> For the complete documentation index, see [llms.txt](https://support.attackforge.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://support.attackforge.com/app/getting-started/notifications.md).

# Notifications

## Overview <a href="#overview" id="overview"></a>

Email notifications keep everyone involved in a test informed, without anyone having to check AttackForge or chase updates. They cover testing progress, retests, new vulnerabilities and changes to existing vulnerabilities.

Testers send daily testing emails, and any team member can send a one-off email. AttackForge sends new vulnerability emails as findings become visible, and time-based emails on the schedule administrators set.

For anything the built-in emails don't cover, build your own. An Action, event or HTTP request starts a Flow, and the Flow sends the email through the sendEmail REST API.

<figure><img src="https://372186556-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M8s1QY2Q6YTHB4a6DMu%2Fuploads%2FxMuOnQzFNIbF74F8iZOR%2Fnotifications-at-a-glance.svg?alt=media&amp;token=163a7e9b-7454-40a4-b454-f202b26522a4" alt=""><figcaption></figcaption></figure>

## Why notifications matter <a href="#why-notifications-matter" id="why-notifications-matter"></a>

* **No surprises for clients.** Clients know when testing starts and stops each day, and hear about serious findings straight away rather than in the final report.
* **Faster response to serious risk.** A new Critical or High vulnerability can reach the people who need to act on it as soon as it's visible.
* **Automatic follow-up.** Scheduled emails chase overdue fixes, warn about upcoming SLA breaches and send regular summaries, so nobody has to remember.
* **Consistent, on-brand messages.** Headers, footers and templates make every email look the same, whoever sends it.

## Four kinds of email <a href="#four-kinds-of-email" id="four-kinds-of-email"></a>

| Email                                | Sent by                                          | When                                     | Use it for                                         |
| ------------------------------------ | ------------------------------------------------ | ---------------------------------------- | -------------------------------------------------- |
| **Daily started or stopped testing** | Testers with Edit access                         | When they start or stop testing each day | Keeping the client informed about testing activity |
| **New vulnerabilities**              | AttackForge, automatically                       | When a new vulnerability becomes visible | Alerting people to serious findings straight away  |
| **Custom one-off emails**            | Testers with Edit access                         | Whenever needed                          | Ad hoc messages to the project team                |
| **Custom time-based emails**         | AttackForge, on a schedule set by administrators | Daily or weekly, at a set hour           | Reminders, escalations and regular reporting       |

For anything else, you can send your own emails with the sendEmail REST API, and automate them with Flows and Actions. See Send custom emails with the REST API, Actions and Flows below.

## Who benefits <a href="#who-benefits" id="who-benefits"></a>

| Who                             | How                                                                   |
| ------------------------------- | --------------------------------------------------------------------- |
| **Clients and stakeholders**    | Know when testing is happening, and hear about serious findings early |
| **Testers and consultants**     | Keep clients informed in a couple of clicks                           |
| **Remediation owners**          | Get reminders before fixes become overdue                             |
| **Administrators and managers** | Automate follow-ups, escalations and reporting across every project   |

## Send daily started and stopped testing emails <a href="#send-daily-started-and-stopped-testing-emails" id="send-daily-started-and-stopped-testing-emails"></a>

Clients often need to know when testing is happening. They might need to watch their monitoring, warn their own teams, or be ready to act if something goes wrong. A short email at the start and end of each testing day keeps them informed.

Project team members with **Edit** access, such as pentesters and consultants, can send these emails.

1. Open the project dashboard.
2. From the project menu, choose:
   * **Daily Commencement Email** when you start testing, or
   * **Daily Completion Email** when you stop.
3. Send the email.

The emails can be personalised for each project. See [Email project team on events](https://support.attackforge.com/app/getting-started/creating-and-managing-projects#email-project-team-on-events).

