> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/active-response/set-up-active-response/playbook-configuration.md). # Playbook Configuration You can customize the following notifications and information sent by the Active Response playbook: * The subject and body text of email or ticket notifications sent by the playbook to potential service owners. * The subject and body text of email or ticket notifications sent to the service owner after an alert was resolved by automated remediation. * The Jira project key that will be associated with any Jira tickets created by the playbook. In addition to specifying the text to include in notifications, you can also include system variables. Variables enable you to include the alert-specific information that your organization uses in their workflow. Customizing the playbook notifications is optional. If you do not customize the notifications, the playbook will use the default text and formats described in [Active response templates](/cortex-xpanse/active-response/automated-remediation-capabilities-matrix.md#UUID-8de97a57-0ad7-40ec-cc78-86b24045fb5d_UUID-0cf03215-40b3-e613-74f0-863f9f41bcf0). ## Customize the Active Response Playbook Notifications The following steps explain how to customize the Active Response playbook notifications. All of these fields use plain text. See [Supported Variables in Active Response Notifications](#UUID-ba9af0e5-f94a-9623-347a-985c96817c9d_section-idm450118276052643409674478323) for the list of variables that can be used in notifications. 1. Navigate to **Automation** → **Playbook Configuration**. 2. In the **Email/Ticketing Notification Subject** field, enter the text to be used in the subject field of emails and ticketing notifications sent to service owners. 3. In the **Email/Ticketing Notification Body** field, enter the text to be used in the body of emails or ticket notifications sent by the playbook to potential service owners. 4. In the **Automated Remediation Subject** field, enter the text to be used in the subject field of email and ticketing notifications sent to service owners after remediation. 5. In the **Automated Remediation Body** field, enter the text to be used in the body of email or ticket notifications sent by the playbook to service owners after remediation. 6. In the **Jira Project Key** field, enter the Jira project key to be used for any tickets created or updated by the playbook. ### **Supported Variables in Active Response Notifications** The following system variables can be used in the body of Active Response email and ticketing notifications. Copy the value from the Variable Name field (including the $) and paste it into your custom notification. | Variable Name | Description | Example | | ------------------------------------- | ----------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | ${alert.asmattacksurfacerulecategory} | Category associated with the Attack Surface Rule | Remote Access Services | | ${alert.name} | Name of the ASM alert | RDP Server at x.x.x.x | | ${alert.details} | Details related to the ASM alert | Remote Desktop Protocol (RDP) servers provide remote access to a computer over a network connection. Externally accessible RDP servers pose a significant security risk as they are frequent targets for attackers and can be vulnerable to a variety of documented exploits. | | ${alert.asmremediation.action} | Summary of the remediation action that was taken | Closed service port from internet. | | ${alert.asmremediation.outcome} | Summary of the outcome of the remediation outcome | Success | | ${alert.asmserviceowner.name} | Name of service owner. Either name or email will be present. | John Smith | | ${alert.asmserviceowner.email} | Email of the service owner. | | | ${alert.asmserviceowner.source} | Where the service owner was found based on data from integrations | AWS | | ${Remediation Guidance} | Guidance for remediation of the ASM alert |

Recommendations to reduce the likelihood of malicious RDP attempts are as follows:

| --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xpanse/active-response/set-up-active-response/playbook-configuration.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.