SMTP (deprecated)
|
FortiDLP's built-in cloud SMTP service will replace its on-premises SMTP service soon. For more information, including instructions on migrating to the new SMTP service, see Incident email notifications. |
If your organization uses a Simple Mail Transfer Protocol (SMTP) service, you can configure FortiDLP to send email alerts when detection and incident events occur.
FortiDLP lets you choose how often you receive alerts to optimize your workflow, and also lets you filter by tags and risk scores.
Rate limiting
The FortiDLP uses the token bucket algorithm to control the rate at which email alerts are delivered. This algorithm consists of a bucket with a maximum capacity of tokens, where tokens are removed each time an email alert is sent, and slowly added back into the bucket at regular intervals of time. If the bucket is empty, alerts cannot be sent. For more information about this algorithm, click here.
If you want to limit the rate at which alerts are delivered, you can set the Token replenish rate per hour and Max tokens fields, as described in Enabling SMTP email alerts (deprecated).
Filtering
FortiDLP gives you fine-grained control over the email alerts you receive—allowing you to filter detections and incidents by specific tags and risk scores.
|
For example, to be alerted to tampering attempts of the FortiDLP Agent and its components, you could filter for detections that have the Or, to only be alerted to critical incidents, you could filter for incidents that have a minimum risk score of |