Create and Assign a Sending Policy for Alerts

Applies To: WatchGuard Advanced Reporting Tool and Data Control This topic applies to the WatchGuard endpoint security modules, Advanced Reporting Tool and Data Control. These optional modules are available with WatchGuard EPDR and WatchGuard EDR.

Sending policies enable you to define how to send generated alerts. You can deliver alerts to servers, groups, or individuals either in real-time or at set intervals.

When you create a sending policy, you include the anti-flooding policy and delivery methods. For more information, see Create an Anti-Flooding Policy for Alerts and Configure Delivery Methods for Alerts.

Your operator role determines what you can see and do in WatchGuard Cloud. Your role must have the Access File Access Information permission to view or configure this feature. For more information, go to Manage WatchGuard Cloud Operators and Roles.

To create a sending policy, in the Advanced Visualization Tool:

1. From the left pane, select Administration > Alerts Configuration.
2. Select Alert Policies.
3. Select Sending Policy.
4. Click New Sending Policy.
   The New Sending Policy dialog box opens.

5. In the Name text box, type a unique name for the sending policy.
6. To automatically assign this policy as the sending policy when an alert does not have a sending policy, select the Set as Default Policy check box.
   
7. From the Anti-flooding Policy drop-down list, select the anti-flooding policy you want to apply.
   For more information, go to Create an Anti-Flooding Policy for Alerts.
8. In the schedule section, select the days of the week and the time period when the sending policy is active.
9. From the drop-down lists, select a delivery type and delivery method.
   For more information, go to Configure Delivery Methods for Alerts.
10. Click Add.
11. Repeat steps 9 and 10 for each delivery method you want to add.
12. Click Create.

Assign a Sending Policy to an Alert

After you create a sending policy, you can assign it to alerts on the Available Alerts tab.

To assign a sending policy to an alert:

1. From the left pane, select Administration > Alerts Configuration.
2. Select Available Alerts.
3. To filter the list of alerts, use the All Categories and All Subcategories boxes.
4. To further reduce the number of alerts in the list, enter keywords in the Filter box.
5. From the list, select the alert you want to assign a sending policy to.
6. In the Active Policies column, click .
   The Sending Policies dialog box opens.

7. Select the sending policies you want to assign to the alert.
8. Click Apply.

Edit and Delete Sending Policies

You can edit or delete an existing policy on the Sending Policy tab.

To edit a sending policy, in the Advanced Visualization Tool:

1. From the left pane, select Administration > Alerts Configuration.
2. Select Alert Policies.
3. Select Sending Policy.
4. From the list of policies, click in the row for the policy you want to edit.
5. Select Edit.

6. To automatically assign this policy as the sending policy when an alert does not have a sending policy, select the Set as Default Policy check box.
   
7. From the Anti-flooding Policy drop-down list, select the anti-flooding policy you want to apply.
8. In the schedule section, select the days of the week and the time period when the sending policy is active.
9. From the drop-down lists, select a delivery type and delivery method. Click Add.
10. To delete an existing delivery type and method, in the row of the method you want to delete, click .
11. Click Update.

To delete a sending policy, in the Advanced Visualization Tool:

1. From the left pane, select Administration > Alerts Configuration.
2. Select Alert Policies.
3. Select Sending Policy.
4. From the list of policies, click in the row for the policy you want to delete.
5. Select Delete.
   A Warning dialog box opens.

6. Click Delete.

Related Topics

About Real-Time Alerts in the Advanced Visualization Tool

Create Alerts in the Advanced Visualization Tool