enVision 3.5.2
Is there any way to customize the subject line in an SMTP output action or template? Instead of using one of the three pre-canned options of Short, Medium, or Long, none of which allow you to modify their content.
Ideally I'd like to set up smtp output actions and/or templates just like we do reports where I can declare SQL clauses and specify variables to construct a dynamic subject line so the people receiving the email alerts have something more relevant.
Say you have a corelation rule fire when XYZ happens on a firewall or IDS. I'd like to be able to specify the SMTP subject line to say "XYZ on %DeviceHostName%". Or in certain circumstances where your paging out to someone who's oncall that there is an increased trend in something happening, like "Virus Threshold Exceeded, %VirusCount% detections of %virusname% in last hour."
That would be way more helpful than a subject line of: ViewName, AertCategoryName, etc, etc, etc.
Anyone had any luck with this? Any ideas?
We're using a custom output action template for SNPP paging, and we are only getting the fields that we need in the page. All we did was create the new output action template, select the long subject type, and then select only the fields that we wanted. That may have only worked for us, though, because subject info is ignored -- I assume that you've already tried creating a new template with limited selections?
The other thing you could try is to edit the outputformat.xml file to move the fields that you view as important to the top of the file. When you do this, the fields show up in a different order on the template creation page. I'm not sure how the subject type determines which fields it needs -- if it is by order or name in this file, you can use that to your advantage! I believe that the outputformat.xml file is only used at the time of the template creation, too, so you can revert back to the original after you've created the template you want.
Again, this is just theory at this point, but may be worth a try while you are waiting for support...