Using meta in email notification subject line.

[Anonymous]

I have an ESA rule that generates an email notification when meta is generated in the 'alert' meta key.

I want to put able to use part of the meta information in the alert to customise the email subject header so there is more context in it.

Is this possible.

[JohnKisner]

@Anonymous

I wanted to let you know that I have confirmation from Engineering that the alert meta is considered a string array meta. As such this is why it required the [0] at the end. If you look at the section labeled Update Your ESA Rules for the Required Multi-Value and Single-Value Meta Keys in the following link: https://community.netwitness.com/t5/netwitness-platform-online/esa-configuration-guide-for-12-3-1/ta-p/705365 you can see at the top of page 15 most, if not all, of the multi-valued meta keys. Using any of these will require the index on the end of the meta key, ex. alert[0], alert[1], alert[2], ...

This document also provides more context around the use of string and string array meta keys. I hope this additional information helps.