Introduction

Note for Partners: notifications are enabled and customized on a per-client basis. Ensure that the Organization Selector is set to the appropriate client.

Active Response allows the Field Effect endpoint agent (v3.0 or later) to automatically take targeted and automated blocking actions against malicious activity at the process level. If Active Response triggers a response action on an endpoint device, a desktop notification will be generated for the end user. These notifications can be customized or disabled.

Notifications are available for the following scenarios:

• Field Effect detects a threat (ex: malicious software) on an endpoint device.
• Field Effect performs an action (ex: isolated from the network, rebooted, etc.) on an endpoint device.
• (Coming soon) A removable drive is detected and blocked on an endpoint device.
• (Coming soon) Disk scan results.

Notifications can be enabled, disabled, and customized from the Endpoint Agent page’s Agent Preferences section. Below is an example notification. This article walks through the process of customizing this notification.

Using System Notifications with Different Languages

Notifications support English, French, and Spanish, and the language is determined by the end user’s operating system settings. If the user has their operating system set to a supported language, the notification’s default message connect will be translated to their set language.

If you create a custom notification message, however, it will remain in the language it was written in.

Customizing Notification Messages

Note: The System Notifications toggle must be enabled to customize System Notification messages. To learn more, see Endpoint Agent Preferences.

Navigate to the Endpoint Agent page (Administration section) and click Customize System Notification Message.

The Customize System Notification Message window will open. From here, you can choose to use the default messaging, custom messaging, or no messaging. The example below shows the messaging options available the messaging location in the notification is highlighted. If you select None, the highlighted area will be left blank. After making your selection, click Save.

Using the Default Message

To use the default message (“an administrator may contact you to investigate the incident”), select Default and click Save. The default messaging will then be shown in the highlighted area shown in the example above.

Using No Messaging

If you want to remove the message entirely, select None and click Save. No messaging will be shown in the highlighted area shown in the example above.

Using a Custom Message

If you want to create your own notification message, select Custom.

The Custom Message field will appear under the message options. Note that custom messaging has a 350-character limit, and some custom characters are unsupported (see Troubleshooting below).

Type your custom message into the field and click Save. Your message will be applied, and you will be taken back to the Endpoint Agent page. 

Testing and Validating Notifications

If you want to receive a test notification to review and validate, Field Effect supports several workflows for sending test AROs and validating blocking capabilities.

To learn how to send a test notification, visit our Field Effect Endpoint Service Validation article and use the Notification Validation Test.

Troubleshooting

As mentioned previously, custom messaging has a 350-character limit. If you exceed this limit, you will not be able to save the message.

Also, some characters are not supported in the custom message. Using an unsupported character will produce an error (shown below) and you will not be able to save your message.

Supported special characters include:

• Alphabetical letters: a-z, A-Z
• Spanish letters and accents: Á, á, É, é, Í, í, Ó, ó, Ú, ú, Ñ, ñ
• French letters and accents: Ç, ç, É, é. Â, â, Ê, ê, Î, î, Ô, ô, Û, û, À, à, È, è, Ù, ù. Ë, ë, Ï, ï. Ü, ü
• Numerical characters: 0-9
• Special characters: “space”, “+”, “(“, “)”, “,” “,” “:” , “;” , “@”