Documentation forSecurity Event Manager

Create email templates for use with SEM rules

Email templates are pre-formatted messages sent to users when alert events trigger a rule. You can use email templates to customize your email notifications triggered as responses in your rules.

An email template includes static and dynamic text (or parameters). The static text allows you to customize the email design. The dynamic text is created from the original event that triggered the rule to fire.

Report specific information

Create email templates to report specific information about an alert event and variables that capture specific parameters about that event. For example, you can report which server is affected, what time the event occurred, or which agent was shut down. Additionally, you can create an Account Lockout template to notify key personnel when an account is locked out or automatically file a trouble ticket. Create static text to describe the event, and incorporate dynamic text that provides the account information from the original event.

Address specific event types

Create templates that are specific to an event type to avoid having to create one email template per rule. For example, you can have one template for Account Modification that can provide a notification when a user is added or removed from a group, when a password is reset, or when other account details are changed. There is no limit to the number of templates you can create.

Best practices

To keep rules, events, and emails simple to manage, SolarWinds recommends the following:

  • Create the rule with a name that describes the event.
  • Create the email template with a name that describes the event.
  • In the email template subject or message, enter the event or rule name to describe the event or alert.

When you receive the email, you can identify the email template, the rule that fired, and the event that caused the rule to fire.

Create or edit an email template

You can use email templates to customize your email notifications when triggered as responses in your custom rules. An email template includes static and dynamic text (or parameters). The static text lets you customize the message body of the email. The dynamic text is filled in from the original event that caused the rule to fire.

  1. Log in to the SEM Console.
  2. On the toolbar, click Configure > Email Templates
  3. On the Email templates toolbar, click Create Email template.
  4. Complete the fields in the Create Email template window.

    1. In the Email template name field, enter a descriptive name for the template.

    2. In the Subject field, enter the subject of the template email.
    3. In the Message field, enter the text of the message to be included in this email. This text is static and cannot be edited within emails created from this template. However, you can include parameters which are replaced by the appropriate metrics (or string) when an email is generated by a rule that uses this template.

      To add parameters, either type $ or click Add parameter, then add the parameter. You do not need to specify the values here, and can use any combination of letters, number and the "." ,"_", and "-" characters.

      When you create the rule, the fields that can be substituted for these parameters are displayed. For example, if your message is:

        This $info event occurred at $time.

      You create a rule triggered by Access.IsThreat, which you can assign any of the Access fields to replace the parameters.

      In the Refine Results pane, you can also filter the groups by the modifier and the time last modified.

  5. Click Create to save your template.

    The new template is now available as an action type in your custom rule builder. See Create a new rule for more information.