Task 4508 Feature Request

[mikew]

I am wondering about the status of TASK ID 4508 which is the request to add the log content into the email notification/NRDP Notification. I have several people requesting some method to provide log content into the notification as without that it requires you to go back and dig into the log info tor the exact reason for the notification. For example, if you get a notification that a user account has been locked, you will need to go back to Log Server and discover which user account was locked. If the username was included in the notification that would make it easier.

Solution Options:
1. Add content to email

2. Script
As a temporary solution could you write a script that could access this information on the Log Server?

Thanks...just trying to figure how to make this work.

[tmcdonald]

We were just discussing this in Dev chat. The main problem is that there is not "a" message we could include, since we alert based on a number of matches being found in a given period. So if we trigger a critical for 10 failed logins, which message do we include? If we include them all, this can be a very large email very quickly. If we just include the last message as a representative sample, that might work but inevitably someone will say "But we need the 5th message if it's a Saturday otherwise the 3rd and 7th messages". Now of course I'm being somewhat ridiculous there, but it does happen :)

That being said, what it sounds like is we will either include an API link for the full JSON message, the last message, or a list of unique hosts in the query. These would be macro options of course, so you can choose how/if they appear in the email.

[mikew]

Good points. It is certainly more complex than it looks as you say. Appreciate the input.

[jolson]

This is a feature that the community has wanted for some time, it's very highly requested.

The developers have told us that something is in the works, but haven't given an exact timeline - just know that we're aware of this feature and we're working on a solution. Thanks Mike, it was nice meeting you at the conference!