Skip to main content

Cloud-delivered Incident ResponderIncident Responder Documentation

Create an Email Template for the Notify by Email Action

Use templates to customize the emails sent when you run the Notify by email Exabeam action.

  1. In the sidebar, click SETTINGSA grey gear icon, then select Analytics.

  2. Under Case Management, select Email Notifications, then select the EMAIL TEMPLATES tab.

  3. Click Add Email TemplateA dark blue plus sign..

  4. Configure the template settings:

    • Template Type – Select Notify by Email Action.

    • Template Name – Name the email template. This name is used to identify the template when you manually run the Notify by email action or configure a playbook action node using the Notify by email action.

    • Subject – Enter the subject line for the email notification.

    • In the text box, create the email body using Scalate's Mustache HTML template language.

      Under Variable Fields, view all the template variables you can use in the email body. For the Notify by Email Action template type, you can use any variable under both Notify by Email Action Fields and Case Manager Incident Fields.

      You can create a more elaborate email with CSS formatting; for example:

      "<!DOCTYPE html>
<html lang=\"en\">
    <head>
        <title>Exabeam Incident Responder</title>
            <style type=\"text/css\">
                body {
                    background:#F4F6F8;
                    font: 15px arial, sans-serif;
                }
                #sides{
                    display: flex;
                }
                #sides_left{
                    flex-grow: 1;
                    padding-left: 10px;
                }
                #header {
                    -webkit-box-shadow: 2px 2px 2px 0px rgba(71,79,88,1);
                    -moz-box-shadow: 2px 2px 2px 0px rgba(71,79,88,1);
                    box-shadow: 2px 2px 2px 0px rgba(71,79,88,1);
                    background:#6ABA4F;
                    color: #FFFFFF;
                    font: 20px arial, sans-serif;
                    width: 800px;
                    padding: 10px;
                    margin-top: 30px;
                    margin-left: auto ;
                    margin-right: auto ;
                }
                #block {
                    -webkit-box-shadow: 2px 2px 2px 0px rgba(71,79,88,1);
                    -moz-box-shadow: 2p2 2px 2px 0px rgba(71,79,88,1);
                    box-shadow: 2px 2px 2px 0px rgba(71,79,88,1);
                    background:#FFFFFF;
                    color: #000000;
                    font: 16px arial, sans-serif;
                    width: 820px;
                    margin-top: 15px;
                    margin-left: auto ;
                    margin-right: auto ;
                }
                #block_header {
                    width: 800px;
                    padding: 10px;
                    background: #E9ECF0;
                    color: #2B2C34;
                    margin-left: auto ;
                    margin-right: auto ;
                }
                #block_body {
                    width: 800px;
                    background: #FFFFFF;
                    color: #2B2C34;
                    padding: auto;
                    padding-top: 20px;
                    padding-bottom: 20px;
                    margin-left: auto ;
                    margin-right: auto ;
                }
            </style>
    </head>
    <body>
        <div id=\"header\">Exabeam Incident Response</div>
        <div id=\"block\">
        <div id=\"sides\">
        <div id=\"sides_left\">
        <div id=\"block_body\">
            Hi,
            <p>Thank you for letting us know - our assessment determined that the email with subject <b>{{input_subject}}</b> received on {{input_incident_date}} is an <b>unsolicited SPAM email</b>. You can safely delete this message. If you no longer wish to receive similar type of messages from the sender in the future - you can block the sender or sender's domain by right clicking the email in Outlook -> Junk -> Block Sender.</p>
            {{#input_description}}
            <p>{{input_description}}</p>
            {{/input_description}}
            {{#signature}}
            <p>Regards,<br>{{signature}}</p>
            {{/signature}}
            {{^signature}}
            <p>Regards,<br>Exabeam IR</p>
            {{/signature}}
        </div>
        </div>
        </div>
        </div>
    </body>
</html>

      You can also create something more simple; for example:

      <html>
    <head>
    </head>
        <body>
            <p>Thank you for letting us know - our assessment determined that 
the email with subject <b>{{input_subject}}</b> received on 
{{input_incident_date}} is an <b>unsolicited SPAM email</b>.
 You can safely delete this message. If you no longer wish to receive 
similar type of messages from the sender in the future - you can block 
the sender or sender's domain by right clicking the email in Outlook 
-> Junk -> Block Sender.</p>
        </body>
</html>

  5. Click SAVE. Now, you can select this template when you configure a playbook action node using the Notify by email action.