Create a string that has the contents you want in it, like:
Malware Email Alert
Antimalware.Infected<Gateway Anti-Malware> equals true
Set User-Defined.notificationMessage = "Date: "
+ "User: "
+ "Client.IP: "
+ IP.ToString (Client.IP)
+ "URL: "
+ String.ReplaceAll (URL, "http", "hXXp")
Email.Send ("Security@MyDommain.com", String.Concat ("Virus Alert from: ", System.HostName), User-Defined.notificationMessage)<Default>
NOTE: I am replacing the http with hXXp in a URL that is sent via email. We typically do this to make it unclickable in the email. In the case of a virus alert like this, the URL is malicious and we don't want someone to blindly click it to try it out.
Hello and thank you for this post. I have a very similar requirement to have emails sent after a rule has been triggered. Using your previous guidance in this post, we have been able to get it working. However we would like to add in the email the name of the system or host also if possible.
Does this functionality exist? If so how should we proceed?
MWG has a property called System.HostName that contains the name of the system. If you include this in the notification message you should be good to go.
Thank you Dirk,
We were playing around with the System.HostName but it just gives us the name of the Webgateway. Are we missing something to have it pull the name of the workstation?
System.Hostname does what you found, it represents the name of the Web Gateway.
To get the client workstation name (which I dont like doing because it assumes a lot of your network and DNS servers) it is a bit tougher, but not by much.
You can use the property:
This will perform a reverse lookup of the client IP, WHICH MEANS YOU MUST HAVE DNS SETUP CORRECTLY OTHERWISE IT WILL NOT WORK.
I dont like using reverse lookups because often DNS servers are not configured correctly to do reverse properly.