Example: Enrich event details with the encoded event ID
To enrich the detailed message event slot, perform the following steps:
Actions used in the example
- Variable
- Enrich
For more information about actions, see Actions-for-advanced-and-time-based-enrichment.
To define the event selection criteria
- Select Configuration > Event Policies and click Create.
- In Event Selection Criteria, define a condition to select events that contain the message base64demo.
The following image illustrates how the event selection criteria will look:
To learn how to construct the event selection criteria, see Creating-and-enabling-event-policies.
To build the policy workflow
On the Advanced Enrichment page, perform the following steps:
- Add the Variable action to encode the event ID to a Base64 value. Use the ToBase64 function to convert the event ID and store the function output in the $Base64EventID variable.
- Add an Enrich action to enrich the detailed message slot with the cross-launch URL of the desired tenant where the event ID is encoded to the Base64 value. Use the Concat function to append the encoded event ID to the desired tenant URL and save the advanced enrichment policy configuration.
- On the Update Event Policy page, add an email Notification policy configuration and use the enriched value of the detailed message slot in the email body as shown in the following screenshot. Save the notification policy configuration.
- Both policy configurations are listed as shown in the following screenshot. Enable the policy and click Save.
Results
The resulting policy workflow enriches the detailed message with the cross-launch URL of the desired tenant where the event ID is encoded (Base64). The notification email contains the encoded cross-launch URL to the Event Details page.
Without event enrichment
With event enrichment
Tip: For faster searching, add an asterisk to the end of your partial query. Example: cert*