Send Email Message Action in Rule Creation in SEM

10/18/2018 7:13 PM

10/25/2018 1:46 AM

This article applies to Security Event Manager (formerly Log & Event Manager).

This article describes how to use the Send Email Message action in Rule Creation.

Security Event Manager

Before adding an action, consider the example used in the two related procedures and perform the following:

1. On the SEM console toolbar, navigate to Build > Rules.
2. In the Refine Results pane, click Change Management, and then scroll down to the the User Account Lockout template under Rule Templates.
3. Click the gear icon, and then select Clone.
4. Edit the rule correlations as needed, and then click Save.

To add or edit a Send Email Message Action:

1. Expand the Actions list in the Components pane on the left, and then drag Send Email Message into the orange Actions box on the right side.
   Note: If you make a mistake, or decide you want to clear out the actions and start over, move your pointer over any action and click the upper right X. There is also an Undo button in the lower left corner of the Rule Creation page.
2. Whether editing an existing Send Email Message Action or starting with a new one, select your template from the Email Template list.
   Note: If you forgot the name, you can always go back to Build > Groups to view your template details. Your rule will still be open when you come return to Build > Rules.
3. Click the Users list, and then select the check box next to the user(s) you want to notify about this event.
4. To populate the Send Email Message action with dynamic values from the event firing the rule:
   1. Locate the Event or Event Group in the rule Correlations. In this example, the User Account Lockout (Updated) Rule uses the UserDisable event, so expand Events on the components pane and type UserDisable into the search box.
   2. Click the Event to populate its available fields in the Fields list under the Events list.
   3. Drag the appropriate fields from the Fields listing into your action. In this example, the Email Template created in the related articles below require the following fields: DetectionTime for the Time variable, SourceMachine for the Machine variable, DestinationMachine for the DC variable, and DestinationAccount for the Account variable.
5. Make sure your rule is enabled by selecting the Enable check box.
   Note: Once enabled, you can also use the Test check box to put your rule in Test Mode. When a test rule fires, you will see InternalTestRule events in the Console to let you know it was triggered and what it would have done, but no action will have been taken.
6. Click Save to save your changes and exit Rule Creation.
   Important: Back in the folders view, you'll see that the Activate Rules button is enabled in the top right corner. This allows you to batch up all your rule changes in case you want to make multiple changes before changing the running state of the manager. Click Activate Rules to tell the console to send your changes to the manager and enable them.

At this point, your rule is active and your template is set up. The next time your rule fires, the recipients specified in your rule will have an email that matches the format you've specified.
Find the same procedure in the new HTML5 SEM Events Console here.

Common monitoring/troubleshooting steps: 

• How do I know that the rule is being triggered? Check your Console for InternalRuleFired events, either by using nDepth or a filter. Those events will show which rule was triggered and when.
• Rule is not triggered when it should be? Check your rule logic and timestamps. The appliance or virtual appliance host layer might need to be configured for NTP. By default, rules will not fire when incoming data drifts more than five minutes from the appliance's clock.
  1. Open a PuTTY session to SEM on port 32022.
  2. Using the CMC user, enter the appliance menu.
  3. Enter the dateconfig command, and confirm the date and time on the Console. The time can be changed with this command, but when the vSphere/Hyper-V time sync pushes the time to the SEM, this will change.
• Rule is triggered but emails are not sent? Make sure that the Email Active Response connector is configured on your manager appliance by performing the following:
  1. Go to Manage > Appliances.
  2. Click the leftmost gear icon, going to Connectors > Email Active Response.
  3. Click Gear > New to create a new connector, or click Gear > Stop and Gear > Edit to edit the configuration if you see a mistake.
     Note:Always click Save and Gear > Start to start/restart the connector. If you typed in a test email address, you can click Test after starting to send a test mesage.

Related Procedures 

• Creating Users in the SEM Console in the SEM Admin Guide.
• Creating Email Templates in the SEM Console in the SEM Admin Guide.
  .