Hi all,
I am a 3CX Bronze partner (Partner ID: 245677) and I do not have the permissions required to post in the Ideas section, so I am publishing this feature request here, hoping the 3CX team will pick it up.
Environment: 3CX v20 Update 9 (Build 995), hosted by 3CX, 8 Italian SIP trunks, 28 extensions (a customer installation).
THE PROBLEM
The installation is under a continuous stream of unauthenticated SIP INVITEs from toll-fraud scanners. 3CX rejects them and logs Event 30051 "Unidentified Incoming Call" (840 in 30 days, from 58 different IPs), but there is no way to be notified by email: the built-in alerts only cover a fixed list of 14 events, and 30051 is not one of them. Without reading the event log every day, the administrator cannot know that the system is under attack.
For a security-relevant event this is a really critical gap. To protect the customer I had to build a custom XAPI-based function myself, with the help of AI, because 3CX offers no way to set up notifications for critical events like this one.
WHAT I AM ASKING
1. Make Event 30051 available in the built-in email alerts.
2. Let admins choose which events to be notified about by event ID and/or severity, not only from a fixed list.
3. Optional: thresholds or a daily digest, to avoid too many emails.
4. In the email: source IP, dialed number and user agent.
5. Optional: automatic blocking of sources coming from countries other than the customer's country, when the attempts repeat and recur within a short period of time.
Anyone with the same need, please comment. Thank you!
I am a 3CX Bronze partner (Partner ID: 245677) and I do not have the permissions required to post in the Ideas section, so I am publishing this feature request here, hoping the 3CX team will pick it up.
Environment: 3CX v20 Update 9 (Build 995), hosted by 3CX, 8 Italian SIP trunks, 28 extensions (a customer installation).
THE PROBLEM
The installation is under a continuous stream of unauthenticated SIP INVITEs from toll-fraud scanners. 3CX rejects them and logs Event 30051 "Unidentified Incoming Call" (840 in 30 days, from 58 different IPs), but there is no way to be notified by email: the built-in alerts only cover a fixed list of 14 events, and 30051 is not one of them. Without reading the event log every day, the administrator cannot know that the system is under attack.
For a security-relevant event this is a really critical gap. To protect the customer I had to build a custom XAPI-based function myself, with the help of AI, because 3CX offers no way to set up notifications for critical events like this one.
WHAT I AM ASKING
1. Make Event 30051 available in the built-in email alerts.
2. Let admins choose which events to be notified about by event ID and/or severity, not only from a fixed list.
3. Optional: thresholds or a daily digest, to avoid too many emails.
4. In the email: source IP, dialed number and user agent.
5. Optional: automatic blocking of sources coming from countries other than the customer's country, when the attempts repeat and recur within a short period of time.
Anyone with the same need, please comment. Thank you!
