IBM Security QRadar

 View Only
Expand all | Collapse all

How to change the $Value.OffenseUrl to display the external URL of the Qradar offence in the email template

  • 1.  How to change the $Value.OffenseUrl to display the external URL of the Qradar offence in the email template

    Posted Fri March 25, 2022 07:39 AM
    Hi,

    My problem is that when I add the "$Value.OffenseUrl" parameter my internal IP appears in the URL in the email template.
    I need the URL to contain the external IP or dns name so that anyone who clicks on the URL will be taken directly to the offence and this will appear in the modified mail template.

    Regards.

    ------------------------------
    cristian librero
    ------------------------------


  • 2.  RE: How to change the $Value.OffenseUrl to display the external URL of the Qradar offence in the email template

    Posted Thu May 19, 2022 11:09 AM
    Hi, 
    i have the same problem. Do you found any solution yet?
    Regards,
    Martin

    ------------------------------
    Martin Schmitt
    ------------------------------



  • 3.  RE: How to change the $Value.OffenseUrl to display the external URL of the Qradar offence in the email template

    Posted Thu July 14, 2022 09:18 AM
    Hi, 

    my collegue finaly found the solution. It is a default xml parser behaviour and "&" is a special character and therefore the validation fails. You can still use it in so called CDATA Paragraphs. If you look at the default template you already see some usage of that.

    Example:
    Customer Offense URL:
    <![CDATA[https://1.4.147.1/console/qradar/jsp/QRadar.jsp?appName=Sem&pageId=OffenseSummary&summaryId=${OffenseID}]]>

    Regards,
    Martin

    ------------------------------
    Martin Schmitt
    ------------------------------