SMTP Output-- Additional Fields

[KentSaunders]

enVision has around 50 pre-defined fields in their templates.  Is there any way that we can include any additional fields? 

My client wishes to alert when specific "important" files are modified.  They are using BSM to do this.  The current solution they are using sends the file name in the alert. enVision does not have a specific field for File Name in any of the templates that I can see.  I realize that the message text would probably contain this information, but for the sake of brevity, and the sanity of the SOC operators, I'd like to just include the file name instead of forcing them to manually parse the information from the message text.

Thanks in advance.

[RSAAdmin]

Alas, the template field selection can't be modified.

The best way to get it is using exactly the method you're trying to avoid - send the payload of the event in the alert.

[RSAAdmin]

ksaunders, do you have an RFE for this?

Matt, that may be the best way under the current field limitations but to be able to include exactly the right amount of details in an SMTP alert saves time when sorting through a large number of alerts which most network security administrators have limited amount of.

[RSAAdmin]

I've run into the same issue myself. For failed login events I would like to have the username in the message, but since that isnt available I have to use the whole message. I have gotten really good at spotting usernames in a long string of text!!

This would be a really nice thing for a future Envision version. I would also add the ability to use variables in the subject line!

[RSAAdmin]

Future enVision version is indeed coming with support for variables in subject line.

[RSAAdmin]

Thats good to hear Sreejith! One of our departments doesn't want to use Envision because of this issue and is using another SEM product that does allow variables in subject lines.

[RSAAdmin]

Any updates on this? I am getting a lot of pressure from various internal people asking why Envision alerts look so terrible. I almost always have to include the payload to get the right info in any given alert and people HATE having to sift through that to get to the right info.

[RSAAdmin]

I agree. The standard output is not good. We've had to pick essential fields and tie the full message in at the end. It just looks very amatuer.