FireSight docsNotifications
FireSight sends device health alerts by email and to Microsoft Teams, Slack or any webhook that accepts JSON. Administrators set them up under Settings, Notifications.
Notifications are for device health only. FireSight doesn't send notifications about rule requests or approvals.
| Setting | Default | Meaning |
|---|---|---|
| Send alerts by email | off | Turns email on. |
| SMTP server | empty | Your mail server or relay, such as smtp.corp.example. |
| Port | 587 | |
| Security | STARTTLS (port 587) | STARTTLS (port 587), TLS (port 465), or None (internal relay only). |
| Sender | empty | The From address, such as firesight@corp.example. |
| User name | empty | Leave empty for a relay that doesn't need a sign-in. |
| Password | empty | Stored encrypted; never shown again. Shows Set once saved; type a new one to change it. |
| Recipients | empty | Separate addresses with commas, such as the NOC mailbox. |
Email needs a server, a sender and at least one recipient. Messages have the subject FireSight: followed by the alert title.
Chat and webhooks
Click Add webhook for each channel:
| Field | Meaning |
|---|---|
| Name | Such as NOC channel. |
| Type | Microsoft Teams, Slack or Generic JSON. |
| URL | Must start with https://. Webhook URLs contain their own keys, so they're stored encrypted and never shown again. A saved webhook shows Saved: with the host name; type a new URL to replace it. |
| On | Untick to pause the webhook without removing it. |
Remove deletes a webhook.
| Type | How to get the URL | What FireSight sends |
|---|---|---|
| Microsoft Teams | Create a workflow "When a Teams webhook request is received" and paste its URL. | An Adaptive Card with the title (coloured by severity) and the message. |
| Slack | An incoming webhook URL. | The title in bold and the message. |
| Generic JSON | Any HTTPS endpoint you control. | A JSON object with source (FireSight), title, text, and the event: kind, severity, message, device, connection and at. |
What to send
| Setting | Default | Sends |
|---|---|---|
| A firewall goes down | on | Down alerts. |
| A firewall comes back up | on | Up alerts. |
| A link is congested | on | Congestion alerts. |
| An interface logs errors or drops | on | Interface error alerts. |
| CPU is high | on | CPU alerts. |
| Memory is high | on | Memory alerts. |
| Also say when congestion, errors, CPU or memory are back to normal | on | The matching "cleared" alerts. |
Thresholds are under Policies & schedules, Monitoring. Firewalls can be muted on the Device health page during maintenance.
Click Save. Every change is recorded in the audit log (without the secrets).
Send a test
Click Send a test to send a test message to every channel that is on. The result is shown per channel, for example email: sent ยท NOC channel: sent, or the error. Save first: the test uses the saved settings. If no channel is on, the test says no channel is turned on: enable email or add a webhook first.
The test ignores the What to send choices. Each test is recorded in the audit log.
Delivery
- Each alert is sent once, when the problem starts or clears.
- A failure on one channel doesn't stop the others. Failures show as (failed) next to the alert under Recent alerts on the Device health page.
- Muted firewalls send nothing.