CloudGuard Controller Monitoring

1. Enable the SmartEvent Software Blade Specific security solution (module): (1) On a Security Gateway, each Software Blade inspects specific characteristics of the traffic (2) On a Management Server, each Software Blade enables different management capabilities. on the Management Server.

   See the R81 Logging and Monitoring Administration Guide > Section Deploying SmartEvent.

2. Open the Legacy SmartEvent GUI client:

   1. From the left navigation panel, click Logs & Monitor.

   2. At the top, click the + tab.

   3. At the bottom, in the section External Apps, click SmartEvent Settings & Policy.

3. In the SmartEvent Policy tree, right-click Event policy.

   The Event Definition wizard opens.

   1. Step 1/6: In the Event Definition wizard window, below Create an event, select that is completely new > click Next.

   2. Step 2/6: In the Name field, enter a name for the Event.

      From the Severity list, select a severity for the event > click Next.

   3. Step 3/6: Select a single log > click Next.

   4. Step 4/6: Click Add product > select the checkbox for CloudGuard IaaS > click Next.

   5. Step 5/6: Below the Define the condition that specifies which {your event name} logs are appropriate for this event:

      1. Select Show more fields > Existing field.

         The Select Log Fields window opens.

      2. Below Log Fields, select Severity > click OK.

      3. Below Available Log Fields, select Severity, click Add.

         The Severity Filter window opens.

      4. Click Add, in the Value field enter the number '4' for the value (four is the highest, referred to as "critical") > click OK.

      5. Make sure that In the Event Definition wizard window, the right-side box now shows Severity Equal {x} > click Next.

         

      6. Click Finish.

      7. To install the policy, click Yes.

      Note - In the SmartEvent window that opens, click Yes to install the policy.

      There is now a User Defined Event, in this example "CloudGuard IaaS Critical", that you can connect to Automatic Reaction which you create.

Use SmartEvent to send push notifications to your mobile device or email account.

This allows you to get notification even when your not in front of SmartConsole, and even when your are not in the office.

In SmartEvent, this is called "Automatic Reaction."

For more information about how to edit an event, see the R81 Logging and Monitoring Administration Guide

1. In the SmartEvent tree, right-click User Defined Events select the event.

2. In the top field, enter the parameters for detecting an Event.

   Example, "Detect the event when at least 2 connections where detected over a period of 120 seconds".

3. Select the button to the right of the Automatic Reactions tab.

4. Select Add new > select Mail or External Script.

   The Add Automatic Reaction window opens.

   For more information about External scripts, see the R81 Logging and Monitoring Administration Guide > Section Creating an External Script Automatic Reaction.

5. In the Name field, delete the default name and enter a different name. For example, "CloudGuard IaaS alert email".

6. In the Command line field, enter the path and the name of the script. For example, "/var/log/myscript.sh".

7. Click Save.

8. In the Automatic Reactions window, click OK.

9. From the SmartEvent toolbar, click the save icon > click Yes.