Thanks Ira. This was helpful. I was familiar with the first placeholder, but not customtags.value. Adding it to my email alert template, I am now seeing results! I was planning on identifying specific attributes, eg. enrichment field1 = fullname, but being able to include all of them with this placeholder works in this use-case. I called it "Additional Information:"
------------------------------
Gary Olsen
------------------------------
Original Message:
Sent: 02-18-2020 03:20
From: Ira Miga
Subject: Enrichment Field Values within Email Action Sets
Hi Gary,
You should be able to send enrichment data to email using placeholders ${Event.irregularBehaviors.infoAttributes.name} and ${Event.customTags.value}.
Can you please share what is the issue when configuring this kind of action set?
------------------------------
IraMiga
Original Message:
Sent: 02-14-2020 12:01
From: Gary Olsen
Subject: Enrichment Field Values within Email Action Sets
I would like to add enrichment fields into our email based action sets. In looking in the Placeholders section in the SecureSphere Database Security User Guide, the only thing I can find referencing enrichment is ${Event.irregularBehaviors.infoAttributes.name} with the description of "The enrichment tags' names.". Has anyone had success in doing something like this before?
#DatabaseActivityMonitoring
------------------------------
-----------------
Gary Olsen
------------------------------