<figure><img src="https://372186556-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M8s1QY2Q6YTHB4a6DMu%2Fuploads%2F6e3W3TmpOqMvvL4oWfiJ%2FScreenshot%202026-11-01%20at%2011.23.38%E2%80%AFam.png?alt=media&amp;token=726bae84-4dd6-4a9d-b025-6a5d7cf1ebbc" alt=""><figcaption></figcaption></figure>

<figure><img src="https://372186556-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M8s1QY2Q6YTHB4a6DMu%2Fuploads%2FaRzgtOwZ5nm88jdbVH3R%2FScreenshot%202026-11-01%20at%2011.24.39%E2%80%AFam.png?alt=media&amp;token=0f8262d3-7058-4caa-8b08-795701f7a97a" alt=""><figcaption></figcaption></figure>

## Get notified about new vulnerabilities <a href="#get-notified-about-new-vulnerabilities" id="get-notified-about-new-vulnerabilities"></a>

Serious findings shouldn't wait for the final report. You can turn on emails for events such as the discovery of a new **Critical** or **High** vulnerability.

* Emails are only sent once the vulnerability is **visible**. A vulnerability that's still Pending (in QA) doesn't trigger one.
* Administrators control how much vulnerability information is shared for each project.
* Project team members choose whether to receive these emails.

There are two notification types:

| Notification type                                           | What's sent                                                                                                       | Best for                                                            |
| ----------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------- |
| **Send Individual Email For Each New Vulnerability**        | One email for each new vulnerability, to each project team member who has opted in, and any additional recipients | Teams that act on each finding as it arrives                        |
| **Send One Email with Details For All New Vulnerabilities** | A single email to the same recipients, summarising each new vulnerability                                         | Avoiding a flood of emails when many findings are released together |

See [Email project team on events](https://support.attackforge.com/app/getting-started/creating-and-managing-projects#email-project-team-on-events).

<figure><img src="https://372186556-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M8s1QY2Q6YTHB4a6DMu%2Fuploads%2FuwmNiDAvyzAXZecLSc92%2FScreenshot%202026-11-01%20at%2011.26.10%E2%80%AFam.png?alt=media&amp;token=c7445192-a290-4d33-ba07-ce3af4aa00e2" alt=""><figcaption></figcaption></figure>

<figure><img src="https://372186556-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M8s1QY2Q6YTHB4a6DMu%2Fuploads%2FJSkJVAd06ur5WXuMi8K9%2FScreenshot%202026-11-01%20at%2011.26.34%E2%80%AFam.png?alt=media&amp;token=4dfb455a-257b-4cb5-b689-28c1b4998469" alt=""><figcaption></figcaption></figure>

<figure><img src="https://372186556-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M8s1QY2Q6YTHB4a6DMu%2Fuploads%2FzboktFOcobe1ZxA0oGBP%2FScreenshot%202026-11-01%20at%2011.25.57%E2%80%AFam.png?alt=media&amp;token=1ddb9083-5c6b-4d34-a94f-557dfc7d7024" alt=""><figcaption></figcaption></figure>

## Send a custom one-off email <a href="#send-a-custom-one-off-email" id="send-a-custom-one-off-email"></a>

Use a one-off email for anything else the project team needs to know, such as a change to the testing window, a request for access, or a note that the report is ready.

1. From the project menu, choose **Custom One-Off Email**.
2. Enter a subject and body. The body supports limited HTML and CSS, and **Project Email Meta Tags**.
3. Choose the recipients: the whole project team, or individual members.
4. Optionally, add other email addresses.
5. Click **Send Email**.

<figure><img src="https://372186556-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M8s1QY2Q6YTHB4a6DMu%2Fuploads%2FmshgkiLbtzm5WTsdSvOI%2FScreenshot%202026-11-01%20at%2011.27.20%E2%80%AFam.png?alt=media&amp;token=67211587-491a-4b3c-a592-f1811e4086dd" alt=""><figcaption></figcaption></figure>

<figure><img src="https://372186556-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M8s1QY2Q6YTHB4a6DMu%2Fuploads%2FZjrhSwq9I4ILWPJFP6al%2FScreenshot%202026-11-01%20at%2011.27.44%E2%80%AFam.png?alt=media&amp;token=a3d3ea9f-97a2-4f53-907c-cbc835869db7" alt=""><figcaption></figcaption></figure>

