Security

How to send individual emails customized in HTML with tokens assigned to each recipient based on one search every 24 hours to warn of password expiry?

alexandramr
Engager

Hello,

I know that there have been previous threads where users have had similar problems, however, I am looking at how to send emails to alert users based on a specific criteria. I cannot access the sendemail.py script so cannot modify that. It would be great if there was an alternative solution.

For example, I have a table with users, emails and password expiry details. I want to send a custom email(html design) to all the users that have their password expiring in 2 days.

The query so far looks something like this:
index=example sourcetype=example source=example
| search PasswordExpiryDate="2"
| eventstats values(mail) AS mail_adresses
| eval recipients=mvjoin(mail_adresses, ",")
| table user, PasswordExpiryDate, mail, FirstName, Domain
| sendemail to="" bcc=$result.recipients$ subject="Reminder- Windows Password Expiration" message="
Hello $result.FirstName$,

Your $result.Domain$ Windows Desktop password will expire on $result.PasswordExpiryDate$."

I would like to modify this in html and then have each individual result generate a custom email to the user.
At the moment, the custom email for the first result is sent to the entire list, which is what the function is supposed to do in the first place. Is it possible to work around this or does the sendemail.py script need to be modified, if so, does anyone have an example?

Any help would be appreciated, tried to find an answer everywhere but no such luck yet.

Thank you and hope you have an awesome day!
Alex

solarboyz1
Builder

Set this scheduled search an alert.
Set the alert mode to once per result.

Then configure the send email alert action using the tokens.

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...