SMTP Template for ESA

[AlexFedorov]

Did anybody know how I can customize Default SMTP Template for ESA? I need exclude all meta keys and include only 4-5 meta keys for enduser. For example I wish to send end user only: source and destination ip's and also action key and username.

How customize this template?

[linoavila]

to refer to any meta you could use this syntax....

<#list events as event>

<#if event_index=1>

  <li>user: ${event.user_dst}

  <li>outcome: ${event.ec_outcome}

</#if&gt;

And modify the xml according to your requirements.

[AlexFedorov]

Could you share your template? I tried replicate your solution but this not gave result.

[SalSanshez]

Alex Fedorov‌ I had to use the following solution on a per alert basis to get the format requested by client...

 '000031690 - How to send customized subjects in an RSA Security Analytics ESA alert email' in RSA Link.

https://community.rsa.com/docs/DOC-45491 

Customer was very happy we were able to match the format of their previous SIEM alerts from Trustwave.