Open for Voting

New Rule Action - Append next x number of Events to email or infer a new Event

I wasn't too sure on the title, I was thinking of this one too:

Ability to include x number of Events gathered to an Email Action (immediately after a Rule fires)

Either way, maybe the examples will make more sense.

Say you have a Rule looking for criteria to happen.  It does, User Joe deletes a "Sensitive File".  It would be nice to have LEM send me an email that says Joe deleted that critical file, and the next 10 things he did was: blah blah blah.

Since this would all be based on Variables since we don't know what Joe is going to do next, perhaps an easier thing to develop is utilizing an nDepth report and sending that as an email attachment?

1. Rule that says = alert me when someone deletes Sensitive File

2. Fires, with the below Action

3. nDepth search = select everything in last 30 minutes for $SourceAccount pulled from the file delete Event