Did anybody know how I can customize Default SMTP Template for ESA? I need exclude all meta keys and include only 4-5 meta keys for enduser. For example I wish to send end user only: source and destination ip's and also action key and username.
How customize this template?
Could you share your template? I tried replicate your solution but this not gave result.
Alex Fedorov I had to use the following solution on a per alert basis to get the format requested by client...
'000031690 - How to send customized subjects in an RSA Security Analytics ESA alert email' in RSA Link.
Customer was very happy we were able to match the format of their previous SIEM alerts from Trustwave.
to refer to any meta you could use this syntax....
<#list events as event>
<#if event_index=1>
<li>user: ${event.user_dst}
<li>outcome: ${event.ec_outcome}
</if>
And modify the xml according to your requirements.