Video Screencast Help
Symantec to Separate Into Two Focused, Industry-Leading Technology Companies. Learn more.

Trying to add printer name into incident email

Created: 30 Apr 2013 | 5 comments

So I want to add the printer name into my canned email response when an employee violates our printer policy. I have searched all over the admin guide and cannot locate the variable for printer name. I see that I can add the machine name using $ENDPOINT_NAME$.

I know DLP can pull this information as I can see it in the incident details. Where on earth can I locate this variable?

Operating Systems:

Comments 5 CommentsJump to latest comment

AMyers6671's picture

Mike,

I want to say you use the $PROTOCOL$ variable for this. I don't have an Endpoint w/ printer handy here but I believe that covers Protocol / Device Type / Target Type. The other you might try is $TARGET$. I'll see if I can spin up an Endpoint quick & give it a try.

Aaron

If this post has helped you, please vote up or mark as solution to help others looking for the same data.

Mike S.'s picture

Aaron, I did try the Protocol / Device Type / Target Type but that did not give me the name of the printer.

And target gives me an N/A.

This is really frustrating because I see it in the incident details but cannot get it as a variable. The only reason I am looking to do this is to show the managers when the employee prints to adobe so that they know to to tell the employee to save as to adobe.

AMyers6671's picture

Mike,

I understand. I actually am trying this on a system now. So far nothing but now you have us interested. :)

Aaron

If this post has helped you, please vote up or mark as solution to help others looking for the same data.

AMyers6671's picture

Mike,

We are thinking that for some reason, the notification doesn't pick up the Endpoint variables. We tried a whole mess of variables and none of them worked. May need a SYMC person to jump in on this one.

Target: $TARGET$
Protocol: $PROTOCOL$
variable_10: $variable_10$
endpoint thing: $endpoint.printer.name$
Printer: $PRINTER$
Printer_Name: $PRINTER_NAME$
Printer_Type: $PRINTER_TYPE$
Blocked: $BLOCKED$
Incident ID: $INCIDENT_ID$
Recipient: $RECIPIENTS$
Device Instance ID: $ENDPOINT_DEVICE_ID$
Sender: $SENDER$
Subject: $SUBJECT$
Device Type: $DEVICE_TYPE$
Content Name: $CONTENT_NAME$
App Name: $APPLICATION$
Content Type: $CONTENT_TYPE$

===========

Target: N/A

Protocol: Endpoint Printer/Fax

variable_10: [UNKNOWN VARIABLE: variable_10]

endpoint thing: [UNKNOWN VARIABLE: endpoint.printer.name]

Printer: [UNKNOWN VARIABLE: PRINTER]

Printer_Name: [UNKNOWN VARIABLE: PRINTER_NAME]

Printer_Type: [UNKNOWN VARIABLE: PRINTER_TYPE]

Blocked: Action Blocked

Incident ID: 4416

Recipient: N/A

Device Instance ID: N/A

Sender: N/A

Subject: N/A

Device Type: [UNKNOWN VARIABLE: DEVICE_TYPE]

Content Name: [UNKNOWN VARIABLE: CONTENT_NAME]

App Name: [UNKNOWN VARIABLE: APPLICATION]

Content Type: [UNKNOWN VARIABLE: CONTENT_TYPE]

If this post has helped you, please vote up or mark as solution to help others looking for the same data.

Mike S.'s picture

Yup Aaron I was thinking the same thing. I had tried all of the precanned ones and tried some others I thought might work and got the same results as you.

Hopefully we can get someone here that would know the answer. Thanks for trying.