USB devices are not authorized to be plugged into our network. Currently our rule is setup to detach the deice and display the message "USB devices are no longer authorized". We would like to customize the message to display the
user's name and the unauthorized message. When I view the events in the LEM the SourceAccount displays the employees name. I thought it would be possible to use the SourceAccount info to personalize the message, but support informed me that it's not possible. The only option is to either have a static message OR to pull in one of the fields from the Alert, but not both.