Endpoint Protection

 View Only
Back to discussions
Expand all | Collapse all

SEPM Notification for Single Risk Event on Failure to delete or quaranteen only

  • 1.  SEPM Notification for Single Risk Event on Failure to delete or quaranteen only

    Posted Jun 01, 2010 01:54 PM
    Hello,

    I am trying to setup some email alerts for the Single Risk Event.  Currently we are getting emails for every event discovered whether or not it was successfully deleted or quaranteened We only eed to issue tickets to our internal Help Desk to remediate any risks not automatically resolved by SEP.  I would like to be able to only send notificaition if SEP was not able to isolate the risk (suchs as not deleted or not quaranteed, etc.).  Currently the only way i can think of doing this is to define a single risk event alert  for every "action type" except for the Deleted and quaranteened.  Is there an easier way to accomplish this?

    Thanks.


  • 2.  RE: SEPM Notification for Single Risk Event on Failure to delete or quaranteen only

    Posted Jun 01, 2010 02:01 PM
    I believe that is the only way to do it with the notifications.