2 Replies Latest reply on Feb 2, 2016 11:04 PM by minsktractorworks

    Getting Source Events In An Email

    minsktractorworks

      Hey All,

       

      I am trying to get the "Rule Message" for the source events of a correlated event into our email alerts so the analysts have more information at initial triage.

       

      There is an option within the email templates for a "Source Event Block" which I thought would do the trick as shown below. But this just adds the correlated event title.

       

      [$SOURCE_EVENTS_START]

      Event Description = [$Rule Message]

      [$SOURCE_EVENTS_END]

       

      Has anyone had success in getting the source events for a correlated event into an email?