​
Overview

Here’s a collection of template variables that you will find useful while configuring things like mail templates.

​
Case

case.state
case.assignee
case.id
case.nature
case.playbook
case.client_id
case.case_number
case.created_date
case.closed_date
case.resolved_date
case.first_event_date
case.last_event_date
case.first_evidence_date
case.last_evidence_date
case.event_count
case.previous_state
case.state_entry_date
case.timeout_date
case.close_counter
case.type_counts
case.reporter_counts
case.malware_counts
case.event_ips
case.event_nettags
case.customer_numbers
case.brand_names
case.customer_types

​
Transition

transition.id
transition.name
transition.actions
transition.type
transition.target
transition.playbook
transition.active
transition.hooks
transition.precondition
transition.source
transition.modifications

​
Subscriber

subscriber.id
subscriber.tags
subscriber.comment
subscriber.first_seen
subscriber.last_seen
subscriber.product_category
subscriber.customer_type
subscriber.brand_name
subscriber.customer_number
subscriber.resolver_data.<example-key>

⚠️ subscriber.resolver_data contains attributes you pass into AbuseHQ via your Subscriber Resolver.

​
Event

AbuseHQ uses the last available event or the event that caused a transition for event-triggered transitions. Note that the event may not be available if the last event has already been deleted.

event.id
event.type
event.complainant
event.client
event.caseId
event.date
event.handled_on 
event.resources
event.resources.ip <Array>
event.resources.evidence_part
event.resources.incident_part 
event.resources.malware.name
event.resources.malware.normalized 
event.report.format
event.report.storage
event.report.send_date
event.report.received_dateevent.tags

​
Repshare

repshare.case.path
repshare.case.url
repshare.subscriber.path
repshare.subscriber.url 
repshare.event.path
repshare.event.url