Modify or copy default Incident Email Template

Dazz · ‎10-02-2024

Hi, is there any way to edit or make a copy of the Default Incident Email Template?

and secondd question about it, this Default Incident Email Template dissappear form the list on Settings->System->Email and i am finding a way to restore, maybe is a file but i dont know where is and the name.

Any suggestion??

Cybersecurity enthusiast.

Anthony_E · ‎10-06-2024

Hello Dazz,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks,

Anthony-Fortinet Community Team.

Anthony_E · ‎10-07-2024

Hi premchanderr,

As a FortiSIEM expert, do you have an idea?

Thanks a lot in advance,

Regards,

Anthony-Fortinet Community Team.

Richie_C · ‎10-08-2024

Hi @Dazz

It is not possible to view the default templates in the GUI. There are various HTML templates in the following locations from the CLI:

/opt/glassfish/domains/domain1/applications/phoenix/phoenix-web-1.0_war/html/templates/admin/popups/

t/glassfish/domains/domain1/applications/phoenix/phoenix-web-1.0_war/

/opt/glassfish/domains/domain1/applications/phoenix/phoenix-web-1.0_war/html/templates/admin/pages/

It is NOT recommended or supported to change the default templates. But, i guess you you use the template as an example and use the HTML to create a new custom template.

Thanks

Take a backup before making any changes

Richie_C · ‎10-08-2024

The following example would give you a table and include various attributes from an incident.

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head>
                        <table class="contents" style="border-collapse: collapse;border-spacing: 0;table-layout: fixed;width: 100%">
                          <tbody><tr>
                            <td class="padded" style="padding: 0;vertical-align: top;padding-left: 32px;padding-right: 32px;word-break: break-word;word-wrap: break-word">
              <p style="Margin-top: 0;text-align: left;"></p>
            <p>This is a custom incident email notification. See the details Below.</p>
            <table style="margin-top: 0px; margin-left: 0;margin-right: auto;width: 100%;" cellspacing="0">
            <col style="width: auto;"/>
            <tbody>
                <tr>
                   <td colspan="2" style="background-color: #FF0000;padding: 10px;border-bottom: 1px solid;border-color: #ffffff;color: #ffffff;"><strong>Incident Information</td>
                </tr>
                <tr>
                    <td width="32%" style="background-color: #e5e5e5;padding: 10px;border-bottom: 1px solid;border-color: #ffffff;"><strong>Incident ID</td>
                  <td width="68%" style="border-bottom: 1px solid;border-color: #c0c0c0;padding: 10px;">$incidentId</td>
                </tr>
            <tr>
                    <td style="background-color: #e5e5e5;padding: 10px;border-bottom: 1px solid;border-color: #ffffff;"><strong>Incident Source</td>
                    <td style="border-bottom: 1px solid;border-color: #c0c0c0;padding: 10px;">$incident_source</td>
                </tr>
                <tr>
                    <td style="background-color: #e5e5e5;padding: 10px;border-bottom: 1px solid;border-color: #ffffff;"><strong>Incident Target</td>
                    <td style="border-bottom: 1px solid;border-color: #c0c0c0;padding: 10px;">$incident_target</td>
                   
                    </tr>
                 <tr>
                  <td style="background-color: #e5e5e5;padding: 10px;border-bottom: 1px solid;border-color: #ffffff;"><strong>Rule Name</td>
                  <td style="border-bottom: 1px solid;border-color: #c0c0c0;padding: 10px;">$ruleName</td>
                </tr>
                 <tr>
                  <td style="background-color: #e5e5e5;padding: 10px;border-bottom: 1px solid;border-color: #ffffff;"><strong>Host Name</td>
                  <td style="border-bottom: 1px solid;border-color: #c0c0c0;padding: 10px;">$hostName</td>
                </tr>
                <td style="background-color: #e5e5e5;padding: 10px;border-bottom: 1px solid;border-color: #ffffff;"><strong>Severity Category</td>
                  <td style="border-bottom: 1px solid;border-color: #c0c0c0;padding: 10px;">$incident_severityCat</td>
                </tr>
                 <tr>
                  <td style="background-color: #e5e5e5;padding: 10px;border-bottom: 1px solid;border-color: #ffffff;"><strong>Rule Description</td>
                  <td style="border-bottom: 1px solid;border-color: #c0c0c0;padding: 10px;">$ruleDescription</td>
                </tr>
                <tr>
                    <td style="background-color: #e5e5e5;padding: 10px;border-bottom: 1px solid;border-color: #ffffff;"><strong>First Occurrence Time</td>
                    <td style="border-bottom: 1px solid;border-color: #c0c0c0;padding: 10px;">$firstSeenTime</td>
                </tr>
                <tr>
                    <td style="background-color: #e5e5e5;;padding: 10px;border-bottom: 1px solid;border-color: #ffffff;"><strong>Last Occurrence Time</td>
                    <td style="border-bottom: 1px solid;border-color: #c0c0c0;padding: 10px;">$lastSeenTime</td>
                </tr>
                <tr>
                <td style="background-color: #e5e5e5;padding: 10px;border-bottom: 1px solid;border-color: #ffffff;"><strong>Detail</td>
                  <td style="border-bottom: 1px solid;border-color: #c0c0c0;padding: 10px;">$incident_detail</td>
                <tr>
                    <td style="background-color: #e5e5e5;padding: 10px;border-bottom: 1px solid;border-color: #ffffff;"><strong>Incident Count</td>
                    <td style="border-bottom: 1px solid;border-color: #c0c0c0;padding: 10px;">$incident_incidentCount</td>
                </tr>
                <td style="background-color: #e5e5e5;padding: 10px;border-bottom: 1px solid;border-color: #ffffff;"><strong>Triggering Events</td>
                    <td style="border-bottom: 1px solid;border-color: #c0c0c0;padding: 10px;">$rawEvents</td>
                </tr>
                   
        </table>
        <br>
<div class="spacer" style="font-size: 1px;line-height: 32px;width: 100%">&nbsp;</div>
                    </body></html>

Take a backup before making any changes

Dazz · ‎10-15-2024

Thanks for the reply, it was very helpful. I'm still checking the documentation to see where the default template is that was lost.
I'll come back with more questions :)

Cybersecurity enthusiast.

Modify or copy default Incident Email Template

Nominate a Forum Post for Knowledge Article Creation