Create an email notification

Each email notification must be bound to exactly one perspective. A notification can be in the active or inactive state. An inactive notification is defined in the system but is not being sent regularly. The option Do not send empty reports stops empty daily or weekly summary reports from being sent. Immediate reports, one-hour, and six-hour summaries are never sent empty to avoid spamming mailboxes. There is also an option called Minimal priority to be reported where you can specify the minimum priority of events to report. Reports are sent per the following rules:

• CRITICAL: report immediately after processing of the flow data (a blank report is never sent)

• HIGH: report in hourly summaries

• MEDIUM: report in six-hours summaries

• LOW: report in daily summaries

• INFORMATION: report in weekly summaries