[Rtir] Scripted Action: Variable substitution in RTIR Templates?
John Green
j.green at ukerna.ac.uk
Wed Mar 24 04:20:45 EST 2004
Gorazd Bozic wrote:
> Hi all,
>
> I was looking at Scripted Actions and was wondering what the meaning of
> "Argument" field was. Can that be used for variable substitution in the
> Template being used?
Yes. _ADDR_ or _IP_ in this field are subsituted to the current email or
IP and can be reference from the Template (by $Argument I think, it is
one of those features we haven't gotten around to using yet).
In theory to make it easy to write a template like
"The machine 1.2.3.4 is infected with Nimda"
"The machine 2.3.4.5 is infected with Nimda"
etc
John
JANET-CERT
More information about the Rtir
mailing list