Did anybody know how I can customize Default SMTP Template for ESA? I need exclude all meta keys and include only 4-5 meta keys for enduser. For example I wish to send end user only: source and destination ip's and also action key and username.
How customize this template?
to refer to any meta you could use this syntax....
<#list events as event>
<#if event_index=1>
<li>user: ${event.user_dst}
<li>outcome: ${event.ec_outcome}
</if>
And modify the xml according to your requirements.