Monitoring and Handling Alerts

Alerts provide real-time information about possible security threats, and how to avoid, minimize, or recover from the damage. The administrator can define alerts to be sent for different gateways and for certain policies or properties.

The gateways send alerts to the Security Management Server. The Security Management Server forwards these alerts to SmartView Monitor. By default, an alert is sent as a pop-up message to the administrator desktop when a new alert arrives to SmartView Monitor.

You can set global alert parameters for all gateways in the system, or specify an action to send an alert for a particular gateway.

Alerts are sent when:

• Rules or attributes which are set to be tracked as alerts are matched by a passing connection.
• System events (also called System Alerts) are configured to cause an alert when different predefined thresholds are surpassed.

System Alerts are sent for predefined system events or for important situation updates. For example, if free disk space is less than 10%, or if a security policy is changed. System Alerts can also be defined for each product. For example, you can define other System Alerts for Check Point QoS.