Put elements of the case data into an email message

This is done by using the placeholders in the playbook actions. Placeholders are expressions that reference fields on events, alerts, cases entities and other elements. Placeholders will hold a place for the data that will be extracted when the action actually runs.

To use a placeholder, click data_array next to a text field (for example, the message field in a Send Email action) and select the content you would like to extract when the action runs.
You can string several placeholders in a row to create richer content.
Notice that a placeholder will always begin and end with a square bracket. Inside those brackets will always be the path of the required content. For example, the [Alert.Name] placeholder will check the alert name and put in the message before sending the email.

Placeholders can be used in email templates, allowing you to set a template once, with all the required placeholders and use it when needed (SOAR Settings > Environments > Email Templates).