Skip to main content
SmartEvent automatic reactions offer Mail, SNMP Trap, Block Source, Block Event Activity and External Script. There is no webhook. The Flashduty Email integration can receive SmartEvent mail, so no separate Check Point integration is needed: create an Email integration in Flashduty and use its address as the recipient of the SmartEvent Mail reaction.

In Flashduty On-call

You can get the integration email address in either of two ways. Choose the Email integration type in both cases, not Check Point.

Dedicated integration

  1. In the Flashduty console, go to Channels and open a channel
  2. Go to Settings → Integrations → Dedicated integrations and click Add integration
  3. Select Email and click Save
  4. Open the generated card and copy the Email address

Shared integration

  1. In the Flashduty console, go to Integration Center → Alert Events
  2. Select Email, enter an integration name and copy the Email address
  3. Configure the default route, choose a channel and click Save

Configure Flashduty and Check Point

SmartEvent sends one mail per event and no recovery mail, and the subject carries the event number (see Mail subject format), so every mail is an independent event.
1

Confirm the push mode of the Email integration in Flashduty

Where: Integration Center › Alert Events › Email (dedicated integration: Channel › Configuration › Integrations › Private integration › Add integration › Email)Each mail creates a new alert whose title is the mail subject and whose description is the mail body. No trigger or close rules are needed.
2

Create a Mail automatic reaction in Check Point SmartConsole

Where: SmartConsole › Logs & Monitor › + › External Apps › SmartEvent Settings & Policy › General Settings › Objects › Automatic Reactions › Add › MailPaths follow the Check Point R81.10 administration guide.Save, reference the automatic reaction in the event definitions you want notifications for, and install the policy.
3

Verify

SmartEvent has no “send test mail” action. Let an event that references this automatic reaction fire for real; an alert titled like [EventNumber] - [Severity] - [Name] should appear in Flashduty. You can also send a test mail from any mailbox to the Flashduty address first to confirm the Email integration itself works; that mail also creates an alert, so close it manually.

Mail subject format

The default Subject of the Mail reaction is [EventNumber] - [Severity] - [Name]: event number, severity and event name. Flashduty uses the mail subject as the alert title.

Limitations

  • No recovery: SmartEvent sends no recovery mail. Enable auto-resolve timeout on the channel that receives this integration (24 hours suggested), or close alerts manually in Flashduty.
  • No deduplication: in the push mode above the Email integration gives every mail a random Alert Key, so each mail creates its own alert, whether or not the subject contains the event number.
  • Severity: alerts from the Email integration always have Warning severity. Use an alert processing pipeline to adjust it from the severity text in the subject.
  • Integration type: alerts show Email as the integration type in Flashduty.