None of those macros should be used.
The command {% set topEventNames = template_helper.get_datatable_value_array(template_helper.get_incident_value(incident, 'id'), 'qr_offense_top_events', 'event_name') %} will create a variable named topEventNames that's value will be a list of all the top event names from the data table qr_offense_top_events. You can then take that list and format it how you want in the email template.
------------------------------
Richard Swierk
------------------------------
Original Message:
Sent: Mon May 05, 2025 01:36 PM
From: Abdlrahman moghazy
Subject: How to Show Top 10 Event Names in SOAR Incident Outbound Email from QRadar Offense Details
Dear Mr. Richard Swierk,
Thank you for your support.
Could you please clarify where exactly I should place the command, and which macro should be used with it?
Should I use:
macro get_note(note, get_children=True)
macro get_row(label, field_name)
or macro get_artifact(art)?
Your guidance is highly appreciated.
Best regards,
------------------------------
Abdlrahman moghazy
------------------------------
Original Message:
Sent: Mon May 05, 2025 11:14 AM
From: Richard Swierk
Subject: How to Show Top 10 Event Names in SOAR Incident Outbound Email from QRadar Offense Details
The following added to the template would return a string comma-separated list of the top event names.
{% set topEventNames = template_helper.get_datatable_value_array(template_helper.get_incident_value(incident, 'id'), 'qr_offense_top_events', 'event_name') %}
------------------------------
Richard Swierk