Creating Custom Alerts with the Alert Policy (EA)

Note: This is an Early Availability (EA) feature that is only available for limited release. For more information, contact your Cato Networks representative or send an email to ea@catonetworks.com.

Overview

The Alert Policy lets you create custom, threshold-based rules that determine when an Alert is generated. This helps you identify potential indicators of attack, investigate abnormal activity, and respond before network performance, security, or user experience is impacted. Based on your network or security requirements, you define the conditions that matter most to your organization and receive an alert if they are met.

You can build Alerts around a wide range of occurrences across SD-WAN, Security, Digital Experience Monitoring (DEM), and other areas of your network. For each rule, you define the scope that the Alert applies to, the trigger that generates it, and the time window over which the condition is evaluated. You then choose what happens if the occurrence takes place. The Alert can generate an Event, a Notification, or both.

As Cato collects data from many domains across your network, there are a vast number of possible configurations for a rule. To help you configure rules for your organization, the Alert Policy includes:

• Predefined Rules: Suggested alert rules that you can enable or disable

• Templates: Include only the metrics relevant to a specific monitoring scenario. Select a template that matches your use case to configure alert conditions and thresholds without searching through all available data sources. For example, the Device Posture template only displays Device ID, User ID, and Site ID as the scope for a rule.

Use Case - Preventing Performance Degradation

Company ABC’s London site regularly runs bandwidth-intensive operations, and the network team has noticed that unusually high volumes of concurrent flows from this site often precede performance degradation for business-critical applications.

To be informed before users are impacted, the network administrator creates an Alert Policy rule for the London site with the Site Connectivity template and sets a threshold based on the Site’s typical traffic volume. The rule is configured to send a notification.

When the number of concurrent flows at the London Site exceeds the threshold, a notification is sent alerting the network team so they can investigate or take action before application performance is affected. This helps Company ABC focus on conditions that are relevant to its environment while reducing unnecessary Events and Notifications.

Understanding Alerts, Events, and Notifications

The Cato Management Application (CMA) generates Alerts and Events and sends Notifications. Although related, they are different notification mechanisms.

• Alert: A rule-based condition defined in the Alert Policy. When the criteria are met, the alert generates an event, sends a notification, or both

• Event: Visible in the CMA, Events record detailed information about an occurrence in your network for investigation and analysis. For more information, see Analyzing Events in Your Network

• Notification: A proactive message sent outside the CMA to inform you about something that occurred in your environment. For more information, see Account Level Alerts and System Notifications

Enabling the Alert Policy

Create Alert Policy rules to define the monitored scope, trigger conditions, evaluation window, and tracking actions for alerts.

Understanding the Sections in an Alert Policy Rule

Rules in the Alert Policy contain these sections:

Configuring the Alerts Policy

To configure Alert Policy rules:

1. From the navigation menu, select Account > Alerts.

2. Click New then New Rule.

3. Configure the General, Scope, Triggers, Time Window, and Tracking sections to meet your requirements.

4. Click Save and then Publish.

5. Set the Alerts toggle to Enabled.