# Format mail send from siem detection threshold rule

**URL:** https://discuss.elastic.co/t/format-mail-send-from-siem-detection-threshold-rule/273375
**Category:** SIEM
**Created:** [May 19, 2021, 8:43am UTC](https://discuss.elastic.co/t/format-mail-send-from-siem-detection-threshold-rule/273375 "2021-05-19T08:43:15Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![lusynda](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lusynda/32/53557_2.png) [@lusynda](https://discuss.elastic.co/u/lusynda)
#### Post date: [May 19, 2021, 8:43am UTC](https://discuss.elastic.co/t/format-mail-send-from-siem-detection-threshold-rule/273375/1 "2021-05-19T08:43:15Z")

</div>

Hi all  
I have successfully config for siem to send alert mail and now when i tried it with the theashold rule it failed.  
So i want to ask how to format theashold rule mail to send infomation.  
The format that i tried is:

```auto
{{#context.alerts}}

  Detection alert for :
  From source.ip : {{signal.threshold_result.terms.value}} at {{@timestamp}}

{{/context.alerts}}

```

---

<div class="post-metadata">

### Author: ![Michael\_Olorunnisola](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/michael_olorunnisola/32/88980_2.png) [@Michael\_Olorunnisola](https://discuss.elastic.co/u/Michael_Olorunnisola)
#### Post date: [May 19, 2021, 5:33pm UTC](https://discuss.elastic.co/t/format-mail-send-from-siem-detection-threshold-rule/273375/2 "2021-05-19T17:33:19Z")

</div>

HI Iusynda! Thanks for reaching out. What version of the stack are you on?

If you happen to be on 7.12.1, then the `threshold_results.terms` is an array, so you'd need to access the value as follows:

```
{{#context.alerts}}

  Detection alert for :
  From source.ip : {{#signal.threshold_result.terms}}{{value}}{{/signal.threshold_result.terms}} at {{@timestamp}}

{{/context.alerts}}
```

---

<div class="post-metadata">

### Author: ![lusynda](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lusynda/32/53557_2.png) [@lusynda](https://discuss.elastic.co/u/lusynda)
#### Post date: [May 20, 2021, 1:37am UTC](https://discuss.elastic.co/t/format-mail-send-from-siem-detection-threshold-rule/273375/3 "2021-05-20T01:37:34Z")

</div>

Yes thanks for your replies.  
I am on version 7.12.0, will your queries works as well.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 17, 2021, 1:37am UTC](https://discuss.elastic.co/t/format-mail-send-from-siem-detection-threshold-rule/273375/4 "2021-06-17T01:37:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
