NetWitness Community

JoshRandall · ‎2019-05-02

One of the more common requests and "how do I" questions I've heard in recent months centers around the Emails that the Respond Module can send when an Incident is created or updated. Enabling this configuration is simple (https://community.rsa.com/docs/DOC-86405), but unfortunately changing the templates that Respond uses when it sends one of these emails has not been an option.

Or rather...has not been an accessible option. I aim to fix that with this blog post.

Before getting into the weeds, I should note that this guide does not cover how to include *any* alert data within incident notification emails. The fields I have found in my tests that can be included are limited to these using JSON dot notation (e.g. "incident.id", "incident.title", "incident.summary", etc.):

Now, this does not necessarily mean it isn't possible to include other data, just that I have not figured out how...yet.

The first thing we need to do is create a new Notification Template for Respond to use. We do this within the UI at Admin / System / Global Notifications --> Templates tab. I recommend using either of the existing Respond Notification templates as a base, and then modifying either/both of those as necessary. (I have attached these OOTB notification templates to this blog.)

For this guide, I'll use the "incident-created" template as my base, and copy that into a new Notification Template in the UI. I give my template an easy-to-remember name, choose any of the default Template Types from the dropdown - it does not matter which I choose, as it won't have any bearing on the process, but it's a required field and I won't be able to save the template without selecting one - and write in a description:

Then I copy the contents of the "incident-created" template into the Template field. The first ~60% of this template is just formatting and comments, so I scroll past all that until I find the start of the HTML <body> tag. This is where I'll be making my changes

One of the more useful changes that comes to mind here is to include a hyperlink in the email that will allow me to pivot directly from the email to the Incident in NetWitness. I can also change any of the static text to whatever fits my needs. Once I'm done making my changes, I save the template.

After this, I'm done in the UI (unless I decide to make additional changes to my template), and open a SSH session to the NetWitness Admin Server. To make this next part as simple and straightforward as I can, I've written a script that will prompt me for the name of the Template I just created, use that to make a new Respond Notification template, and then prompt me one more time to choose which Respond Notification event (Created or Updated) I want to apply it to. (The script is attached to this blog.)

A couple notes on running the script:

Must be run from the Admin Server
Must be run as a superuser

Running the script:

...after a wall of text because my template is fairly long...I get a prompt to choose Created or Updated:

And that's it! Now, when a new incident gets created (either manually or automatically) Respond sends me an email using my custom Notification Template:

And if I want to update or fix or modify it in any way, I simply make my changes to the template within the UI and then run this script again.

Happy customizing.

GrayS · ‎2020-04-30

Hi Josh,

Thanks for the guide - I'd been pointed at this page for customizing some incident notifications. I want to include the pertinent alert meta in the email as well so we can get our service desk software to automatically create tickets. Hoping I can use 'incident.alertMeta' to show this. A couple of things:

I'm running 11.3.2 and there is no 'Incident Created' default template. I get emails for created/updated incidents, yet I can't find a template that matches the content of these emails. Where is this template if it's not under Admin / System / Global Notifications / Templates ?
Second, I created a new template as per your instruction and ran your script. No errors. The system still sends the original template, seemingly nothing has changed.

Any ideas?

Cheers

JoshRandall · ‎2020-05-01

The email templates for Incident Created and Incident Updated are in the Integration Server's JAR file. I pulled them both out and attached them to the blog so others wouldn't have to try and find them.

Can you post screenshots of the selections you made when running the script plus its outputs, what your template looks like in the UI, and the resulting email you're getting?

Lastly, it appears my assumption about what data could be included was not entirely accurate. The "alertMeta[]" fields in the screenshot are not actually available for the Incident notification template (that screenshot is from the Respond REST API....it is doing some additional work to provide those).

You can use this notification template to email everything available to the incident notifications. The output formatting is in JSON, but you can change that if you like.

<#setting number_format="computer">
<#setting boolean_format="true,false">
<#assign null_value="null">

<#macro json_value_of item>
    <#compress>
        <#if item?is_sequence>
        [<#list item as value><@json_value_of value/><#if value_has_next>, </#if></#list>]
        <#elseif item?is_hash>
        {<#list item?keys?sort as key>"${key}" : <#if item[key]??><@json_value_of item[key]/><#else>${null_value}</#if><#if key_has_next>, </#if></#list>}
        <#elseif item?is_date>
        "${item?string.iso_utc_ms}"
        <#elseif item?is_string>
        "${item?replace("\"","\'")?j_string}"
        <#elseif item?is_boolean>
        ${item?string}
        <#elseif item??>
        ${item}
        </#if>
    </#compress>
</#macro>

{"incident": [<@json_value_of incident/>]}
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Which creates an email like this

GrayS · ‎2020-05-03

Thanks Josh, so it doesn't look like the alertMeta is able to be included in the email. In this case I will need to see if our support desk software supports making a subsequent API call once it receives the email with the IncidentID. I must have mucked up the template somehow because I stopped receiving emails altogether - I reverted back to your template your exported and it's working again.

SantoViapiana · ‎2021-02-14

Hi, could you tell me if this "personalization" is also applicable to 11.5.2 version?
Thank you in advance

JoshRandall · ‎2021-02-15

Santo Viapiana‌

Yes, i just re-ran the original script on my 11.5.2 lab system and it still works as intended.

NetWitness Community

Customizing Respond Incident Notification Emails