topic How to Send a Test Notification Email in Cortex XSOAR and Identify Available Variables? in Cortex XSOAR Discussions

How to Send a Test Notification Email in Cortex XSOAR and Identify Available Variables?

JesusAngel — Sat, 11 Jan 2025 23:38:38 GMT

Hi everyone,

I’m trying to test the email notifications configured in Cortex XSOAR to ensure they include the correct variables (like incident severity, name, and ID). Specifically, I want to verify the notification sent to an analyst when they are assigned an incident.

Here are my main questions:

Is there a built-in way to send test notifications using the notification templates in XSOAR?
Can I send a test email using the !send-mail command? If so, how can I structure it to include variables like {{.severity}} or {{.incident.id}}?
What variables are available to customize notifications, particularly the ones sent when an incident is assigned to an analyst? Is there a reference list or documentation for these variables?

I’ve already configured the SMTP Mail Sender integration, and the test from the integration settings works fine. However, I want to simulate a real notification to validate the content and variables in the email.

Any guidance on testing notifications and understanding the available variables would be greatly appreciated!

Re: How to Send a Test Notification Email in Cortex XSOAR and Identify Available Variables?

pagnihotri — Wed, 15 Jan 2025 07:37:41 GMT

You can send any value if that is present in the context of the incident using "send-mail" automation.

Simply grab the key to the specific value. For getting the incident name, you could use ${incident.name}

Re: How to Send a Test Notification Email in Cortex XSOAR and Identify Available Variables?

JesusAngel — Thu, 16 Jan 2025 11:43:31 GMT

Hello,

I set the messages.html.formats.incidentassigned template as follows:

<p>{{.username}} has assigned you {{.incTermArticle}} {{.incTermSingular}} {{.invName}}.</p>

<ul>
<li>{{.incTermCapitalSingular}} Id: #{{.incID}} </li>
<li>{{.incTermCapitalSingular}} Name: {{.invName}}</li>
<li>{{.incTermCapitalSingular}} SLA: {{.SLA}}</li>
<li>{{.incTermCapitalSingular}} Severity: {{.severity}}</li>
</ul>

<p>Please log in and review.</p>

But most of the fields were empty:

Regards,