Perform the following procedure to configure an email server for alerts.

Prerequisites

Before enabling email alerts for specific watchlists or feeds, you should decide which email server to use. You can:

  • Use your own email server

  • Use the Carbon Black EDR external email server

  • Opt out of email alerts

If you use the Carbon Black EDR external email server, the following information is sent through the server and stored by Carbon Black EDR:

  • Your server ID

  • The time of the email

  • The name of the watchlist or feed are that triggered the hit

Important: Carbon Black strongly recommends that you use your own email server because email sent through the Carbon Black EDR external email server is sent over the Internet in clear text.

Carbon Black also encourages you to use your own email server if you are concerned about the potential delays that can occur during times of high processing of alerts for all Carbon Black EDR servers subscribed to the Carbon Black EDR external email server. Using your own email server reduces the possibility of delayed emails.

Procedure

  1. Log in to Carbon Black EDR as a Global Administrator or as a Carbon Black Hosted EDR Administrator.
  2. Cick Username> Settings.
  3. On the Settings page, click E-Mail.
    • Select whether to use the Carbon Black external mail server.

    • If you want to use your own mail server, select that option and configure the mail server with the connection criteria.

    All email alerts for all console users will use these settings.