[Rtir] Scripted Action: Variable substitution in RTIR Templates?

[John Green]

Gorazd Bozic wrote:
> Hi all,
> 
> I was looking at Scripted Actions and was wondering what the meaning of
> "Argument" field was. Can that be used for variable substitution in the
> Template being used?

Yes. _ADDR_ or _IP_ in this field are subsituted to the current email or 
IP and can be reference from the Template (by $Argument I think, it is 
one of those features we haven't gotten around to using yet).

In theory to make it easy to write a template like

"The machine 1.2.3.4 is infected with Nimda"
"The machine 2.3.4.5 is infected with Nimda"

etc


John
JANET-CERT