Regarding smtp setup

[RSAAdmin]

Hi people,

I was working on the RSa server to trigger email SMtp setup. could u please give me the list what all details are required to setup the output  from rsa server

[RSAAdmin]

you mean trigger alert as SMTP output action? here is the list (you can refer onlinehelp for more details)

Field	Value
Action name	NIE RAID 5 Array Alert
Action type	SMTP
Description	SMTP alert used for NIE RAID 5 Array Alert notification. SMTP notification is sent to RSA and to user defined email addresses.
To 1:	support@callhome.network-intelligence.com
To 2:  through To 5:	Type the email addresses individuals within your organization to receive the related message.
From:	Type the email address of the sender. This should be a valid email address. Tip:  You may want to set up an address specifically for this purpose. For example, enVision@domain.com.
Server:	Type IP address of the SMTP mail server from which the email message will be sent. (This is typically your email server.) You can also type the resolved name of the mail server and update the hosts file (/WINNT/system32/drivers/etc) with the name and IP address of the mail server.
Subject:	Type the subject line for the alert email message.
Body:	Leave this field blank - the system uses the actual syslog message as the email body. It also displays the following: View ID Date/Time the message was received IP address of the device Device type Level Category NIC Category Message ID Payload

[RSAAdmin]

Hi Seth,

Is there a way I can define envision to send actual logs too , instead of envision to decide what to send .

[FernandoAllende]

Hello Sanjith:

Yes, you can send a CSV file with every event that triggered a correlation alert. The feature is called "Composite Events" and is all documented in the envision online help. You can add the file to an output action, but enVision still decide to send the event line, you cannot select which part of the line or which variable send ... fortunately it works! and you can see the file in you favorite CSV editor.

Regards from Chile,

Fernando Allendes.

[DelfinAbzueta]

Yes,

You can use SYSLOG as ACTION TYPE instead of SMTP, when you are defining the output action.

Then you need to type all the information needed: IP addresses and ports.