Commit ab08349
authored
Add flow completion e-mail notification artifact (#1094)
From the artifact description:
> Send an e-mail when a client flow (with artifacts of interest) has
finished.
> Cancelled collections and collections with artifacts that do not
satisfy
> preconditions do not create notifications when they are finished.
>
> Example use cases:
>
> - A collection is created for an offline client and you want to be
notified
> when it finishes. The DelayThreshold ensures that e-mails are not sent
unless
> flows complete some time later (i.e. not immediately).
> - An e-mail is sent to an auditor for every collection with detailed
results
> - Send e-mails when flows (of interest) fail
If HTML is enabled, the e-mails look something like this:
<img width="604" height="1006" alt="image"
src="https://github.com/user-attachments/assets/fc93e8e3-a4eb-4b72-ae55-90a0e82888a7"
/>
Rows containing empty information, like in this example "Urgent",
"Hunt", "Uploaded files", "Uploaded bytes" and "Error", are left out.
For consistency, these can be included even if falsy by setting
KeepEmptyRows to true.
In this example, a row called "Computer serial" is a custom line
configured by adding the following to the ClientMetadata parameters:
| Field | Alias |
|---------|---------|
| serial | Computer serial |
where "serial" is a client metadata field for the client that completed
the flow.
The same result looks like this in plain text:
<img width="1246" height="589" alt="image"
src="https://github.com/user-attachments/assets/1291e342-6ac9-43a5-97dc-a6dbeec30ac4"
/>
If a flow fails, the output looks as follows:
<img width="606" height="1078" alt="image"
src="https://github.com/user-attachments/assets/05960cfc-385f-4d1b-9b8c-96441d08a952"
/>1 parent 85912d6 commit ab08349
31 files changed
Lines changed: 8967 additions & 0 deletions
File tree
- content
- blog/2026/2026-04-19-alerts-and-email
- exchange/artifacts
- knowledge_base/tips
- email_alerts
- monitoring_artifact_errors
- sending_email
- vql_alerts
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
2134 | 2134 | | |
2135 | 2135 | | |
2136 | 2136 | | |
| 2137 | + | |
| 2138 | + | |
| 2139 | + | |
| 2140 | + | |
| 2141 | + | |
| 2142 | + | |
| 2143 | + | |
| 2144 | + | |
| 2145 | + | |
| 2146 | + | |
| 2147 | + | |
| 2148 | + | |
| 2149 | + | |
| 2150 | + | |
| 2151 | + | |
| 2152 | + | |
| 2153 | + | |
| 2154 | + | |
| 2155 | + | |
| 2156 | + | |
| 2157 | + | |
| 2158 | + | |
| 2159 | + | |
| 2160 | + | |
| 2161 | + | |
| 2162 | + | |
| 2163 | + | |
| 2164 | + | |
| 2165 | + | |
Large diffs are not rendered by default.
0 commit comments