Hi there,
As handy as the existing email alerts are for Defender for Endpoint for Alerts and Vulnerability Notifications, we could really do with having the ability to customise the message body so that where required we can inject some custom data to allow those messages to be parsed correctly by ticketing systems.
As they stand for our organisation where we will process different alerts for our customers all the emails will end up in a single queue and not be handled by our ticketing system because we cannot insert a custom field with a value that our parsers will look for.
Long term we will look at API level integration but this is even more work, effort and cost to complete. The path to least resistance where we already have a working integration will be to have some ability to insert some plaintext above the existing MS template for the ATP alert emails.
For right now this the potential to hamper response efforts.
Thanks very much for your consideration.
Kind regards,
James
