You can set up a Barracuda Content Shield policy to send an alert when users at a site attempt to access one or more websites that are in a filtered category a certain number of times.
If you are a Barracuda Content Shield user, review Working with Barracuda Content Shield Policies before setting up your policies to avoid unexpected alerts.
Barracuda Content Shield Alert Behavior vs. Barracuda RMM Alert Behavior
Barracuda Content Shield users will find differences between Barracuda Content Shield and Barracuda RMM alert behavior that they should consider when setting up their Barracuda Content Shield policy in Barracuda RMM. The result of these differences could be more alert emails than you are expecting.
The most important difference is that Barracuda RMM sends alerts as soon as the trigger threshold is met, instead of once every 24 hours, or at the end of the selected time period. When the set number of events occurs, you receive an alert right away, instead of one email a day, or one email per time period.
In Barracuda RMM, you also receive an alert every time the trigger threshold is met rather than one email every 24 hours.
The following example illustrates what happens in Barracuda Content Shield and Barracuda RMM when:
- An alert is set for the threshold of three events occurring within one hour, and
- Nine events happen within one hour.
In Barracuda Content Shield (1), this would result in a single email being sent sometime within 24 hours of the threshold being met.
In Barracuda RMM (2), if three events occur in the first fifteen minutes of the hour, you receive an email that is sent as soon as the events occur. If three more events happen in the next five minutes, you receive an additional email. If an additional three events occurred in the next five minutes, you would receive another email.
To receive fewer emails, consider:
- Raising the number of incidences that occur before an email is sent.
- When you create the alert, don’t set the alert to send an email. A trouble ticket will be created for each alert, which you can access through the Status > Alerts page. Alerts are also displayed on the Alert Viewer.