Documentation forSecurity Event Manager

Create email templates for use with SEM rules

Email templates are pre-formatted messages that SEM sends to users when alert events trigger a rule.

If you have not yet configured SEM to connect to your mail server, see Set up SEM to send Email Alerts to configure it now.

About SEM email templates

You can use email templates to customize your email notifications when triggered as responses in your rules. An email template includes static and dynamic text (or parameters). The static text lets you customize the appearance of the email. The dynamic text is filled in from the original event that triggered the rule to fire.

Create email templates to report specific information about an alert event and variables that capture specific parameters about that event. For example, you can report which server is affected, what time the event occurred, or which Agent was shut down. Or you can create an Account Lockout template to notify key personnel when an account is locked out, or automatically file a trouble ticket. Create static text to describe the event, and incorporate dynamic text that provides the account information from the original event.

Create templates that are specific to an event type to avoid having to create one email template per rule. For example, you can have one template for Account Modification that can provide a notification when a user is added or removed from a group, when a password is reset, or when other account details are changed. There is no limit to the number of templates you can create.

Best practices to keep rules, events, and emails simple to manage

To keep rules, events, and emails simple to manage, SolarWinds recommends the following:

  • Create the rule with a name that describes the event.
  • Create the email template with a name that describes the event.
  • In the email template subject or message, enter the event or rule name to describe the event or alert.

When you receive the email, you can identify the email template, the rule that fired, and the event that caused the rule to fire.

Create or edit an email template

You can use email templates to customize your email notifications when triggered as responses in your custom rules. An email template includes static and dynamic text (or parameters). The static text lets you customize the message body of the email. The dynamic text is filled in from the original event that caused the rule to fire.

  1. In the SEM Events Console, click the Groups tab.
  2. From the Manage drop-down list, select E-mail templates, and then click Create E-mail template.

  3. In the Template name field, enter a descriptive name for the template.
  4. In the From field, enter who sent the message. For example, SolarWinds or SEM Manager.
  5. In the Message field, add static text, or click the Add parameter button to add dynamic text (parameters).

    You can also type a $ sign directly into the message body to open the parameter naming tool.

    The static text lets you customize the message body of the email. The dynamic text is filled in from the original event that triggered the rule to fire. For example, in the parameter name field, enter a reference to actual event data, such as DetectionIP, DestinationAccount, EventInfo, etc., and then click Add.

  6. To save your template, click Create. When the email is initiated, the dynamic text (parameters) in the message body will be replaced by the actual value in the event log that triggered the action.

The new template is now available as an action type in your custom rule builder. To learn more, see Create a new rule.

In the Refine Results pane, you can also filter the groups by the modifier and the time last modified.