Normally, the alert notification email from EDR will\u00a0be sent when a detection with he risk level at "Severe", "High" and "Medium" has been added to the portal, but is it possible to\u00a0configure the alert email that ONLY will be notified when "Severe" or "high" risk level has happened?\u00a0\u00a0Is it possible to filter the email alerts coming from EDR? I don't want to get a lot of low risk alert emails, but only medium and higher. Or only higher or severe etc.<\/p>\n
From the Management > Organization Settings > Detection and Reponse settings tab, it is not possible to edit which classification EDR detections would send emails.<\/p>\n
In this case, you have to use this workaround to generate an email report that only goes when there is High or Severe level detection:<\/p>\n
This report report is sent whenever High<\/strong> or Severe<\/strong> level detection appears on that Security Events<\/strong> page. Unfortunately, it is not possible to choose to send emails only about Severe<\/strong> level detections, because on the Security Events<\/strong> page that Severity equals Action needed filter includes both High<\/strong> and Severe <\/strong>level detections.<\/p>\n We will be improving those reporting and email features this year, but there is no specific estimate at this time.<\/p>\n Here you need to note that if you are trying to send a test report from that new report using the Send test report button, remember to first temporarily disable Send only when report has content<\/strong>, because if there is no content in the report, the test report will not be sent either.<\/p>\n