Put elements of the case data into an email message
This is done by using the placeholders in the playbook actions. Placeholders are expressions that reference fields on events, alerts, cases entities and other elements. Placeholders will hold a place for the data that will be extracted when the action actually runs.
To use a placeholder, click
data_array
next to a text field (for example, the message field in a
Send Email action) and select the content you would like to extract
when the action runs.
You can string several placeholders in a row to create richer content.
Notice that a placeholder will always begin and end with a square bracket.
Inside those brackets will always be the path of the required content. For
example, the [Alert.Name] placeholder will check the
alert name and put in the message before sending the email.
Placeholders can be used in email templates, allowing you to set a template once, with all the required placeholders and use it when needed (SOAR Settings > Environments > Email Templates).