Master list of template variables.

[Anonymous]

   ive been digging through the online documentation trying to find an answer, I'm looking to build some custom alert templates for SA.

and the ones i had saved from the legacy informer appliance no longer work, as the variable options have changed, ive been able to find some idea of what i need to be looking for by coming across the cep alert setup within the help documentation but it doesnt list all the available options that there are for all the meta that is collected.

-mark

[huanzhou1]

for the alert, ESA alert template you can find from sadocs.

for reporting engine, the alert template not there

for cep, not sure whether same as ESA or not

[Anonymous]

its mostly for the reporting engine. as its all i have. since we are just using SA for the NW/FPC options and not using it as a siem.

[huanzhou1]

are you refer to this link?

http://sadocs.emc.com/0_en-us/095_10.3_User_Guide/13_Device_and_Service_Configuration/Event_Stream_Analysis_(ESA)_Configuration_Guide_(SP2)/Configure_Templates_for_Alert_Notification/ESA_Templates_Tab/Template_Definition

[Anonymous]

no, its more templates for email alerts, and the required fields for the meta variables. as well as how they are built.

IE in 9.x i had this for an informer template, that would send an smtp alert out when a condition or alert was generated.

i modified this from a cef template that we had for our siem.

{name} found in {#sessionid} ip.src:{#ip.src} - ip dst:{#ip.dst} - Host: {#alias.host} {#directory} - {#filename} - tcp.dst{#tcp.dstport} - Udp DST{#udp.dstport} - Location {#tld} - Serivce = {#service}

[huanzhou1 · Accepted solution]

for reporting engine alert, for meta, you can add like this: ${meta.sessionid}, ${meta.service}, ${meta.filename}, and etc.

Add an Alert - RSA Security Analytics Documentation