We do a lookup for client contacts based on the endpoint/sensor name. This means we have to pull from the provided Destination Hostname, Source Hostname or sometimes Source User in the email message body to figure out the sensor.
This gets even more difficult when it is an M365 integration, AD, and similar which many times do not provide that information in the email body text.
Would it be at all possible to please include Sensor: ABC123-01 or similar in the message body text?
Additionally, the Tenant name would be nice, as when there are two O365 installations for example, it's sometimes unclear for which account the alert is sent.
Login or Sign up to post a comment