How to get context Alert Data in SUBJECT of Security Alert SIEM

Hi,

I Have a Security Alert where I have to get data_stream.namespace and host.name in SUBJECT of Alert

Can someone please guide me through it?

I have tried below but got blank in output mail subject

Subject : AlertName | {{context.alerts.data_stream.namespace}} | {{context.alerts.host.name}}

I am getting results in email body as I put following syntax


{{#context.alerts}}

Namespace : {{data_stream.namespace}}
Hostname : {{host.name}}

{{/context.alerts}}

Help would be much appreciated

Thanks !!

Hi Rohit,

The reason your subject line is empty is that context.alerts is an array and you have to iterate through it, by doing something like: {{#context.alerts}}{{data_stream.namespace}}{{/context.alerts}}.

That said, I'm guessing you don't want all the namespaces in your subject line as it would the nbe very long, so perhaps try this: {{context.alerts.0.data_stream.namespace}}. This would give you the namespace in the first alert document contained in context.alerts.

1 Like

Thanks for the blazing fast reply @gmmorris !
It really helped !!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.