Use placeholders in Playbook actions
Supported in:
Placeholders are dynamic expressions used in playbook actions to insert specific case data, entity attributes, or alert details into text fields (like an email message). At runtime, the placeholder is replaced by the actual data extracted from the Google Security Operations platform.
Placeholder structure
A placeholder always starts and ends with square brackets [ ], which
contain the specific data path (for example, [Alert.Name]
references the alert's name).
The following placeholders won't render for any automatic operation:
- General.CurrentUserEmail
- General.CurrentUserID
- General.CurrentUserFullName
- General.CurrentUserRole
Use a placeholder
To use a placeholder, follow these steps:
- Click data_array Placeholder next to a text field (for example, the message field in a Send Email action).
- Select the preferred content path to insert the placeholder (for example,
[Alert.Name]).
You can combine multiple placeholders with static text to create rich, custom content.
Need more help? Get answers from Community members and Google SecOps professionals.