Use placeholders to populate email content

Supported in:

Placeholders are dynamic expressions used in playbook actions to insert specific case data, entity attributes, or alert details into text fields (like an email message). At runtime, the placeholder is replaced by the actual data extracted from the Google Security Operations platform.

Placeholder structure

A placeholder always starts and ends with square brackets [ ], which contain the specific data path (for example, [Alert.Name] references the alert's name).

You can save placeholders within reusable Email Templates. Go to SOAR Settings > Environments > Email Templates. This process lets you define rich, templated content once and reuse it across multiple playbooks.

Use a placeholder

To use a placeholder, follow these steps:

  1. Click data_array Placeholder next to a text field (for example, the message field in a Send Email action).
  2. Select the preferred content path to insert the placeholder (for example, [Alert.Name]).

You can combine multiple placeholders with static text to create rich, custom content.

Need more help? Get answers from Community members and Google SecOps professionals.