How to get context Alert Data in SUBJECT of Security Alert SIEM

Elastic Security Endpoint Security
1

Hi,

I Have a Security Alert where I have to get data_stream.namespace and host.name in SUBJECT of Alert

Can someone please guide me through it?

I have tried below but got blank in output mail subject

Subject : AlertName | {{context.alerts.data_stream.namespace}} | {{context.alerts.host.name}}

I am getting results in email body as I put following syntax


{{#context.alerts}}

Namespace : {{data_stream.namespace}}
Hostname : {{host.name}}

{{/context.alerts}}

Help would be much appreciated

Thanks !!

2

Hi Rohit,

The reason your subject line is empty is that context.alerts is an array and you have to iterate through it, by doing something like: {{#context.alerts}}{{data_stream.namespace}}{{/context.alerts}}.

That said, I'm guessing you don't want all the namespaces in your subject line as it would the nbe very long, so perhaps try this: {{context.alerts.0.data_stream.namespace}}. This would give you the namespace in the first alert document contained in context.alerts.

1 Like
3

Thanks for the blazing fast reply @gmmorris !
It really helped !!

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.