Need Help Configuring Alert Actions to Include Log Data in OpenSearch

Plugins Alerting
4

Hey @joseraeiro2

Correct me if I’m wrong, but you would like more details about the alert in the Notification sent?

Example:
I found that adding this to my query

 "exists": {
"field": "winlog.event_data.SubjectUserName",
"boost": 1
}

Then I would add that field to my Message section…

Monitor {{ctx.monitor.name}} just entered alert status. Please investigate the issue.
  - Trigger: {{ctx.trigger.name}}
  - Severity: {{ctx.trigger.severity}}
  - Period start: {{ctx.periodStart}}
  - Period end: {{ctx.periodEnd}}
 -  username: {{_source.winlog.event_data.SubjectUserName}}

Email Results:

> 2 
>  gsmith.domain.com
>  greg.smith

This post might help.