Hello Atlassian
I got this email
-
From: no-reply@manage.trendmicro.com <no-reply@manage.trendmicro.com>
Sent: Wednesday, June 22, 2022 6:44 PM
Subject: Apex Central Notification: Virus Found - First and Second Actions Unsuccessful
Apex Central (n5azba.manage.trendmicro.com) notification: Virus found action result.
The first and second virus scan actions were unsuccessful for the virus detected on \Apex Central as a Service\Local Folder\Apex One (Mac) as a Service\Apex One (Mac) as a Service\Default\ZADMRHF8J9\ZADMRHF8J9.
Update your components to the latest version.
Virus: OSX_Genieo.PFL
Action result: Unable to delete file
Infected file: PRTPLG1 File path: /Volumes/Time Machine Backups/Backups.backupdb/ZADMRHF8J9/2020-06-15-004754/MacIntosh HD/Users/cathor/Library/Application Support/ProntoApp/ZipRar/PRTPLG1.bundle/Contents/MacOS
Scan engine: N/A
Virus pattern: 17.563.00
Event date/time: 6/22/2022 09:10:52
-
What is the best way to get this alerted and not get duplicated alerts so having the unique entities and alias?
Hi @Afonso Henrique Rodrigues Alves ,
If you want all emails to create alerts vs. deduplicating, you don't necessarily need to configure anything in the alias field. Leaving it blank would automatically parse the alert's ID into the alias.
You could consider having the create alert action only trigger for certain types of emails as well with something like this:
But if you do want to parse some data from the email/alert into the alias, then it needs to be unique and somewhat inconsistent to avoid deduplication.
Thanks @Nick H
I really appreciate your help.
I think the best way - following your logic is - to do as you mentioned and inserting an alias that points to the path as we can see here
\Apex Central as a Service\Local Folder\Apex One (Mac) as a Service\Apex One (Mac) as a Service\Default\ZADMRHF8J9\ZADMRHF8J9.
the bold section is very unique.
Could you help me with that?
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.
Hi @Afonso Henrique Rodrigues Alves ,
I think there is confusion with the terminology being used. You're saying the alerts are duplicating, meaning a new alert is being created for each email.
When it seems like you want these to deduplicate, or increase in count under one alert.
In that case, you are correct that the alias needs to match with all of these, so it would need to be consistent. I'm not a regex expert so wouldn't know what you need to simply pull:
\Apex Central as a Service\Local Folder\Apex One (Mac) as a Service\Apex One (Mac) as a Service\Default\ZADMRHF8J9\ZADMRHF8J9.
But to extract all of that, you could use some form of string processing with something like:
{{ message.substringBetween("\\",".") }}
Not sure that is much help, but I'm unsure what regex expression is needed to only pull: \Apex Central as a Service\Local Folder\Apex One (Mac) as a Service\Apex One (Mac) as a Service\Default\
You could test expressions with a site like this: https://regex101.com/
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.
Thanks @Nick H
Your explanation really helped me and Improve my vocabulary.
So we are using the deduplication term here as I have seen the same term on how backups work.
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.
Where would I insert the regex for email?
([a-zA-Z0-9._-]+@[a-zA-Z0-9._-]+\.[a-zA-Z0-9_-]+)
Now I am researching the regex for the path and unique workstations.
\Apex Central as a Service\Local Folder\Apex One (Mac) as a Service\Apex One (Mac) as a Service\Default\ZADMRHF8J9\ZADMRHF8J9.
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.