Comprehensive and Detailed Explanation From Exact Extract of Forescout Platform Administration and Deployment:
According to the Forescout Administration Guide, when creating a new "Send Mail" notification action, the email configured under Options > General > Mail is used by default.
Default Email Configuration:
According to the Managing Email Notifications documentation:
"From the Tools menu, select Options > General > Mail and DNS. Update any of the following fields: Send Email Alerts / Notifications - List email addresses to receive CounterACT email alerts."
This setting establishes the default recipients for all email notifications across the system.
Email Notification Hierarchy:
According to the documentation:
Default Recipients (Options > General > Mail) - Used when no specific recipients are defined
Policy-Specific Recipients - Can override defaults in individual policy actions
Action-Level Recipients - The "Send Mail" action can specify custom recipients
When "Send Mail" Action Uses Defaults:
According to the documentation:
When you create a "Send Mail" action without specifying custom recipients, the system automatically uses the email addresses configured in:
Tools > Options > General > Mail and DNS
The "Send Email Alerts/Notifications" field
Why Other Options Are Incorrect:
B. Email of the last logged in user - The system doesn't track login history for email defaults
C. The Tech Support email - There is no "Tech Support email" setting in Forescout
D. Email used for license registration - License email is not used for policy notifications
E. Email entered in the send mail action on the rule - While this CAN override defaults, it's not the DEFAULT used when creating the action
Referenced Documentation:
Managing Forescout Platform Email Notifications
Managing Email Notifications
Managing Email Notification Addresses
