Security Compliance

SEM email alerts sent by rules are blank or missing details

This KB article describes how to update SEM rules to prevent SEM from sending email messages that are either empty or missing event details. Refer to these steps to learn how to add dynamic values from the event firing the rule to the Send Email Message action.

First published date

10/10/2018 2:15 PM

Last published date

10/10/2018 2:15 PM

Overview

Email messages sent in response to Security Event Manager (formerly Log & Event Manager) rules firing are empty or missing actual event details.

Product section

Security Event Manager

Cause

The fields in the Send Email Message Action of the rule are not populated.

Resolution

  1. On the SEM Console, go to Build > Rules and edit the rule that sent the email message.
  2. To populate the Send Email Message action with dynamic values from the event firing the rule:
    1. On the left side, locate the Event or Event Group used in the rule's Correlations section.
    2. Highlight the Event to populate its available fields in the Fields listing under the Events listing.
    3. Drag the appropriate fields from the Fields listing into your action. Afterwards, your Send Email Messages fields should appear as in this example:
       
  3. Click Save to save your changes and exit Rule Creation.
    Important: Back in the folders view, you'll see that the Activate Rules button is enabled in the top right corner. This allows you to batch up all your rule changes in case you want to make multiple changes before changing the running state of the manager. So, verify that you click Activate Rules to tell the Console to enable your changes.