FortiSIEM
FortiSIEM provides Security Information and Event Management (SIEM) and User and Entity Behavior Analytics (UEBA)
FortiKoala
Staff
Staff
Article Id 195376
Description

Configure ZoneFox so rules can send email alerts


Scope

Installation and Administration


Solution

When rules are created and activated, they can be configured to contain an email address to send email alerts to.  In order to send the emails, the Business Layer component has to contain the necessary SMTP server connectivity configuration details.


Edit the C:Program Files (x86)Inquisitive SystemsZoneFox.BusinessLayerZoneFox.Bl.WinServiceZoneFox.Bl.WinService.exe.config file, and add the values for your system to the <appSettings> section:


    <add key="SMTPUser" value=""/>
    <add key="SMTPHost" value=""/>
    <add key="SMTPPort" value="25"/>
    <add key="SMTPUseSsl" value="<TRUE|FALSE>"/>



Additionally add the SMTPPassword within a <secureAppSetting> section, which will be encrypted when the service first starts:


   <secureAppSetting>

      <add key="SMTPPassword" value="YourPassword" />

   </secureAppSetting>


Restart the ZoneFox.BI.Nesper and ZoneFox.BI.WinService services after making these changes.


If the rules are unable to send emails, for example if the SMTPPassword changes without the ZoneFox system being updated, the C:Program Files (x86)Inquisitive SystemsZoneFox.BusinessLayerZoneFox.Bl.WinServiceGhostAlerts folder will contain details, otherwise it is empty.



Contributors