# Link recognition in Elastic Detections emails seem wrong and confusing

**URL:** <https://discuss.elastic.co/t/link-recognition-in-elastic-detections-emails-seem-wrong-and-confusing/267156>\
**Category:** Kibana\
**Tags:** elastic-stack-alerting\
**Created:** [March 13, 2021, 5:49pm UTC](https://discuss.elastic.co/t/link-recognition-in-elastic-detections-emails-seem-wrong-and-confusing/267156 "2021-03-13T17:49:52Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![willemdh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/willemdh/32/16922_2.png) [@willemdh](https://discuss.elastic.co/u/willemdh)\
**Post date:** [March 13, 2021, 5:49pm UTC](https://discuss.elastic.co/t/link-recognition-in-elastic-detections-emails-seem-wrong-and-confusing/267156/1 "2021-03-13T17:49:52Z")

</div>

Hello,

While working with Elastic Emails alerts on detections, I've noticed several misrecognized links. For example:

![image](https://us1.discourse-cdn.com/elastic/original/3X/c/5/c5e3554f0005771b0c1866a3b0e367095a06c525.png)

In the above example `user.name` is suddenly a link.., while this is just a part of a query.

![image](https://us1.discourse-cdn.com/elastic/original/3X/7/6/76cdb771e01ce5dcc466418ef7fca0cb1f90d21e.png)

Another issue seems that url's with large links are not complete:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/3/d/3d3a8c4b5e0cce8ca181fbdc8626446e7f1905f1.png)

Resulting in:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/a/aaaa08dece2a28406305989a82ad88553969c977.png)

Best regards,

Willem

---

<div class="post-metadata">

**Author:** ![tsullivan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tsullivan/32/31077_2.png) [@tsullivan](https://discuss.elastic.co/u/tsullivan)\
**Post date:** [March 17, 2021, 5:16pm UTC](https://discuss.elastic.co/t/link-recognition-in-elastic-detections-emails-seem-wrong-and-confusing/267156/2 "2021-03-17T17:16:04Z")

</div>

Hi, what does the email action in your watch definition look like?

There are different ways to set the text body: `body`, `body.text` and `body.html`

The definition may mistakenly have `body` or `body.html` when it should be `body.text`

---

<div class="post-metadata">

**Author:** ![willemdh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/willemdh/32/16922_2.png) [@willemdh](https://discuss.elastic.co/u/willemdh)\
**Post date:** [March 17, 2021, 7:12pm UTC](https://discuss.elastic.co/t/link-recognition-in-elastic-detections-emails-seem-wrong-and-confusing/267156/3 "2021-03-17T19:12:53Z")

</div>

Hi @tsullivan

My issue is about Kibana alerting, not Elastic watches.

Grtz

Willem

---

<div class="post-metadata">

**Author:** ![Patrick\_Mueller](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/patrick_mueller/32/109425_2.png) [@Patrick\_Mueller](https://discuss.elastic.co/u/Patrick_Mueller)\
**Post date:** [March 18, 2021, 6:01pm UTC](https://discuss.elastic.co/t/link-recognition-in-elastic-detections-emails-seem-wrong-and-confusing/267156/4 "2021-03-18T18:01:36Z")

</div>

Hello again @willemdh !

From previous discussion on html rendering of emails with markdown, I mentioned we had "linkification" turned on, and I'm guessing that is what is doing this, since ... I guess they could be hostnames.

For mustache templates that you are creating, I'm guessing that if you replaced but some back-tics ( ` ) before and after the variable reference (before `{{` and after `}}`, the linkifier may be smart enough to know not to linkify those.

I think we'll have to add an option to email to allow the linkification to be turned off. I'll open an issue on this and post it back here ...

For that super-long link, I'd guess it's likely hopeless to get these auto-linkified correctly. Did that come from one of our existing alerting templates, or one of your own? Because I'd suggest to convert that to an explicit markdown link instead, for example `[Results link](long-url-here)`. I can open an issue for the security alert though, if it's that's the default template it provides.

The error (with the stack walkback) you're seeing when traversing the link seems like a separate issue - it's just not handling "incorrect" URLs well. I'll open a separate issue on that.

