Additional output action fields

[RSAAdmin]

Can RSA please add more fields to the output action templates.  The current templates and are very "Network" centric.  We utilise envision alerts for alot of windows hosts and it would be good to see some windows fields like username, object type etc included into the templates. 

Why cant we just create our own and pick the fields that are in specific tables ??  seems simple enough to me and other SIEM products can do it.

[JeffHermans]

I second that request. It would be nice to be able to format the output similar to "<table-name:field-name>=<value>" within the body of the email.

[RSAAdmin]

I've been asking for this for years.  Even more specifically, I'd like to see these fields added:

Target Account Name

Caller Machine Name

Caller User Name

These fields are common throughout many Windows Security events and provide key information in events like Account Lockouts, Accounts Unlocked, Password Resets and many others like these.

As the other person stated, the output action fields available are very Network centric.  I think these are all still the original fields from many years ago.  Without the above fields that I mentioned, you have to use the Message Text field to get that information, but it ends up being a big block of data and you have to fish for it making it quite cumbersome.  Add trying to read it on a blackberry and it becomes a nightmare to say the least.

These are standard message fields and shouln't be too difficult to add, I would think.  I know the alert parsing is being addressed and that changes are coming down the road, but can we at least get tossed a bone to keep us somewhat satisfied for now?

[RSAAdmin]

Any feedback from product management on this request ?

[ScottPause]

I've asked that they at least standardize the fields they output. That would be a start.

ESE-357 - Need fields added to output action (should be for standardizing all fields output)

[RSAAdmin]

Would be nice to have an update on this one. I would still like to see username in my emails. The other nice thing would be the ability to use variables in the subject line.

[RSAAdmin]

The feature to add variables to subject line will be supported in upcoming version of enVision.

[RSAAdmin]

sreejith, thats great news!!! Very happy to see this.

[RSAAdmin]

I've been asking RSA about this for years as well. My understanding is that content 2.0 updates will allow more "common" fields to be shared across all event sources, similar to what the "global" table was meant to be. I really hope this comes soon, my customers have a difficult time understanding why we cannot give them meaningful output actions. Additionally, management wants all alerts forwarded to our event management solution, IBM Netcool. It's been far too long, i'm ready for RSA to take some action here...