Threshold Rule type - not able to send more than three field values in email action

Elastic Security SIEM
,
1

Hi,

Threshold rule type is not allowing to send more than three field values in email action body. Group by is allowed to do onyl for three fields and those field values are only are available in the aggregated alert output.

{{#context.alerts}}
{{#signal.threshold_result.terms}}
{{value}}
{{/signal.threshold_result.terms}}
{{/context.alerts}}

Please let me know if there is any option to add more field information's in the threshold alert from the log events.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.