Feature request: email alerts for critical security events (e.g. 30051 "Unidentified Incoming Call"), selectable by event ID

[_aMiCiCi_]

Hi all,

I am a 3CX Bronze partner (Partner ID: 245677) and I do not have the permissions required to post in the Ideas section, so I am publishing this feature request here, hoping the 3CX team will pick it up.

Environment: 3CX v20 Update 9 (Build 995), hosted by 3CX, 8 Italian SIP trunks, 28 extensions (a customer installation).

THE PROBLEM
The installation is under a continuous stream of unauthenticated SIP INVITEs from toll-fraud scanners. 3CX rejects them and logs Event 30051 "Unidentified Incoming Call" (840 in 30 days, from 58 different IPs), but there is no way to be notified by email: the built-in alerts only cover a fixed list of 14 events, and 30051 is not one of them. Without reading the event log every day, the administrator cannot know that the system is under attack.

For a security-relevant event this is a really critical gap. To protect the customer I had to build a custom XAPI-based function myself, with the help of AI, because 3CX offers no way to set up notifications for critical events like this one.

WHAT I AM ASKING
1. Make Event 30051 available in the built-in email alerts.
2. Let admins choose which events to be notified about by event ID and/or severity, not only from a fixed list.
3. Optional: thresholds or a daily digest, to avoid too many emails.
4. In the email: source IP, dialed number and user agent.
5. Optional: automatic blocking of sources coming from countries other than the customer's country, when the attempts repeat and recur within a short period of time.

Anyone with the same need, please comment. Thank you!

 

[Alejandro_3CX]

Hi @_aMiCiCi_ did you try enabliing the alert for Anti-hacking requests?

 

[_aMiCiCi_]

Hi Alejandro, thank you for the quick reply!

Both "Anti-hacking rejects requests" (Event 12292) and "IP Blacklisted" (Event 12290) alerts are enabled on this system, but these alerts do not cover Event 30051 "Unidentified Incoming Call", which is the one we are asking for. In the last 30 days the system logged 840 events of type 30051 (they were already being logged in the previous weeks, so this is not a one-off) and only 2 of type 12292 and none of type 12290, so those alerts would have sent just 2 emails and none for these attempts.

As per the technical documentation ("3CX Events Explained": https://www.3cx.com/docs/event-log/), Event 30051 is documented as a warning, with no email notification, while for example Event 4099 explicitly states that an email notification is also triggered.

So we are still asking for an email alert for 30051 (ideally with thresholds or a daily digest), to help avoid improper charges from toll fraud.

Thank you again for your support!

 

[Evolute IT]

You can do that with our SYNOPSYS platform via a custom monitoring rule. Feel free to request access via the link in my signature (the logo.)

 

[Alphabetic]

You can do that with our SYNOPSYS platform via a custom monitoring rule. Feel free to request access via the link in my signature (the logo.)

Really nice interface btw.