Just to add on, found this great write up of all variables by Kevin:
http://blogs.technet.com/b/kevinholman/archive/2007/12/12/adding-custom-information-to-alert-descriptions-and-notifications.aspx
Regards
Sarbjit Singh
From: Sarbjit Singh
Sent: Saturday, April 04, 2015 5:26 PM
To: SCOM List
Subject: extracting specific fields from the alert description.
Greetings,
I have created an alert notification email subscription based on AD account
changes EVENT IF 642.
I am trying to get the actual change that happen to the AD user object into the
email subject. E.g. if the password was changed, then the subject should have a
mentioned of “Password change” or if the Expiry Date of the AD user object is
changed, then the email alert subject should have a mention of “Expiry Date
changed”.
The options I have is all the changeable fields are listed under one field
“Alert Description” as highlighted below.
Thanks in advance for some insight on this.
Regards
Sarbjit Singh
Template used is shown here.
Subject: Alert: $Data[Default='Not Present']/Context/DataItem/AlertName$
Resolution state: $Data[Default='Not
Present']/Context/DataItem/ResolutionStateName$
Body: Alert: $Data[Default='Not Present']/Context/DataItem/AlertName$
Source: $Data[Default='Not Present']/Context/DataItem/ManagedEntityDisplayName$
Path: $Data[Default='Not Present']/Context/DataItem/ManagedEntityPath$
Last modified by: $Data[Default='Not Present']/Context/DataItem/LastModifiedBy$
Last modified time: $Data[Default='Not
Present']/Context/DataItem/LastModifiedLocal$
Alert description: $Data[Default='Not
Present']/Context/DataItem/AlertDescription$
Alert view link:
"$Target/Property[Type="Notification!Microsoft.SystemCenter.AlertNotificationSubscriptionServer"]/WebConsoleUrl$?DisplayMode=Pivot&AlertID=$UrlEncodeData/Context/DataItem/AlertId$"
Notification subscription ID generating this message: $MPElement$
Here is the email received.
Subject: Alert: EVENT 642 Resolution state: New
Alert: EVENT 642
Source: SGG1DC01
Path: ssg1dc01.domainx.com
Last modified by: System
Last modified time: 01/04/2015 9:51:29 AM
Alert description: Event Description: User Account Changed:
Target Account Name: user1
Target Domain: DOMAINX
Target Account ID: DOMAINX\user1
Caller User Name: SSG1DC01$
Caller Domain: DOMAINX
Caller Logon ID: (0x0,0x3E7)
Privileges: -
Changed Attributes:
Sam Account Name: -
Display Name: -
User Principal Name: -
Home Directory: -
Home Drive: -
Script Path: -
Profile Path: -
User Workstations: -
Password Last Set: 4/1/2015 9:51:28 AM
Account Expires: -
Primary Group ID: -
AllowedToDelegateTo: -
Old UAC Value: -
New UAC Value: -
User Account Control: -
User Parameters: -
Sid History: -
Logon Hours: -