## Set up custom time-based emails <a href="#set-up-custom-time-based-emails" id="set-up-custom-time-based-emails"></a>

Time-based emails are sent automatically on a schedule, using rules you define. Use them for:

* **reminders**, such as a vulnerability whose SLA will be breached in 7 days
* **escalations**, such as Critical or High vulnerabilities whose SLA was breached two or three days ago
* **regular reporting**, such as a weekly summary of open vulnerabilities for a client

Every custom email can have its own settings. Administrators create them under **Administration > Notifications > Custom Emails**.

<figure><img src="https://372186556-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M8s1QY2Q6YTHB4a6DMu%2Fuploads%2F2EptrQt36HBpwarhUgGi%2FScreenshot%202026-11-01%20at%2011.28.32%E2%80%AFam.png?alt=media&amp;token=7800e814-143b-462c-8f4e-cb5edda151ee" alt=""><figcaption></figcaption></figure>

### Choose how often and when <a href="#choose-how-often-and-when" id="choose-how-often-and-when"></a>

| Setting             | Options                                                                                                                      |
| ------------------- | ---------------------------------------------------------------------------------------------------------------------------- |
| **Email frequency** | **Daily:** sent every day, in the hour you choose. **Weekly:** sent on the day you choose each week, in the hour you choose. |
| **Email time**      | Any hourly block in the day                                                                                                  |

### Choose the type <a href="#choose-the-type" id="choose-the-type"></a>

The type decides which data the email can filter and include: **Vulnerabilities**, **Projects**, **Project Requests**, **Users** or **Writeups**.

### Write a filter <a href="#write-a-filter" id="write-a-filter"></a>

The filter decides which records go into the email, using a query syntax. For example, only open vulnerabilities, or only projects that finish this week.

{% hint style="info" %}
**Important:** Before an email is sent, the filtered data is checked against each recipient, to make sure they have access to it.
{% endhint %}

The filter supports these operators: `$and`, `$or`, `$eq`, `$ne`, `$in`, `$nin`, `$gt`, `$gte`, `$lt`, `$lte`, `$regex`, `$elemMatch` and `$all`. It also supports the `datetime()` function, for dates relative to now.

#### **Filter operators**

| Operator     | What it does                                                                                   | Example                                                                 |
| ------------ | ---------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------- |
| `$and`       | All of two or more conditions must match                                                       | Open **and** Critical vulnerabilities                                   |
| `$or`        | At least one of two or more conditions must match                                              | Critical **or** High vulnerabilities                                    |
| `$eq`        | The field equals a value. The value can be a string, boolean, number, null or function.        | `{ priority: { $eq: 'Critical' } }`                                     |
| `$ne`        | The field doesn't equal a value. The value can be a string, boolean, number, null or function. | `{ priority: { $ne: 'Info' } }`                                         |
| `$in`        | The field contains a value from a list (array)                                                 | `{ tags: { $in: ['OWASP Top 10'] } }`                                   |
| `$nin`       | The field doesn't contain any value from a list (array)                                        | `{ tags: { $nin: ['OWASP Top 10'] } }`                                  |
| `$gt`        | The field is greater than a value. Supports strings, numbers and functions.                    | `{ likelihood_of_exploitation: { $gt: 7 } }`                            |
| `$gte`       | The field is greater than or equal to a value. Supports strings, numbers and functions.        | `{ likelihood_of_exploitation: { $gte: 7 } }`                           |
| `$lt`        | The field is less than a value. Supports strings, numbers and functions.                       | `{ likelihood_of_exploitation: { $lt: 7 } }`                            |
| `$lte`       | The field is less than or equal to a value. Supports strings, numbers and functions.           | `{ likelihood_of_exploitation: { $lte: 7 } }`                           |
| `$regex`     | The field matches a regular expression. Supports JavaScript regular expressions.               | `{ title: { $regex: /SQL/i } }` finds "SQL" in the title, ignoring case |
| `$elemMatch` | At least one item in an array field matches all the given conditions                           | See below                                                               |
| `$all`       | The field contains all of the given values                                                     | `{ tags: { $all: ["CWE-520", "Web App"] } }`                            |

