There are two alert payload types that can be leveraged with email notification payloads: event and event_cleared. An event is generated when a policy is violating. An event_cleared is generated when a once-violating policy is no longer violating. Your custom event payloads can be setup to notify you on either type with unique messaging and details about the alert.
To create a custom event payload:
Alternatively, you can create your new custom email payload in the policy editor on the new notification itself by clicking + New Email.
Example 1
This example provides the policy name related to the alert in the subject of the email and then provides the alert category name of the alert firing in the body. When the alert clears, it sends another email with CLEAR
as the body text.
CloudWisdom Alert [${policyName}]
<#if payloadType == "event">
${eventCategory.name}
</#if>
<#if payloadType == "event_cleared">
CLEAR
</#if>
Example 2
This example sends an email with UP
or DOWN
as the subject line, with all of the alert details in the email body.
<#if payloadType == "event">DOWN</#if><#if payloadType == "event_cleared">UP</#if>
Time: ${eventTimestamp}
Event Category: ${eventCategory.name}
Policy Name: ${policyName}
Policy Description: ${policyDescription}
Event ID: ${event.id}
Element: ${elementName}
Violation: ${event.data.results}