Attach a CSV to an Alert with Results Different Than Those that Triggered the Alert

[aalara]

Greetings,

I've created an alert based on a search that uses the transaction command. The alert action is "send email". I then send one email per result and attach a CSV file. I use the transaction command to group events/results together and reduce the number of Emails that are sent.

This works well for the alerts/Emails, but i'd like to see if it would be possible to attach a CSV with results that are not grouped using the transaction command. In other words I want to attach a CSV file with results different than those that triggered the alert. Any assistance would be greatly appreciated.

Thank You

[DalJeanis]

The key to the question is "results different". As long as the results can be derived from the results that triggered the alert, then it is possible.

There are a number of ways. For instance, you could write out the results to a csv file, and instead of "send email", trigger a second report that will read the csv and create the results to be emailed.

You could also rewrite the report so that it is creating the results that need to be emailed, and doing the decisioning step in an appendpipe or eventstats, so that the original data is still available after the decision to alert is made.

Or, you could take the final results that set off the alert, and use them as input to the map command to (re-)pull the event records to send.