Views:
Configure the following event notification to notify administrators when communications between multiple endpoints and known C&C callback addresses have been detected.

Procedure

  1. Go to Detections → Notifications → Event Notifications.
    The Event Notifications screen appears.
  2. Click Advanced Threat Activity.
    A list of events appears.
  3. In the Event column, click C&C callback outbreak alert.
    The C&C Callback Outbreak Alert screen appears.
  4. Specify the following notification settings.
    Settings
    Description
    C&C list source
    Select one or more C&C list sources.
    Callback attempts
    Specify the number of callback attempts.
    Compromised hosts
    Specify the number of compromised hosts.
    Period
    Specify the period of time.
  5. Select recipients for the notification.
    1. From the Available Users and Groups list, select contact groups or user accounts.
    2. Click >.
      The selected contact groups or user accounts appear in the Selected Users and Groups list.
  6. Enable one or more of the following notification methods.
    Method
    Description
    Email message
    To customize the email notification template, use supported token variables or modify the text in the Subject and Message fields.
    For more information, see Standard Token Variables and C&C Callback Token Variables.
  7. To test if recipients can receive the event notification, click Test.
  8. Click Save.