IBM Security QRadar SOAR

Hello,

I want to edit Rule Open SR by email by adding new Activity field (additional_recipients), as Multyselect  type of field. I created new Activity field in Rule Open SR by email and edit script Mail.open_sr_by_email.ftl as follows.

<#-- Add email headers -->
<#assign action_field_defs = restClient.get("types/actioninvocation").fields>
<#function getActionField_ValueById valueId>
<#list actionFields['additional_recipients'].values as valueItem>
<#if valueItem.value?c == valueId>
<#return valueItem.label>
</#if>
</#list>
</#function>

<#assign mail_to = "">
<#list .data_model.incident.properties.additional_recipients as value>
<#assign mail_to = mail_to + getActionField_ValueById(value?c) + ",">
</#list>

${putToMail("to",data_model.properties.email_address)}

${putToMail("additional_recipients",data_model.value)}

${putToMail("cc",data_model.properties.cc_address!"")}
${putToMail("subject", subject)}
${putToMail("X-Co3-Confirmation","true")}

Activity field is a Multiselect, so the value you get will be an array. I know I need to loop and get each id, map the id to value (which is email address), and join the value using comma as separator and used in "putToMail" line. After this Action status is success but email is still not received by people in Additional_recipient field so it is not working.

I'm not developer, if someone could assist please to solve this.

Thank you.




------------------------------
Ajla Srna
------------------------------