Email Alert Body

teaz

Hello,

I have a question about alert emails. I have the following rule definition (to catch a failed login on Fortigate):

I would like to define the email subject and body myself. In the received email a part of the body has been added somewhere by ELS. An example of the email is displayed below. In the example the body should only be 'email test body', without the part after. The issue is that the email is not readable and contains too much information. Where in ELS is the email body defined / added?

teaz

Nevermind, 'alert_text_type: alert_text_only', solves the problem.

SzymonC

Hi,

You are absolutely right. Here's my example:

alert_text_type: alert_text_only
alert_text: \"Host from AS family detected\n\n\n Host: {}\n\n Application name: {}\n\n Application group: {}\n\n Application status: {}\n\n"
alert_text_args:
  - host
  - app_name
  - app_group
  - app_status

Result:

Just remember that first {} in alert_text corresponds with first object from alerts_text_args list.