How to send email alert to groups based on condition success using Kibana Rules

Elastic Security SIEM
1

I have created a rule using Kibana rules, by following the below steps:

  1. Created a new rule by selecting "Rule" under the "Security" section
  2. Then selected the rule type as "Event Correlation", wherein I added the index pattern and wrote the EQL (which included the where condition to include the events)
  3. Added the required fields in the Action section, and then saved the rule.

enter image description here

I am getting the email alerts based on the condition written, but the alerts are such that:

Suppose a single mail contains the below content -

ClientName: ABC
HostName: ABC

ClientName: ABC
HostName: ABC

ClientName: DEF
HostName: DEF

But I want to group the mail so that each mail should have data related to only 1 clientName. As in this case email should have contained data of only those clients whose name is ABC

Whereas the data of clientName DEF, should be sent in a different mail.

Is there a way to achieve this type of grouping based on the clientName? This similar situation can be done using watcher as given in this answer, but can anyone please let me know what the ideal way to do that in my case ?

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.