Hello,

You can achieve this by following these steps:

1. Automatically Pull Recipient Details
   Use appropriate placeholders in the email recipient field. This will automatically pull in the recipients' details from the alert.

2. Populate the Email Template
   Set up a manual action to present the email template to the analyst before sending the email.

3. Allow Analyst Review and Corrections
   With the manual action enabled, the analyst can review and make any necessary corrections to the email content.

4. Execute to Send the Email
   Once the analyst has reviewed and made corrections, they can hit 'execute' to send the email.

Thanks,

Suraj Kadav

I tried analyst can’t verify the data since it is placeholder 

Yes, you need to use Get Context Value Action to see what's there in placeholder.

#1

Usually I would recommend setting the Action to Manual, so you can review at runtime the content, but this does not resolve placholders, so you are only approving the pre-resolved value

#2

So I would do something different, but meets your needs

Use the Action buffer, in that build up the email content

And use HTML Widget to display the value. This will include the placeholders resolved to their value.

#2

You can have a MultiChoiceQuestion "Hey analyst, is that Email body good to send?"
Yes-> Playbook has "Send Email" and the Input is the Buffer.ScriptResult

No -> Playbook has "Send Email" with no body defined and set to Manual, the analsyt can then copy/paste the value of the HTML widget (the parsed version with mistakes) and improve/amend before sending

In this image, look at the M/A

Hi ,

Can you give more insight around buffer action how to use it

I have around 9 email templates so based on threat type i need to render email preview but if i use buffer i need to setup views .. few views will b empty ... it wont look good