cancel
Showing results for 
Search instead for 
Did you mean: 
izik
Level 7

alarm content

hi

i have correlation rule that check if user connect from 2 different PC , it's work fine

i create alarm for this rule , how can i add the 2 PC(IP address) to the alarm content ? currently i receive only the first one

this is the alarm template

----------------------------------------

Alarm: [$Alarm Name]

Assignee: [$Alarm Assignee]

Trigger Date: [$Trigger Date]

Summary: [$Alarm Summary]

User : [$%UserIDSrc]

IP : [$Source IP]

----------------------------------------

thanks

izik

0 Kudos
1 Reply
abanaru
Level 11

Re: alarm content

Put [$Source IP] between [$SOURCE_EVENTS_START] and [$SOURCE_EVENTS_END].

More information in the manual P315-316 - https://kc.mcafee.com/resources/sites/MCAFEE/content/live/PRODUCT_DOCUMENTATION/26000/PD26482/en_US/...

0 Kudos