event specific e-mail alerts (from VMS)

[slug420]

How can I create an e-mail alert that includes actual information about the event that triggered it?

Like for example, knowing a TCP Syn Host Sweep occured and met the threshold I set for my alert is faaar less useful than knowing 10.10.10.10 triggered it and not only met the threshold but triggered the alert 10,000 times.

I am running VMS 2.3 managing 5.x IPS sensors.

If VMS cannot do this then its officially a piece of shit.

Also, if VMS cannot do this, can MARS or CSM?

[mkirbyii]

See http://forums.cisco.com/eforum/servlet/NetProf?page=netprof&forum=Security&topic=Intrusion%20Prevention%20Systems/IDS&CommCmd=MB%3Fcmd%3Ddisplay_location%26location%3D.1ddd0907