---

<div class="post-metadata">

**Author:** ![Patrick\_Mueller](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/patrick_mueller/32/109425_2.png) [@Patrick\_Mueller](https://discuss.elastic.co/u/Patrick_Mueller)\
**Post date:** [March 18, 2021, 6:14pm UTC](https://discuss.elastic.co/t/link-recognition-in-elastic-detections-emails-seem-wrong-and-confusing/267156/5 "2021-03-18T18:14:14Z")

</div>

Issue opened to look into the auto-linkification in emails: [[actions] allow email auto-linkification to be turned off · Issue #94963 · elastic/kibana · GitHub](https://github.com/elastic/kibana/issues/94963)

---

<div class="post-metadata">

**Author:** ![Patrick\_Mueller](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/patrick_mueller/32/109425_2.png) [@Patrick\_Mueller](https://discuss.elastic.co/u/Patrick_Mueller)\
**Post date:** [March 18, 2021, 6:30pm UTC](https://discuss.elastic.co/t/link-recognition-in-elastic-detections-emails-seem-wrong-and-confusing/267156/6 "2021-03-18T18:30:33Z")

</div>

Just opened this issue for the stack walkback you saw: [error traversing malformed link into security from an action email · Issue #94967 · elastic/kibana · GitHub](https://github.com/elastic/kibana/issues/94967)

---

<div class="post-metadata">

**Author:** ![willemdh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/willemdh/32/16922_2.png) [@willemdh](https://discuss.elastic.co/u/willemdh)\
**Post date:** [March 19, 2021, 2:38pm UTC](https://discuss.elastic.co/t/link-recognition-in-elastic-detections-emails-seem-wrong-and-confusing/267156/7 "2021-03-19T14:38:48Z")

</div>

Hi @Patrick_Mueller,

Thanks for making the GH Issues and the recommendations. I think the super long link is a SIEM rule reference, I'm gonna have to take a good look if I can nest the rule references into Results link.

Fyi, this is the current configuration I'm using for our SIEM alerts. It's quite generic and can be used for both threshold and query rules. It does need to be further tested on anomaly rules though and there is a small issue with multiple filters I need to fix.

```
Elastic SIEM **{{context.rule.severity}}** ( **{{context.rule.risk_score}}** ) severity alert triggered at **{{date}}** for rule **{{alertName}}**!

{{state.signals_count}} signals found. ({{context.rule.max_signals}} max)

{{context.rule.description}}

This is a *{{context.rule.type}}* *{{context.rule.language}}* rule with query *{{context.rule.query}}*

{{#context.rule.threshold}}
and threshold *{{.}}*
{{/context.rule.threshold}}
{{^context.rule.threshold}}
{{/context.rule.threshold}}

{{#context.rule.filters}}
and filters *{{.}}*
{{/context.rule.filters}}
{{^context.rule.filters}}
{{/context.rule.filters}}

{{#context.rule.false_positives}}
False postitives: *{{.}}*
{{/context.rule.false_positives}}
{{^context.rule.false_positives}}
{{/context.rule.false_positives}}

References:

{{#context.rule.references}}
{{.}}

{{/context.rule.references}}
{{^context.rule.references}}
No references found for this rule.

{{/context.rule.references}}

```

Something I would really love to see added into the SIEM alerting is a way to provide default email templates. Currently when I need to make a change I have to reconfigure 100's of rules... ☹

Best regards,

Willem

---

<div class="post-metadata">

**Author:** ![Patrick\_Mueller](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/patrick_mueller/32/109425_2.png) [@Patrick\_Mueller](https://discuss.elastic.co/u/Patrick_Mueller)\
**Post date:** [March 22, 2021, 12:25pm UTC](https://discuss.elastic.co/t/link-recognition-in-elastic-detections-emails-seem-wrong-and-confusing/267156/8 "2021-03-22T12:25:27Z")

</div>

Thanks, I've opened an issue to track this: [[alerting] customer-managed action parameter templates · Issue #95049 · elastic/kibana · GitHub](https://github.com/elastic/kibana/issues/95049)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 19, 2021, 12:26pm UTC](https://discuss.elastic.co/t/link-recognition-in-elastic-detections-emails-seem-wrong-and-confusing/267156/9 "2021-04-19T12:26:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.