This is done by using the placeholders in the playbook actions. Placeholders
are expressions that reference fields on events, alerts, cases entities and
other elements. Placeholders will hold a place for the data that will be
extracted when the action actually runs.
To use a placeholder, click
data_array
next to a text field (for example, the message field in a
Send Email action) and select the content you would like to extract
when the action runs.
You can string several placeholders in a row to create richer content.
Notice that a placeholder will always begin and end with a square bracket.
Inside those brackets will always be the path of the required content. For
example, the [Alert.Name] placeholder will check the
alert name and put in the message before sending the email.
Placeholders can be used in email templates, allowing you to set a template
once, with all the required placeholders and use it when needed (SOAR
Settings > Environments > Email Templates).
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-03-06 UTC."],[[["Playbook actions utilize placeholders to dynamically insert case data into email messages."],["Placeholders, identified by square brackets, reference specific fields from events, alerts, cases, and other entities."],["Selecting `data_array` in a text field allows users to choose the content to extract using placeholders."],["Multiple placeholders can be combined to create detailed and informative email content."],["Placeholders can be integrated into email templates within SOAR settings for consistent use."]]],[]]
