# Security Detection Rules ( SIEM )

**URL:** https://discuss.elastic.co/t/security-detection-rules-siem/360163
**Category:** Elasticsearch
**Created:** [May 24, 2024, 1:34pm UTC](https://discuss.elastic.co/t/security-detection-rules-siem/360163 "2024-05-24T13:34:01Z")
**Posts on this page:** 1
**Page:** 1

<div class="post-metadata">

### Author: ![Elk\_huh](https://avatars.discourse-cdn.com/v4/letter/e/d26b3c/32.png) [@Elk\_huh](https://discuss.elastic.co/u/Elk_huh)
#### Post date: [May 24, 2024, 1:34pm UTC](https://discuss.elastic.co/t/security-detection-rules-siem/360163/1 "2024-05-24T13:34:01Z")

</div>

For the Alerts , Detection rules

Under Action when i am trying to output to an email  
Why doesn't the variable {{context.rule.investigation\_fields}} give me the values of the investigation fields, in the emails i just get the field names back example below

contxt.rule.investigation fields {"field\_names":["@timestamp","event\_data.TargetUserName","event.action","source.ip","winlog.computer\_name"]}