NOTE:To use this feature, you must have the user permission Event Menu Configuration.
Use the Event Menu Configuration window to create the menu items that appear on the Event menu, which is available by right-click when an event (or set of events, if the action is written in JavaScript) is selected in any event table (for example, an Active View window, Snapshot window, Incidents Events window, or Offline Query window). Sentinel has the following default Event Menu Configuration items that you can clone, activate or deactivate:
Figure 11-7 Event Menu Configuration
Ping: Ping the destination (or target) IP of the selected event
nslookup: Perform an nslookup on the Source (or initiator) IP of the selected event
traceroute (tracert on Microsoft SQL 2005): Perform a traceroute from the Source (or initiator) IP of the selected event to the Sentinel Server
Whois?: Perform an ARIN Whois? lookup on the Source (or initiator) IP of the selected event
To view the configuration details for any of these options, select the item and click Details. The following is the nslookup configuration.
Figure 11-8 Menu Item
In addition, new options can be customized to execute a command, open a Web browser, or execute a JavaScript Action configured through the Action Manager.
NOTE:The Execute Command scripts, commands, or applications must be available in $ESEC_HOME/config/exec (on UNIX) or %ESEC_HOME%\config\exec (on Windows). Symbolic links are not supported on UNIX.
Event Menu Configuration allows you to perform the following activities:
Users with the appropriate permissions can add new actions to the event menu that appears when users right-click on an event or events in any event table. There are three types of actions that can be configured for the event menu:
Execute Command: Executes a script or an application, opens the output in a specified application. This can take the value of a field or fields as input. This action can only be executed on a single event.
Launch a Web Browser: Launches a web browser with a specified URL. This can take the value of a field or fields as input. This action can only be executed on a single event.
JavaScript Actions configured through the Action Manager. JavaScript actions can be executed on a single event or multiple events.
NOTE:Some JavaScript Action Plugins require a correlated event or incident as input. Actions configured from these plugins will be excluded from the Event Menu Configuration list. This Action Plugin property is defined by the developer.
Click Admin tab.
In the Admin Navigator, click Admin > Event Menu Configuration.
Click Add. The Event Menu Configuration window opens.
Enter a Name and Description.
NOTE:To place the command in a folder, provide [foldername]/[commandname] in the Name field.
Select an action from the dropdown menu or click Add Action to configure a new JavaScript action. The available settings vary based on which action is chosen:
Option |
Description |
---|---|
Use browser |
Displays the output of your command using the defaults configured for the web browser, based on the file type below. This is only available with the Execute Command Action |
File Type |
If you selected the Action Execute Command, your Browser settings are setup to Use Default Browser, and you selected the option Use the following commands to launch a browser, you have the option of setting the File Type for the output of this command (such as pdf or .pdf). This is only available with the Execute Command Action if Use browser is selected |
Command/URL |
The script or URL that the browser should open or the script/application name to invoke. This is only available with the Execute Command and Launch Web Browser Actions |
Parameters |
Parameters to represent information from the selected event must be enclosed by percent signs (for example, %InitIP%). For a list of available tags you can use when specifying parameters, click Help on the Event Menu Configuration dialog box or see |
NOTE:This option is only available if your menu configuration browser settings are set to Use Default Browser. For more information, see Section 11.6.8, Editing Your Event Menu Browser Settings.
NOTE:On Unix, the script or application for Execute Command must be located in $ESEC_HOME/config/exec or $ESEC_HOME%\config\exec.
Click OK. The new option is added to the list of menu items when users right-click on an event or events.
Open the Event Menu Configuration window.
Select a menu item from the table and click Clone.
In the Event Menu Configuration dialog box, edit:
Name
Description
Action
To use a browser or not. For information, see Section 11.6.8, Editing Your Event Menu Browser Settings.
Command/URL
Parameters
Select an action:
Execute Command
Launch Web Browser.
Any JavaScript action configured in the Action Manager
NOTE:For a list of available tags you can use when specifying parameters, click Help on the Event Menu Configuration dialog box or see Sentinel Event Fields
in Sentinel 6.1 Reference Guide.
Click OK. The new option is added to the list of menu items in the Event Menu Configuration window.
Open the Event Menu Configuration window.
Double-click a menu option.
Type your desired changes and click OK.
Open the Event Menu Configuration window.
Highlight a menu item and click Details.
Open the Event Menu Configuration window.
Select a menu option, right-click and select either Activate or Deactivate.
Open the Event Menu Configuration window.
Select a menu option and click Up or Down.
Open the Event Menu Configuration window.
Select a menu option and click Delete.
Click Yes to delete the menu option
Click No to retain the menu option
This option allows you to send your Event Menu output to an external browser. The external browser can be any application. It is not restricted to Internet Browsers. By changing the file extension you can launch whatever application is associated with that extension. For example, txt is often associated with Notepad. You can also select to launch a specific program (for example, you can set txt files to be opened by Wordpad or other editor).
Open the Event Menu Configuration window.
Click Browser.
You can select from the following two options:
Use default browser: Uses the default browser set in that particular machine. For example, in Windows, “Internet Explorer”.
Use the following commands to launch a browser: Allows you to specify a specific application to launch. When using a browser other than the default browser, your command line must be followed by a %URL%. For example:
C:\Program Files\Internet Explorer\IEXPLORE.EXE %URL%
Default extension: This file extension is assumed if the File Type in a configured action is blank.
The following is an example where the output of the Menu Option launches into Internet Explorer.
After you set your configuration, click OK.