Currently when I raise email notification, all the available fields also get added in the attachment content. I don’t want this. I want to include only those column which are visible in the query result. How to do this.
Query which I am using:-
_fetch * from event where $Duration=1h group count_unique $URL limit 4
>>_lookup virustotal get_url_report $URL
>>_checkif int_compare $VTPositives > 1 include
And then select the required columns and send it over email.