11.6 Configure Menu Options

NOTE:To use this feature, you must have the user permission Event Menu Configuration.

Use the Event Menu Configuration window to create the menu items that appear on the Event menu, which is available by right-click when an event (or set of events, if the action is written in JavaScript) is selected in any event table (for example, an Active View window, Snapshot window, Incidents Events window, or Offline Query window). Sentinel has the following default Event Menu Configuration items that you can clone, activate or deactivate:

Figure 11-7 Event Menu Configuration

Ping: Ping the destination (or target) IP of the selected event
nslookup: Perform an nslookup on the Source (or initiator) IP of the selected event
traceroute (tracert on Microsoft SQL 2005): Perform a traceroute from the Source (or initiator) IP of the selected event to the Sentinel Server
Whois?: Perform an ARIN Whois? lookup on the Source (or initiator) IP of the selected event

To view the configuration details for any of these options, select the item and click Details. The following is the nslookup configuration.

Figure 11-8 Menu Item

In addition, new options can be customized to execute a command, open a Web browser, or execute a JavaScript Action configured through the Action Manager.

NOTE:The Execute Command scripts, commands, or applications must be available in $ESEC_HOME/config/exec (on UNIX) or %ESEC_HOME%\config\exec (on Windows). Symbolic links are not supported on UNIX.

Event Menu Configuration allows you to perform the following activities:

11.6.1 Adding an Option to the Event Menu

Users with the appropriate permissions can add new actions to the event menu that appears when users right-click on an event or events in any event table. There are three types of actions that can be configured for the event menu:

Execute Command: Executes a script or an application, opens the output in a specified application. This can take the value of a field or fields as input. This action can only be executed on a single event.
Launch a Web Browser: Launches a web browser with a specified URL. This can take the value of a field or fields as input. This action can only be executed on a single event.
JavaScript Actions configured through the Action Manager. JavaScript actions can be executed on a single event or multiple events.

NOTE:Some JavaScript Action Plugins require a correlated event or incident as input. Actions configured from these plugins will be excluded from the Event Menu Configuration list. This Action Plugin property is defined by the developer.

To add a command to the right-click menu:

Click Admin tab.
In the Admin Navigator, click Admin > Event Menu Configuration.
Click Add. The Event Menu Configuration window opens.
Enter a Name and Description.

NOTE:To place the command in a folder, provide [foldername]/[commandname] in the Name field.

Select an action from the dropdown menu or click Add Action to configure a new JavaScript action. The available settings vary based on which action is chosen:

Option	Description
Use browser	Displays the output of your command using the defaults configured for the web browser, based on the file type below. This is only available with the Execute Command Action
File Type	If you selected the Action Execute Command, your Browser settings are setup to Use Default Browser, and you selected the option Use the following commands to launch a browser, you have the option of setting the File Type for the output of this command (such as pdf or .pdf). This is only available with the Execute Command Action if Use browser is selected
Command/URL	The script or URL that the browser should open or the script/application name to invoke. This is only available with the Execute Command and Launch Web Browser Actions
Parameters	Parameters to represent information from the selected event must be enclosed by percent signs (for example, %InitIP%). For a list of available tags you can use when specifying parameters, click Help on the Event Menu Configuration dialog box or see Sentinel Event Fields in Sentinel 6.1 Reference Guide.

NOTE:This option is only available if your menu configuration browser settings are set to Use Default Browser. For more information, see Section 11.6.8, Editing Your Event Menu Browser Settings.

NOTE:On Unix, the script or application for Execute Command must be located in $ESEC_HOME/config/exec or $ESEC_HOME%\config\exec.

Click OK. The new option is added to the list of menu items when users right-click on an event or events.

11.6.2 Cloning an Event Menu Option

To clone an Event Menu option:

Open the Event Menu Configuration window.
Select a menu item from the table and click Clone.
In the Event Menu Configuration dialog box, edit:
- Name
- Description
- Action
- To use a browser or not. For information, see Section 11.6.8, Editing Your Event Menu Browser Settings.
- Command/URL
- Parameters
- Select an action:
  - Execute Command
  - Launch Web Browser.
  - Any JavaScript action configured in the Action Manager
NOTE:For a list of available tags you can use when specifying parameters, click Help on the Event Menu Configuration dialog box or see Sentinel Event Fields in Sentinel 6.1 Reference Guide.
Click OK. The new option is added to the list of menu items in the Event Menu Configuration window.

11.6.3 Modifying an Event Menu Option

To modify an Event Menu Configuration option:

Open the Event Menu Configuration window.
Double-click a menu option.
Type your desired changes and click OK.

11.6.4 Viewing Event Menu Option Parameters

To view the parameters for an Event Menu Configuration menu option:

Open the Event Menu Configuration window.
Highlight a menu item and click Details.

11.6.5 Activating or Deactivating an Event Menu Option

To activate or deactivate an Event Menu Configuration option:

Open the Event Menu Configuration window.

Select a menu option, right-click and select either Activate or Deactivate.

11.6.6 Rearranging Event Menu Options

To move an Event menu option up or down:

Open the Event Menu Configuration window.
Select a menu option and click Up or Down.

11.6.7 Deleting an Event Menu Option

To delete a Menu Configuration option:

Open the Event Menu Configuration window.
Select a menu option and click Delete.
- Click Yes to delete the menu option
- Click No to retain the menu option

11.6.8 Editing Your Event Menu Browser Settings

This option allows you to send your Event Menu output to an external browser. The external browser can be any application. It is not restricted to Internet Browsers. By changing the file extension you can launch whatever application is associated with that extension. For example, txt is often associated with Notepad. You can also select to launch a specific program (for example, you can set txt files to be opened by Wordpad or other editor).

To Edit your Menu Configuration Browser Settings:

Open the Event Menu Configuration window.
Click Browser.

You can select from the following two options:
- Use default browser: Uses the default browser set in that particular machine. For example, in Windows, “Internet Explorer”.
- Use the following commands to launch a browser: Allows you to specify a specific application to launch. When using a browser other than the default browser, your command line must be followed by a %URL%. For example:
```
C:\Program Files\Internet Explorer\IEXPLORE.EXE %URL%
```
- Default extension: This file extension is assumed if the File Type in a configured action is blank.
The following is an example where the output of the Menu Option launches into Internet Explorer.
After you set your configuration, click OK.