# Elastic Detection Rule Creation

**URL:** <https://discuss.elastic.co/t/elastic-detection-rule-creation/379471>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [June 25, 2025, 1:10pm UTC](https://discuss.elastic.co/t/elastic-detection-rule-creation/379471 "2025-06-25T13:10:08Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Elk\_huh](https://avatars.discourse-cdn.com/v4/letter/e/d26b3c/32.png) [@Elk\_huh](https://discuss.elastic.co/u/Elk_huh)\
**Post date:** [June 25, 2025, 1:10pm UTC](https://discuss.elastic.co/t/elastic-detection-rule-creation/379471/1 "2025-06-25T13:10:09Z")

</div>

How do i pull variables from .source or the following required Fields defined in the SIEM alert so i can use it in EMAIL action body

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/5/a/5a48de7f2a2abcf6e4504c9031c016269ba5c630.png)

---

<div class="post-metadata">

**Author:** ![Elk\_huh](https://avatars.discourse-cdn.com/v4/letter/e/d26b3c/32.png) [@Elk\_huh](https://discuss.elastic.co/u/Elk_huh)\
**Post date:** [July 29, 2025, 1:58pm UTC](https://discuss.elastic.co/t/elastic-detection-rule-creation/379471/2 "2025-07-29T13:58:48Z")

</div>

The First email action, the json variables are accessible through

```auto
- Timestamp: {{context.date}}
- Hostname: {{context.hits.0._source.agent.name}}
- Service: {{context.hits.0._source.windows.service.display_name}}

```

Confirmed in the State of Recovered Actions email, Variables do not come through