Create email templates for use with SEM rules

You can use email templates to customize your email notifications when triggered as responses in your custom rules. An email template includes static and dynamic text (or parameters). The static text lets you customize the message body of the email. The dynamic text is filled in from the original event that caused the rule to fire.

1. On the SEM Console, click the Configure tab.
2. From the Configure drop-down list, select E-mail templates, and then click Create E-mail template.

   

3. In the Email template name field, enter a descriptive name for the template.
4. In the Subject field, enter the subject of the template email.
5. In the Message field, enter the text of the message to be included in this email. This text is static and cannot be editing within emails created from this template, but you can include parameters which are replaced by the appropriate metrics (or string) when an email is generated by a rule that uses this template.
6. To add parameters, either type $ or click Add parameter, then add the parameter. You do not need to specify the values here, and can use any combination of letters, number and the "." ,"_", and "-" characters.

   

   When you create the rule, the fields that can be substituted for these parameters are displayed. For example, if your message is:

   This $info event occurred at $time.

   And you create a rule triggered by Access.IsThreat, you will be able to assign any of the Access fields to replace the parameters.

   

7. To save your template, click Create.

The new template is now available as an action type in your custom rule builder. To learn more, see Create a new rule.

In the Refine Results pane, you can also filter the groups by the modifier and the time last modified.