How to use Template Engine to Render Complex Templates - Part 2

[Rob_Becker]

If you haven't read the "How to use Template Engine to Render Complex Templates - Part 1" post, start off there an continue with this post.

Once the template is created, it needs to be saved in the Email HTML Template section in Settings.  Name the template any name you wish.  Make sure it is saved in the appropriate environment that it will be used for.

Step 3. With the template created, we can now create the playbook or block to render the template.  The first step will be Get Case Data from the Siemplify Tools integration.  This action returns a JSON representation of the case.  The second step will be the Render Template action from TemplateEngine.  Render Template takes the following inputs: Template and JSON Object.  Select the name of the Template we created for “Template” and for JSON Object, use the Placeholder Browser to select the JsonResult from the Get Case Data action.  The parameters will look like this:

The final step in this block will be the Send Email action.  Actions that use parameters of type “Email Content” do not accept input from previous playbook steps.  Since the Send Email action in EmailV2 uses this parameter type, we cannot use the output from Render Template.  To get around this, we will duplicate the Send Email action and modify the parameter type in the IDE.  Save your playbook and go into the IDE.

Once you’re in the IDE, find Send Email under Emailv2.  Open the action and select “Duplicate Item” from the right menu.

In the duplicated action, double click on the “Content” parameter and change the type from Email Content to Content.

Finally, rename the action to “Send Email with Template” and save.

Return to the Playbooks section and select the block we were working on. For the final step, drag the “Send Email with Template” action in Emailv2.  For the “To:” parameter, use the placeholder for the Environment contact.  Fill in “Case Closure Notice” for the subject and use the result of the Render Template action as the content.

The completed block will look like this:

The output of Render Template can now be used in the body of an email or a ticket.  Here is an example of how the above example renders in an email.

The full template used:

  Dear [Environment.Name], please see below conclusion report of cyber security incident.

          Siemplify Case Notification

        Case Title:

          {% for alert in input_json['alerts']  %}

            {% do alert_descs.append( alert['additionalProperties']['ruleGenerator'] ) %}

          {% endfor %}

          {{ alert_descs|unique|join(',') }}

        Case Id:

        Creation Date/Time:

        Case Severity:

        Time to resolution:

        {% if "[Case.Priority]" == "Critical" %}

        {% elif "[Case.Priority]" == "High" %}

        {% elif "[Case.Priority]" == "Medium" %}

        {% elif "[Case.Priority]" == "Low" %}

        {% elif "[Case.Priority]" == "Informative" %}

        {% endif %}        

        Analysis:

    {% set alert_comments = [] %}

        {% for comment in input_json['wallData'] %}

            {% if comment['isFavorite']== True %}

                {% if comment['type'] == 5 and comment['creatorUserId'] != 'System' %}

                    {% do alert_comments.append( comment['comment'] ) %}

                {% elif comment['type'] == 6 %}

                    {% do alert_comments.append( comment['content'] ) %}

                {% endif %}

            {% endif %}

        {% endfor %}

    {% if alert_comments|length > 0 %}   

    {% for alert_comment in alert_comments %}

          {{ alert_comment|safe }}            

     {% endfor %}

     {% else %}

            No analyst notes.

     {% endif %}     

{% set alert_descs = [] %}

[Case.Id]

[Case.CreationTime]

[Case.Priority]

The expected timeframe to resolve this issue is 1 hours

The expected timeframe to resolve this issue is 2 hours

The expected timeframe to resolve this issue is 6 hours

The expected timeframe to resolve this issue is 8 hours

The expected timeframe to resolve this issue is 8 hours

Enjoy!