Skip to main content

Cyware Orchestrate

Email Templates

Notice

This feature is available in Orchestrate from the release version v3.5.0 and later.

Analysts can create reusable email templates.

What are email templates?

Email templates are pre-defined email layouts in rich text format that includes an email header and email body. Analysts can reuse email templates with predefined content and customize them in playbooks, reducing the time and effort required to compose emails from scratch. This also eliminates the need to have the technical expertise to use a custom node for creating emails. 

How can I use email templates?

Analysts can use the templates in playbooks to send emails. The templates can be used for apps that support Rich Text format field type. For example, you can use email templates in Cyware Email Service - Send Email in Rich Text Format.

You can perform the following actions with email templates:

Create Email Template

You can create and reuse email templates to send emails to recipients. You can create a maximum of 20 email templates.

Before you start

Ensure that your user group has permission to Create/Update Email Template.

Steps

To create an email template, do the following:

  1. Go to Playbooks > Resource Library and select Email Templates.

  2. Click Create Template.

  3. Enter the template title and description.

  4. In Template Body, create the template body using the formatting options such as bold, italic, insert table, HTML code editor, and more. You can also define variables in the {{variable}} format. For example, {{incident_id}}. You can fetch the variables as key-value pairs and assign values to the variables dynamically while sending emails. 

  5. Click Save.

Note

The playbooks that have already used the email template will not be affected by the updates made to it. The new template will be incorporated into the playbooks that use it after the recent updates have been made.

Use Email Template in Playbook

You can use the created email templates in playbooks and further customize them using the rich text editor.

Steps

To use an email template in the playbook, do the following:

  1. Go to an existing playbook or create a new playbook. For more information, see Create Playbook.

  2. Drag and drop an app node, search, and select the required app that supports rich text fields. For example, search for Cyware Email Service and select Send Email in Rich Text Format.

  3. Click the added node and select Setup Input Data. Now, scroll down to the Message Body field.

  4. Click Select Template and select the email template that you have created. The below block shows an example email template with a variable incident_id. In this example, the variable should automatically take the unique ID of the incident onboarded by the playbook.

    Notice

    Hi user,

    The Incident Onboarding and Action playbook automatically onboarded suspicious activity from your SIEM to Respond (CFTR) as an incident. The unique ID of the newly onboarded incident is {{incident_id}}.

  5. You can choose to preview an email template before restoring it. To preview and use an email template, click Preview > Use Template. 

  6. Click Sync Variables to fetch the variables from the email body as keys. This converts variables into key-value pairs. You can assign a static value or a dynamic path as values. The below example shows a dynamic path assigned to the incident_id key to automatically fetch the unique ID of the incident onboarded by the playbook.

    key: incident_id 
value: ${_2::result::cftr_instance::incident_id}

    The ${_2::result::cftr_instance::incident_id} dynamic path retrieves the unique incident ID from the results of node number 2.

  7. You can further edit or customize the template.

Delete Email Template

You can delete email templates that are not in use. 

Before you start

Ensure that your user group has permission to Delete Email Template.

Steps

To delete an email template, do the following:

  1. Go to Playbooks > Resource Library and select Email Templates.

  2. Select an email template and click Delete. You cannot recover an email template after it is deleted.

    Deleting an email template does not impact the playbooks that have used it.