cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
sysec
Level 7
Report Inappropriate Content
Message 1 of 7

Email Body

Jump to solution

Hi All,

How can i change the body of the action email.send to have some meaningfull variables?

i can choose a single propeerty and it works but when i try to put variables like "URL" or $URL$ in the string value  i get the text and not the url link?

10x in advance for your advises

Shay

Message was edited by: sysec on 1/4/12 2:34:41 AM CST
1 Solution

Accepted Solutions
eelsasser
McAfee Retired
McAfee Retired
Report Inappropriate Content
Message 2 of 7

Re: Email Body

Jump to solution

Create a string that has the contents you want in it, like:

Name:
Malware Email Alert

Rule Criteria:
Antimalware.Infected<Gateway Anti-Malware> equals true

Action:
Continue

Events:
Set User-Defined.notificationMessage = "Date: "
+ DateTime.ToWebReporterString
+ String.CRLF
+ "User: "
+ Authentication.UserName
+ String.CRLF
+ "Client.IP: "
+ IP.ToString (Client.IP)
+ String.CRLF
+ "URL: "
+ String.ReplaceAll (URL, "http", "hXXp")
+ String.CRLF

Email.Send ("Security@MyDommain.com", String.Concat ("Virus Alert from: ", System.HostName), User-Defined.notificationMessage)<Default>

NOTE: I am replacing the http with hXXp in a URL that is sent via email. We typically do this to make it unclickable in the email. In the case of a virus alert like this, the URL is malicious and we don't want someone to blindly click it to try it out.

View solution in original post

6 Replies
eelsasser
McAfee Retired
McAfee Retired
Report Inappropriate Content
Message 2 of 7

Re: Email Body

Jump to solution

Create a string that has the contents you want in it, like:

Name:
Malware Email Alert

Rule Criteria:
Antimalware.Infected<Gateway Anti-Malware> equals true

Action:
Continue

Events:
Set User-Defined.notificationMessage = "Date: "
+ DateTime.ToWebReporterString
+ String.CRLF
+ "User: "
+ Authentication.UserName
+ String.CRLF
+ "Client.IP: "
+ IP.ToString (Client.IP)
+ String.CRLF
+ "URL: "
+ String.ReplaceAll (URL, "http", "hXXp")
+ String.CRLF

Email.Send ("Security@MyDommain.com", String.Concat ("Virus Alert from: ", System.HostName), User-Defined.notificationMessage)<Default>

NOTE: I am replacing the http with hXXp in a URL that is sent via email. We typically do this to make it unclickable in the email. In the case of a virus alert like this, the URL is malicious and we don't want someone to blindly click it to try it out.

View solution in original post

sysec
Level 7
Report Inappropriate Content
Message 3 of 7

Re: Email Body

Jump to solution

10x eelsasser

it totally works 

Re: Email Body

Jump to solution

Hello and thank you for this post.  I have a very similar requirement to have emails sent after a rule has been triggered.  Using your previous guidance in this post, we have been able to get it working.  However we would like to add in the email the name of the system or host also if possible.

Does this functionality exist?  If so how should we proceed?

Thank you,

dstraube
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 5 of 7

Re: Email Body

Jump to solution

Hello watarimono,

MWG has a property called System.HostName that contains the name of the system. If you include this in the notification message you should be good to go.

Regards,

Dirk

Re: Email Body

Jump to solution

Thank you Dirk,

We were playing around with the System.HostName but it just gives us the name of the Webgateway.  Are we missing something to have it pull the name of the workstation?

jscholte
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 7 of 7

Re: Email Body

Jump to solution

Hi watarimono!

System.Hostname does what you found, it represents the name of the Web Gateway.

To get the client workstation name (which I dont like doing because it assumes a lot of your network and DNS servers) it is a bit tougher, but not by much.

You can use the property:

DNS.LookupReverse(Client.IP)

This will perform a reverse lookup of the client IP, WHICH MEANS YOU MUST HAVE DNS SETUP CORRECTLY OTHERWISE IT WILL NOT WORK.

I dont like using reverse lookups because often DNS servers are not configured correctly to do reverse properly.

Best Regards,

Jon

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community