topic XSIAM Email Communication in Cortex XSIAM Discussions

XSIAM Email Communication

A.Velusamy — Thu, 12 Feb 2026 08:08:08 GMT

In XSIAM, we need a way for analysts to send email updates at different stages of an incident — like when it is received, contained, and recovered.

Each case should have its own email chain that includes all previous emails for that case.

To support this, we have added a button in the case template where analysts can write and send emails. When they send emails from the same case, it should continue the email chain instead of sending separate, new emails each time.

Does anyone know how to set this up? Or is there a content pack in XSIAM that can help?

Re: XSIAM Email Communication

Dan682Lee — Mon, 16 Feb 2026 03:55:29 GMT

Hello! openskycc

In XSIAM, you can set this up by linking the “Send Email” button in your case template to a playbook that uses the same incident ID and references the original message ID, so each update continues the same thread. Communication‑related content packs in the Cortex Marketplace (email integrations and incident communication workflows) can help, but if none fit exactly, you can adapt an existing email playbook to ensure all emails from a case stay in one chain.

Re: XSIAM Email Communication

A.Velusamy — Mon, 16 Feb 2026 07:09:36 GMT

Hi ..I tried using the “Send Email” option, but it isn’t working and the original message ID isn’t available. If you have tested this earlier, could you pls share more details, maybe with screenshots?

From the Cortex Marketplace, I'm unable see email integrations or incident communication workflows. Any help would be appreciated.