What are the notification channels (UI, e-mail, SMS, SNMP)?

Short answer

WAF notifications have four channels, and all of them are selected in the Notifications window on the WAF Management tab of the vService: E-mail (address list), SMS (phone number list), SNMP Notification (switch, off by default) and UI Notification (switch, on by default; the notification appears in the notification panel at the bottom right). The recipients come from this window; the notification profiles and contact groups on the Notification Management screen are not used in WAF notifications, and only the infrastructure is taken from there: the e-mail server (SMTP), the SNMP target and night silencing. If Mute Night Notifications is on, SMS is not sent between 22:00–08:00; e-mail, SNMP and interface notifications continue. Even if UI Notification is off, every notification is written to the Notification Logs screen. If Report Attachment is selected in an advanced notification, the e-mail goes as a single message that attaches the filtered report, with a short delay; the other channels work immediately.

Channels

Channel	Field in the window	Required infrastructure	Note
E-mail	E-mail: addresses line by line	E-mail Settings (SMTP)	The report attachment of the advanced notification comes only by e-mail
SMS	SMS: numbers line by line	The notification service of TR7	The text is converted to plain text; it is not sent during night silencing
SNMP	SNMP Notification: switch (off by default)	SNMP Settings in Notification Management: target, version and community	If no target is defined, the trap is not sent
Interface	UI Notification: switch (on by default)	-	Appears in the notification panel at the bottom right (notification panel)

• The channels are applied to all the triggers in the same window: Block Threshold (per sec), Detected Attack Threshold (per sec) and Advanced Notifications.
• On the bottom strip of the Notifications card, the channels that are on appear as badges: E-mail and SMS with a count, SNMP Notification and UI Notification only while they are on (Notifications card).
• In Notification Logs, delivery result icons appear for e-mail and SMS; interface and SNMP are not listed in this column (delivery channels).
• In a cluster setup, notifications are produced on each device from its own traffic; the Host line in the e-mail and the server name in the SMS text show which device the notification came from (Notification Management).

Setup steps: Can I receive a notification when the attack count exceeds a certain threshold? · Sent notifications: Where do I see the WAF notifications that were sent (Notification Logs)? · Channels on the LB side: Can I get notified when a vService goes down; which channels are available (SNMP, e-mail, SMS)?

Common Misconceptions

• "The contact group in Notification Management receives the WAF notifications." The WAF recipients are the E-mail and SMS lists in the Notifications window; Notification Management only provides the infrastructure.
• "If UI Notification is off, no record is kept." The notification continues to be written to Notification Logs; it is just not shown in the notification panel.
• "Night silencing silences all the channels." Only SMS is silenced.
• "If the report attachment is selected, no e-mail address is needed." The report attachment is sent only by e-mail; if the E-mail list is empty, the report is not produced and the notification goes through the other channels.

How it is done in the documentation

• Notifications · What Is Notifications?
• Notifications · E-mail
• Notifications · SNMP Notification
• Notification Logs · The Notification Delivery Channels

Related questions

• Can I receive a notification when the attack count exceeds a certain threshold?
• Where do I see the WAF notifications that were sent (Notification Logs)?
• Can I get notified when a vService goes down; which channels are available (SNMP, e-mail, SMS)?