Combining conditions with `$and`:

```
{
    $and: [
        {
            status: { $eq: 'Open' }
        },
        {
            priority: { $eq: 'Critical' }
        }
    ]
}
```

Combining conditions with `$or`:

```
{
    $or: [
        {
            priority: { $eq: 'Critical' }
        },
        {
            priority: { $eq: 'High' }
        }
    ]
}
```

Matching a custom field with `$elemMatch`, for example vulnerabilities where the custom field `is_pci` is "Yes":

```
{
    custom_fields: {
        $elemMatch: {
            name: { $eq: "is_pci" },
            value: { $eq: "Yes" }
        }
    }
}
```

#### **Dates with datetime()**

`datetime()` is the only supported function. `datetime(timeValue, modifiers)` creates a date and time, and optionally adjusts it.

* **timeValue** must be `now`, `YYYY-MM-DD` or `YYYY-MM-DD HH:MM`.
* **modifiers** can be `+999 years` or `-999 years`, `+999 months` or `-999 months`, `+999 days` or `-999 days`, `+999 hours` or `-999 hours`, `+999 minutes` or `-999 minutes`, `start of year`, `start of month`, or `start of day`.
* Modifiers are applied in order.

| Example                                | Filter                                                    |
| -------------------------------------- | --------------------------------------------------------- |
| Created after 1 June 2022              | `{ created: { $gt: datetime('2022-06-01') } }`            |
| Created after 12:00 UTC on 1 June 2022 | `{ created: { $gt: datetime('2022-06-01 12:00') } }`      |
| Created in the last 7 days             | `{ created: { $gt: datetime('now', '-7 days') } }`        |
| SLA more than 7 days away              | `{ sla: { $gt: datetime('now', '+7 days') } }`            |
| SLA more than 1 year and 7 days away   | `{ sla: { $gt: datetime('now', '+7 days', '+1 year') } }` |

#### **Fields you can filter on**

**Vulnerabilities**

| Field                        | Description                                           |
| ---------------------------- | ----------------------------------------------------- |
| `id`                         | Vulnerability ID                                      |
| `alternate_id`               | Alternate ID, set by the project's vulnerability code |
| `created`                    | When the vulnerability was created                    |
| `modified`                   | When the vulnerability was last modified              |
| `priority`                   | Critical, High, Medium, Low or Info                   |
| `title`                      | Title                                                 |
| `zero_day`                   | Yes or No                                             |
| `likelihood_of_exploitation` | 1 to 10                                               |
| `status`                     | Open or Closed                                        |
| `status_updated`             | When the status was last changed                      |
| `is_retest`                  | Yes or No: whether it's ready for retesting           |
| `sla`                        | SLA date                                              |
| `target_remediation_date`    | Target remediation date                               |
| `release_date`               | Release date                                          |
| `custom_tags`                | Custom tags, as name and value pairs                  |
| `custom_fields`              | Custom fields, as name and value pairs                |

**Projects**

| Field                | Description                                                      |
| -------------------- | ---------------------------------------------------------------- |
| `id`                 | Project ID                                                       |
| `created`            | When the project was created                                     |
| `modified`           | When the project was last modified                               |
| `name`               | Project name                                                     |
| `code`               | Project code                                                     |
| `status`             | Overrun, Waiting to Start, Testing, Completed, Retest or On Hold |
| `start_date`         | Start date                                                       |
| `end_date`           | End date                                                         |
| `on_hold`            | Yes or No                                                        |
| `organization_code`  | Organisation code                                                |
| `vulnerability_code` | Vulnerability code                                               |
| `group_id`           | IDs of linked groups                                             |
| `group`              | Names of linked groups                                           |
| `custom_fields`      | Custom fields, as name and value pairs                           |

