Hey there! I'm currently struggling to find a way to send the alert sid (commonly found under view results when using the Send Email action in the Alert config) to SOAR. Currently I'm able to send the results as multiple artifacts within 1 container via the Grouping checkbox.
However if I have a result that holds over 5k+ events, then a container will hold 5k+ artifacts. What's interesting is that in each artifact within the container, there's a variable named _originating_search that has the SID I want to pass.
Right now I only want this result sid (_originating_search) but I cant figure out how to do this. Any suggestions welcomed!
