The NetWatcher Advanced tab in the customer portal is very power when it comes to viewing Event (indicator of compromise) data. One of the many features is the ability to set a tripwire and alert the user via SMS or email of activity that meets the criteria of the saved filter. Here is an example of creating a filter for any inbound traffic from China, Russia or Iran.
Once you hit 'save filter' you have the choice of just saving the filter or making it a tripwire by selecting the SMS and/or email functions.
Your email or SMS will look like the following:
You can also set the same SMS/email Tripwires for Alarms (post correlation).