**Project requests**

| Field               | Description                                                    |
| ------------------- | -------------------------------------------------------------- |
| `id`                | Project request ID                                             |
| `created`           | When the request was created                                   |
| `modified`          | When the request was last modified                             |
| `name`              | Name                                                           |
| `code`              | Code                                                           |
| `status`            | Pending Approval, Requested Information, Approved or Rejected. |
| `start_date`        | Requested start date                                           |
| `end_date`          | Requested end date                                             |
| `organization_code` | Organisation code                                              |
| `custom_fields`     | Custom fields, as name and value pairs                         |

**Users**

| Field                  | Description                                              |
| ---------------------- | -------------------------------------------------------- |
| `id`                   | User ID                                                  |
| `created`              | When the user was created                                |
| `modified`             | When the user was last modified                          |
| `first_name`           | First name                                               |
| `last_name`            | Last name                                                |
| `username`             | Username                                                 |
| `email`                | Email address                                            |
| `last_logged_in`       | When the user last logged in                             |
| `status`               | Active or Blocked                                        |
| `role`                 | client, consultant, librarymod, projectoperator or admin |
| `failed_logins`        | Number of failed logins                                  |
| `mfa_enabled`          | Yes or No                                                |
| `last_active_on_app`   | When the user was last active in the app                 |
| `last_active_on_ssapi` | When the user was last active on the Self-Service API    |
| `account_expiry`       | When the account expires                                 |

**Writeups**

| Field                        | Description                                     |
| ---------------------------- | ----------------------------------------------- |
| `id`                         | Writeup ID                                      |
| `created`                    | When the writeup was created                    |
| `modified`                   | When the writeup was last modified              |
| `reference_id`               | 15-digit reference ID                           |
| `title`                      | Title                                           |
| `description`                | Description                                     |
| `attack_scenario`            | Attack scenario                                 |
| `remediation_recommendation` | Remediation recommendation                      |
| `likelihood_of_exploitation` | 1 to 10                                         |
| `severity`                   | 1 to 10                                         |
| `custom_library_key`         | Key of the custom library it belongs to         |
| `imported_library`           | Yes or No: whether it's in the Imported library |
| `project_library`            | Yes or No: whether it's in the Project library  |
| `tags`                       | Tags                                            |
| `custom_tags`                | Custom tags, as name and value pairs            |
| `custom_fields`              | Custom fields, as name and value pairs          |

### Choose the recipients <a href="#choose-the-recipients" id="choose-the-recipients"></a>

Who you can send to depends on the type:

| Type                 | Recipients                                                                                                                                                                                     |
| -------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Vulnerabilities**  | Vulnerability Creator; Project Team and Project Group Members by role; role-based groups; Individual Groups; Individual Users; user or group custom fields on the vulnerability or its project |
| **Projects**         | Project Creator; Project Team and Project Group Members by role; role-based groups; Individual Groups; Individual Users; user or group custom fields on the project                            |
| **Project Requests** | Project Requestor Creator; role-based groups; Individual Groups; Individual Users; user or group custom fields on the project request                                                          |
| **Users**            | Clients, Consultants, Library Moderators, Project Coordinators, Administrators; Individual Groups; Individual Users                                                                            |
| **Writeups**         | Role-based groups; Individual Groups; Individual Users; user or group custom fields on the writeup                                                                                             |

The roles are Clients, Consultants, Library Moderators, Project Coordinators and Administrators. Project Team and Project Group Members can also be set to Everyone.

**Skip Access Check**

By default, each recipient only receives data they have access to. **Skip Access Check** turns this off, and sends the filtered data whatever the recipient's access.

{% hint style="info" %}
**Warning:** When this option is turned on, recipients may receive more data in the email than they have access to. Only use it when every recipient is allowed to see all the data the filter returns.
{% endhint %}

### Write the subject and body <a href="#write-the-subject-and-body" id="write-the-subject-and-body"></a>

* **Subject:** the email's title.
* **Body:** HTML, so it can include headings, lists, tables and images.

