Elastic Detection Rule Creation

Elastic Stack Elasticsearch
1

How do i pull variables from .source or the following required Fields defined in the SIEM alert so i can use it in EMAIL action body

image
image1090×604 39.5 KB

1 Like
2

The First email action, the json variables are accessible through

- Timestamp: {{context.date}}
- Hostname: {{context.hits.0._source.agent.name}}
- Service:  {{context.hits.0._source.windows.service.display_name}}

Confirmed in the State of Recovered Actions email, Variables do not come through