This is done by using the placeholders in the playbook actions. Placeholders
are expressions that reference fields on events, alerts, cases entities and
other elements. Placeholders will hold a place for the data that will be
extracted when the action actually runs.
To use a placeholder, click
data_array
next to a text field (for example, the message field in a
Send Email action) and select the content you would like to extract
when the action runs.
You can string several placeholders in a row to create richer content.
Notice that a placeholder will always begin and end with a square bracket.
Inside those brackets will always be the path of the required content. For
example, the [Alert.Name] placeholder will check the
alert name and put in the message before sending the email.
Placeholders can be used in email templates, allowing you to set a template
once, with all the required placeholders and use it when needed (SOAR
Settings > Environments > Email Templates).
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-29 UTC."],[[["\u003cp\u003ePlaybook actions utilize placeholders to dynamically insert case data into email messages.\u003c/p\u003e\n"],["\u003cp\u003ePlaceholders, identified by square brackets, reference specific fields from events, alerts, cases, and other entities.\u003c/p\u003e\n"],["\u003cp\u003eSelecting \u003ccode\u003edata_array\u003c/code\u003e in a text field allows users to choose the content to extract using placeholders.\u003c/p\u003e\n"],["\u003cp\u003eMultiple placeholders can be combined to create detailed and informative email content.\u003c/p\u003e\n"],["\u003cp\u003ePlaceholders can be integrated into email templates within SOAR settings for consistent use.\u003c/p\u003e\n"]]],[],null,["# Put elements of the case data into an email message\n\nPut elements of the case data into an email\nmessage\n===================================================\n\nSupported in: \nGoogle secops [SOAR](/chronicle/docs/secops/google-secops-soar-toc)\n\n\nThis is done by using the placeholders in the playbook actions. Placeholders\nare expressions that reference fields on events, alerts, cases entities and\nother elements. Placeholders will hold a place for the data that will be\nextracted when the action actually runs.\n\n\u003cbr /\u003e\n\nTo use a placeholder, click data_array next to a text field (for example, the message field in a\n**Send Email** action) and select the content you would like to extract\nwhen the action runs. \n\nYou can string several placeholders in a row to create richer content. \n\nNotice that a placeholder will always begin and end with a square bracket.\nInside those brackets will always be the path of the required content. For\nexample, the `[Alert.Name]` placeholder will check the\nalert name and put in the message before sending the email. \n\n\nPlaceholders can be used in email templates, allowing you to set a template\nonce, with all the required placeholders and use it when needed (**SOAR\nSettings \\\u003e Environments \\\u003e Email Templates**).\n\n\u003cbr /\u003e\n\n**Need more help?** [Get answers from Community members and Google SecOps professionals.](https://security.googlecloudcommunity.com/google-security-operations-2)"]]
