How to create a SEM email template to match an incoming rule so that all of the meaningful data in the event can be captured in the email

Complete the following steps to create an email template in Security Event Manager (formerly Log & Event Manager) to match an incoming rule so that all of the meaningful data in the event can be captured in the email.

Important Note: If you are receiving emails with blank fields, please follow this page link instead, If you are dealing with lacking information in the emails you are receiving from SEM and want to add additional fields into those emails, you are in the right place and should continue on.

Steps 

Generic Rule Email Template Setup 

1. Review the event that the rule is based on using the EventName search in nDepth.
2. Take a screenshot of an example of the event data in the Result Details so that it can be referenced later.
3. Go to BUILD>Groups in the SEM WebConsole/AirConsole and click the plus (+) sign in the top right corner of that page. Then, from the drop-down menu, select Email Template.
4. In the bottom left Name field type RuleName and click the plus (+) sign to the right.

   

5. Type Rule Name: $RuleName into the Name field in the top right.
6. Populate the From field in the top right with the name you want to associate with SEM in the email.
7. Type Rule Name: $RuleName into the Subject field in the top right.
8. Type Rule Name: $RuleName into the Message field in the lower right.

Specific Rule Email Template Setup 

1. Pull up the screenshot of the event that was captured during step 2 of the last section.
2. Identify the bolded fields in the event by using the Result Details screenshot and add them to the template just as you did with RuleName in the last section. 

   
   Important Note: These fields may be different based on the event. Identifying the meaningful fields based on the incoming data is important here. You will need to do some of the legwork to look over the incoming event associated with the rule.
   
   Example Meaningful Fields:

   EventInfo

   InsertionIP

   InsertionTime

   DetectionIP

   DetectionTime

   ToolAlias

   ProviderSID

   SourceAccount

   SourceMachine

   DestinationAccount

   DestinationMachine

   ExtraneousInfo

   (etc...)
    

3. Add these fields to the Email Template after they have been added to the Parameters section

   For our Example Meaningful Fields above, we would see something similar to the the following in the message section of the email template:
   

   $EventInfo

   $InsertionIP

   $InsertionTime

   $DetectionIP

   $DetectionTime

   $ToolAlias

   $ProviderSID

   $SourceAccount

   $SourceMachine

   $DestinationAccount

   $DestinationMachine

   $ExtraneousInfo 

4. The end result in the Message field should look something like this (with fields identified for the email recipient):
    

   Name:<Email Template Name>(Usually named after the Rule)
   From: LEM (or what ever you decide)
   Subject: Rule Name: $RuleName
   Rule Name: $RuleName
   

   Event Info: $EventInfo

   Insertion IP Address: $InsertionIP

   Insertion Time/Date: $InsertionTime

   Detection IP Address: $DetectionIP

   Detection Time/Date: $DetectionTime

   Connector Name: $ToolAlias

   Event ID: $ProviderSID

   Source Account: $SourceAccount

   Source Machine: $SourceMachine

   Destination Account: $DestinationAccount

   Destination machine: $DestinationMachine

   Extra Information: $ExtraneousInfo