_URL is set (see Server configuration).
To stop these emails, clear Email people about rule requests under Rule requests and click Save. The Enabled switch and recipient list under Email are for device health alerts only; rule request emails go to the people involved.
Emails are sent in the background, so a slow or unreachable mail server never holds up an approval. Failures are written to FireSight's log.
Send a test
Click Send a test to send a test message to every channel that is on. The result is shown per channel, for example email: sent ยท NOC channel: sent, or the error. Save first: the test uses the saved settings. If no channel is on, the test says no channel is turned on: enable email or add a webhook first.
The test ignores the What to send choices. Each test is recorded in the audit log.
Delivery
- Each alert is sent once, when the problem starts or clears.
- A failure on one channel doesn't stop the others. Failures show as (failed) next to the alert under Recent alerts on the Device health page.
- Muted firewalls send nothing.