Threat intel alerts

Lacework FortiCNAPP generates threat intel alerts when it detects inbound/outbound connections with known bad external hosts.

These alerts provide advanced warning of potential threats based on the latest intelligence and threat analysis with the following features:

• The alerts are raised within 15 minutes of the potential threat being detected, giving you more time to take action and protect your organization's assets.

• Evolving Alerts - This feature allows you to receive a single, consolidated alert that will automatically update and evolve over one hour, reducing the noise of repetitive alerts. This approach will give you all the information you need to triage and investigate alerts while minimizing distractions and interruptions. See for more information.

• The alerts use aggregation keys that allow the grouping of similar alerts into one consolidated alert with all the latest information about the threat, reducing the number of notifications you receive.

The following table lists all of the Threat Intel alerts.

Alert Name	Alert Type	Connection
Inbound connection from a bad external IP Address	ExternalClientBadIpConn	IP -> Machine
Outbound connection to a bad external IP Address	ExternalServerBadIPConn	IP -> Machine
Outbound connection to a bad external URL	ExternalServerBadDNSConn	IP -> Machine

Suppression of threat intelligence alerts is currently unavailable.