Notification via Mail - Improvement

[RFeyertag]

Hello! 

Changes are coming with 3.11, but for improvement put this information directly into mail:

• Source
• Category
• Action
• Host
• Username
• Starred Alert
• Excluded Alert
• Alert ID
• Incident ID
• actor_process_image_path
• actor_process_image_name
• actor_process_command_line
• actor_process_image_sha256
• causality_actor_process_image_path
• causality_actor_process_image_name
• causality_actor_process_command_line
• causality_actor_process_image_sha256
• os_actor_process_image_path
• os_actor_process_image_name
• os_actor_process_command_line
• os_actor_process_image_sha256

If you like to do it the sexy way, let us choose what we want to see. 

BR

Rob

[aspatil]

Hello @RFeyertag ,

Thanks for reaching out on LiveCommunity!

This may create the email noisy. All the required information is provided with JSON file is attached to the email.

However, we welcome your suggestion. Please open FR for the same.

If you feel this has answered your query, please let us know by clicking on Like and "mark this as a Solution".

[Rindsland · Accepted solution]

We also want it like the old way, instead as attachment.

It would also be a cool thing, to configure what is showing directly inside the Mail.

I am pretty sure that also other customers would like to see this.

Best regards

Marcus

[nbichsel]

The notification email is my biggest pain point.
I can't have  XDR send that email with everything and expect our night shift techs to be able to decern if waking me up is important or not.

[Rindsland]

FR?