Each type has its own **metatags**, for things like the recipient's name, a loop over the filtered records, and the record's fields.

Every type supports `{user.firstName}` and `{user.lastName}` for the recipient's name. Each type also has a **loop tag**, such as `{vulnerabilities}...{/vulnerabilities}`. The content between the loop tags is repeated for each record the filter returns, so put the record's tags inside it.

Dates shown as "DAY MONTH DATE YEAR" can be reformatted. See "Format dates and times" below.

**Vulnerability metatags**

Loop: `{vulnerabilities}...{/vulnerabilities}`

| Metatag                             | Description                                            |
| ----------------------------------- | ------------------------------------------------------ |
| `{vuln.id}`                         | Vulnerability ID                                       |
| `{vuln.alternate_id}`               | Alternate ID, from the project's vulnerability code    |
| `{vuln.created}`                    | Created date (DAY MONTH DATE YEAR)                     |
| `{vuln.modified}`                   | Modified date (DAY MONTH DATE YEAR)                    |
| `{vuln.priority}`                   | Critical, High, Medium, Low or Info                    |
| `{vuln.title}`                      | Title                                                  |
| `{vuln.description}`                | Description                                            |
| `{vuln.attack_scenario}`            | Attack scenario                                        |
| `{vuln.remediation_recommendation}` | Remediation recommendation                             |
| `{vuln.proof_of_concept}`           | Proof of concept, or steps to reproduce                |
| `{vuln.status}`                     | Open, Retest or Closed                                 |
| `{vuln.status_updated}`             | Date the status was last updated (DAY MONTH DATE YEAR) |
| `{vuln.tags}`                       | Tags, as a bulleted list                               |
| `{vuln.zero_day}`                   | Yes or No                                              |
| `{vuln.likelihood_of_exploitation}` | Likelihood of exploitation, from 1/10 to 10/10         |
| `{vuln.notes}`                      | Notes, each in its own paragraph                       |
| `{vuln.test_cases}`                 | Test cases, as a bulleted list                         |
| `{vuln.sla_date}`                   | SLA date (DAY MONTH DATE YEAR)                         |
| `{vuln.target_remediation_date}`    | Target remediation date (DAY MONTH DATE YEAR)          |
| `{vuln.release_date}`               | Release date (DAY MONTH DATE YEAR)                     |
| `{vuln.cvssv3}`                     | CVSSv3 score                                           |
| `{vuln.cvssv3_vector}`              | CVSSv3 vector string                                   |
| `{vuln.cvssv3_base_score}`          | CVSSv3 base score                                      |
| `{vuln.cvssv3_temporal_score}`      | CVSSv3 temporal score                                  |
| `{vuln.cvssv3_environmental_score}` | CVSSv3 environmental score                             |
| `{vuln.custom_tag_[name]}`          | A custom tag. Replace `[name]` with the tag's name.    |
| `{vuln.custom_field_[key]}`         | A custom field. Replace `[key]` with the field's key.  |
| `{vuln.user_id}`                    | ID of the user who created the vulnerability           |
| `{vuln.user_first_name}`            | First name of the user who created the vulnerability   |
| `{vuln.user_last_name}`             | Last name of the user who created the vulnerability    |

**Linked library writeup**

| Metatag                             | Description                                                   |
| ----------------------------------- | ------------------------------------------------------------- |
| `{vuln.library_id}`                 | Writeup ID                                                    |
| `{vuln.library_created}`            | Writeup created date (DAY MONTH DATE YEAR)                    |
| `{vuln.library_modified}`           | Writeup modified date (DAY MONTH DATE YEAR)                   |
| `{vuln.library_code}`               | Writeup code                                                  |
| `{vuln.library_tags}`               | Writeup tags, as a bulleted list                              |
| `{vuln.library_import_source}`      | Import source                                                 |
| `{vuln.library_import_source_id}`   | Import source ID                                              |
| `{vuln.library_custom_tag_[name]}`  | A writeup custom tag. Replace `[name]` with the tag's name.   |
| `{vuln.library_custom_field_[key]}` | A writeup custom field. Replace `[key]` with the field's key. |

