Is it possible to add all three different IP address of three separate events which triggered with correlation alert email. I can see the option of "source event block". But not sure how to use it if I have multiple source events and all of them has different username \ IP in relevant fields field.
How we can add in email template different IP/ username of all the triggering source events?
Correlation Event Start: [$REPEAT_START]
Source Event Start: [$SOURCE_EVENTS_START]
Source IP = [$Source_IP]
Source User = [$%UserIDSrc]
Source Event Stop: [$SOURCE_EVENTS_END]
Correlation Event End: [$REPEAT_END]
The Problem is you have different IP-Adresses in Source Event Block but not a different Description Like Source IP 1: Source IP 2: etc....