# Common File for adding email address in SIEM Detection email action

**URL:** <https://discuss.elastic.co/t/common-file-for-adding-email-address-in-siem-detection-email-action/282341>\
**Category:** SIEM\
**Tags:** elastic-stack-alerting, detection-rules\
**Created:** [August 24, 2021, 11:19am UTC](https://discuss.elastic.co/t/common-file-for-adding-email-address-in-siem-detection-email-action/282341 "2021-08-24T11:19:13Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![jancodenew](https://avatars.discourse-cdn.com/v4/letter/j/87869e/32.png) [@jancodenew](https://discuss.elastic.co/u/jancodenew)\
**Post date:** [August 24, 2021, 11:19am UTC](https://discuss.elastic.co/t/common-file-for-adding-email-address-in-siem-detection-email-action/282341/1 "2021-08-24T11:19:13Z")

</div>

Hi,

Please share if there any way to keep common file for Email "To" address and use parameter in detection email action instead of adding email address in each Detections Rules.

I am using ELK 7.13.4.

Thanks in advance

---

<div class="post-metadata">

**Author:** ![jancodenew](https://avatars.discourse-cdn.com/v4/letter/j/87869e/32.png) [@jancodenew](https://discuss.elastic.co/u/jancodenew)\
**Post date:** [August 29, 2021, 8:58am UTC](https://discuss.elastic.co/t/common-file-for-adding-email-address-in-siem-detection-email-action/282341/2 "2021-08-29T08:58:48Z")

</div>

One more doubt related to the above query. If there is no common file method to enter the email address. Kindly share if there is any option to do bulk actions to change the email ids in multiple rules.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 26, 2021, 8:59am UTC](https://discuss.elastic.co/t/common-file-for-adding-email-address-in-siem-detection-email-action/282341/3 "2021-09-26T08:59:45Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
