Another question on Message Variables
- Community Thread
- Forum Thread
- RSA enVision
I'd like to know how to do this also. The best I can tell, it can not be configured in the Alerts,Alert Configuration, Set Up Alert History, display options page. The closest you can get is identifying which columns you want and in what sort precendence you want them.
The feature/capability you're looking for is also a lot like what I was looking for in my post on Subject Lines for SMTP output actions, which can be found here.
As an alternative option for your question, I played around with trying to run custom reports off the Message field in the Alerts table, but there's no real good (reliable) way to elicit the username or IP address as a variable, since it could potentally be different each time, depending on the event ID and event source that generated the alert in the first place.
Good question though, thanks for posting.