On VMS 2.2 with SecMon 1.2.3, the section admin/event rule allows you to send an email.
I have a requirement to send an email for various signatures when they are triggered on a particular sensor. The email should include the source and the destination address as well as the time, date and count etc.
I created a rule as follows
Rule Name: Rule
-----------------------------------------------
Comment: “signature description”
-----------------------------------------------
Active: yes
-----------------------------------------------
Filter: (Signature Name = “signature description”) AND
(Originating Device = abc) OR
(Originating Device = xyz)
-----------------------------------------------
Rule Actions:
Notify via Email:
Recipient(s): ----
Subject: Rule
Message: (Signature Name = “signature description”) AND
(Originating Device = abc) OR (Originating Device = xyz)
The following rule: ${RuleName}, has triggered ${MsgCount} times on the ${DateStr} ${TimeStr}
-----------------------------------------------
Thresholds and Intervals:
Issue action(s) after 3 event occurrences.
Repeat action(s) again after 5 event occurrences.
Reset count every 30 minutes.
Unfortunately it does not seam to work as I thought it would. Could anyone tell me if this is at all possible or even achievable with VMS?
The strange thing is that with this rule active, I receive emails even when the “signature description” has not even triggered.
