IBM Support

QRadar Rule email notification limitations

Question & Answer


Question

Are there limits to how many users you can configure to receive email notifications?

Cause

The email address field in the Rule configuration is limited to 256 characters in total. That limitation is based on IETF standards section-4.5.3.1: Simple Mail Transfer Protocol

Answer

If you have a large list of email addresses to be notified when a rule is triggered, the use of a distribution email address may be required. By using a mail distribution list, you can group all email addresses and use the group email address in the rule configuration. The distribution list is something that you must configure on your email server.


Where do you find more information?



[{"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":"Rules","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.2","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
16 June 2018

UID

swg21995487