Detections Hostname Variable

[xennn]

Please add the variable for a Hostname in the Detections Alert
(Alert notification placeholders)

https://www.elastic.co/guide/en/security/master/rules-ui-create.html

We use the feature for notification and cant include the hostname in the email

For the Watchers this Feature work there but not in Alerting from detections

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[spong]

Hey there @xennn, this functionality is now available in the 7.11 release. 🙂

Docs are here, and an example that loops over all the alerts and prints their host name is as follows:

{{#context.alerts}}
Detection alert for host: {{host.name}}
{{/context.alerts}}

Here's the PR adding this functionality if relevant. Note: we don't currently provide autocomplete or a list of available fields on context.alerts as this will vary from rule to rule, but all fields written to the resulting alert should be available.

[elasticmachine]

Pinging @elastic/security-detections-response (Team:Detections and Resp)

[xennn]

We update to Kibana 7.11.1 and it is not working

[spong]

Would you be able to provide more information to help debug? Is the action not firing? Can you share your action template? If the action is firing, what's the body of the payload received? Have you verified the output alert indeed has the fields you're referencing?

That should be enough to get us moving 🙂

[PurpleV0id]

im having the same issue, this is an example of my action message for email:
{{#context.alerts}}
host.name: {{host.name}}

user.name: {{user.name}}
{{/context.alerts}}

user.name is populated but host.name is not. I also added {{context.alerts}} to the message to check the output and fields and {{host.name}} is within the output

I have included alot of other fields based around process. etc and so far host.name is the only one thats coming up blank.

[xennn]

Oh its working for me, i forget the {{#context.alerts}}. Now it´s working fine for me. I test only with {{host.name}}
Thank you @PurpleV0id
Now i need a soloution to change it global in all rules -> #91337

[PurpleV0id]

@xennn
so it works for you but not working for me.

When looking at the output of {{context.alerts}} fields such as user.name are nested such as "user":{"name":"someone","domain":"somedomain"}

my host.name and host.hostname is not nested. Its the only difference i can see between the fields that work and host.name

[spong]

@PurpleV0id, are your source indices for this rule ECS compliant? While recommended, Detections will still function if not, but you'll need to match the same format in your action template as the source events. So if hostname is on the root alert instead of host.name, you'll need to reference as so: {{hostname}}.

If I'm understanding correctly that should work for you. Printing the whole object and then trying to reference a field based on that format should do it. If not, could you provide a sample source document, rule, and action template, and we can create a new issue to address 🙂