E-Mail notification for missing Heartbeat

Since MR5, you can configure the missing heartbeat delay. 

https://community.sophos.com/sophos-xg-firewall/b/blog/posts/sophos-xg-firewall-v18-mr5--build-586-is-now-available

• Missing Heartbeat enhancements to reduce notifications sent for intended/expected changes in endpoint status

But the notifications are sent from Sophos Central, or is the notification initially caused from the XG-Firewall config?

You can configure both. Suppression to Central is the second switch. 

So, i configured the following:

console> system synchronized-security suppress-missing-heartbeat-to-central

verified that 

console> system synchronized-security suppress-missing-heartbeat-to-central show

returns "0".

I will report in a few days if the notifications are now turned off.

Thank you in advance!

0 means "zero delay". It stands for Seconds until XG will report a missing heartbeat.

Just to be sure, what this actually means: 

If you shutdown a client or a service etc. the Heartbeat service will be closed on the client. XG will notice this and expects no traffic anymore. But in some race condition, the client still sends traffic while shutting down. 

This causes Missing heartbeat alerts.

You can activate a suppression in seconds to increase the threshold until this message will be generated. For example: You can try to set the value to 60 sec. This means, XG will ignore 60 secs long traffic, even if the heartbeat traffic is stopped. (PS: Only the generation of alerts, the protection feature is still enabled). 

Thank you for the detailed explanation. I will report the results in 1 or 2 days.

Current setting:

console> system synchronized-security suppress-missing-heartbeat-to-central set seconds 60

verify:

console> system synchronized-security suppress-missing-heartbeat-to-central show

should return "60"

console> system synchronized-security delay-missing-heartbeat-detection show

Still returns unchanged "60".

Yes, 60 is the Default Value for this. You can increase it to 120 or you can increase the other threshhold for Alerts send to Central from 0 to 60. 

It's been 2 days now, and we have not received any more of these annyoing notifications. Guess the Problem ist solved now :) Thank you all!

I have no such command in CLI "system synchronized-security" - anyone know why? There are airgap, appliance_access, and so on, but no synchronized-security :-(

As Lucar Toni wrote. You need Firewallversion 18.0.5 to use these commands.