Variables and subfields

Elastic Security
1

When working with alerts and using variables in the connectors, is if possible to only use a subset of the data in my notifications?

For example, the field name is details, but this field looks to contain its own json data, and I only want 1 piece of that data.

currently I'm using {{{FieldName}}} which looks like this
1

But all I want ins the value of "display_name" from the value of the root field

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.