cancel
Showing results for 
Search instead for 
Did you mean: 

adding details of all the source event of a triggered correlation alarm

Jump to solution

Is it possible to add all three different IP address of three separate events which triggered with correlation alert email. I can see the option of "source event block". But not sure how to use it if I have multiple source events and all of them has different username \ IP in relevant fields field.

How we can add in email template different IP/ username of all the triggering source events?

1 Solution

Accepted Solutions
Highlighted
xded
Level 12
Report Inappropriate Content
Message 2 of 2

Re: adding details of all the source event of a triggered correlation alarm

Jump to solution

Correlation Event Start: [$REPEAT_START]

Source Event Start: [$SOURCE_EVENTS_START]

Source IP = [$Source_IP]

Source User = [$%UserIDSrc]

Source Event Stop: [$SOURCE_EVENTS_END]

Correlation Event End: [$REPEAT_END]

The Problem is you have different IP-Adresses in Source Event Block but not a different Description Like Source IP 1: Source IP 2: etc....

1 Reply
Highlighted
xded
Level 12
Report Inappropriate Content
Message 2 of 2

Re: adding details of all the source event of a triggered correlation alarm

Jump to solution

Correlation Event Start: [$REPEAT_START]

Source Event Start: [$SOURCE_EVENTS_START]

Source IP = [$Source_IP]

Source User = [$%UserIDSrc]

Source Event Stop: [$SOURCE_EVENTS_END]

Correlation Event End: [$REPEAT_END]

The Problem is you have different IP-Adresses in Source Event Block but not a different Description Like Source IP 1: Source IP 2: etc....

More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator
  • Community Help Hub

      New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

    • Find Forum FAQs
    • Learn How to Earn Badges
    • Ask for Help
    Go to Community Help

    Join the Community

      Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

    • Get helpful solutions from McAfee experts.
    • Stay connected to product conversations that matter to you.
    • Participate in product groups led by McAfee employees.
    Join the Community
    Join the Community