**Affected asset**

| Metatag                           | Description                                                          |
| --------------------------------- | -------------------------------------------------------------------- |
| `{vuln.asset}`                    | Asset name                                                           |
| `{vuln.asset_id}`                 | Asset library ID                                                     |
| `{vuln.asset_created}`            | Asset library created date (DAY MONTH DATE YEAR)                     |
| `{vuln.asset_modified}`           | Asset library modified date (DAY MONTH DATE YEAR)                    |
| `{vuln.asset_external_id}`        | Asset library external ID                                            |
| `{vuln.asset_type}`               | Asset library type                                                   |
| `{vuln.asset_details}`            | Asset library details                                                |
| `{vuln.asset_custom_field_[key]}` | An asset library custom field. Replace `[key]` with the field's key. |

**All affected assets.** Loop: `{vuln.assets}...{/vuln.assets}`. Use these tags inside the loop:

| Metatag                                 | Description                                                          |
| --------------------------------------- | -------------------------------------------------------------------- |
| `{vuln.asset.name}`                     | Asset name                                                           |
| `{vuln.asset.id}`                       | Asset library ID                                                     |
| `{vuln.asset.created}`                  | Asset library created date                                           |
| `{vuln.asset.modified}`                 | Asset library modified date                                          |
| `{vuln.asset.asset_external_id}`        | Asset library external ID                                            |
| `{vuln.asset.asset_type}`               | Asset library type                                                   |
| `{vuln.asset.asset_details}`            | Asset library details                                                |
| `{vuln.asset.asset_custom_field_[key]}` | An asset library custom field. Replace `[key]` with the field's key. |

**Linked projects.** Loop: `{projects}...{/projects}`. Use these tags inside the loop:

| Metatag                             | Description                                                   |
| ----------------------------------- | ------------------------------------------------------------- |
| `{vuln.project_id}`                 | Project ID                                                    |
| `{vuln.project_created}`            | Project created date (DAY MONTH DATE YEAR)                    |
| `{vuln.project_modified}`           | Project modified date (DAY MONTH DATE YEAR)                   |
| `{vuln.project_name}`               | Project name                                                  |
| `{vuln.project_code}`               | Project code                                                  |
| `{vuln.project_start_date}`         | Project start date                                            |
| `{vuln.project_end_date}`           | Project end date                                              |
| `{vuln.project_vuln_link}`          | A "View" link to the vulnerability in the project             |
| `{vuln.project_link}`               | A "View" link to the project dashboard                        |
| `{vuln.project_custom_tag_[name]}`  | A project custom tag. Replace `[name]` with the tag's name.   |
| `{vuln.project_custom_field_[key]}` | A project custom field. Replace `[key]` with the field's key. |

**Project metatags**

Loop: `{projects}...{/projects}`

| Metatag                        | Description                                           |
| ------------------------------ | ----------------------------------------------------- |
| `{project.id}`                 | Project ID                                            |
| `{project.created}`            | When the project was created                          |
| `{project.modified}`           | When the project was last modified                    |
| `{project.name}`               | Project name                                          |
| `{project.code}`               | Project code                                          |
| `{project.start_date}`         | Start date                                            |
| `{project.end_date}`           | End date                                              |
| `{project.organization_code}`  | Organisation code                                     |
| `{project.on_hold}`            | Yes or No                                             |
| `{project.vulnerability_code}` | Vulnerability code                                    |
| `{project.custom_tag_[name]}`  | A custom tag. Replace `[name]` with the tag's name.   |
| `{project.custom_field_[key]}` | A custom field. Replace `[key]` with the field's key. |
| `{project.user.id}`            | ID of the user who created the project                |
| `{project.user.first_name}`    | First name of the user who created the project        |
| `{project.user.last_name}`     | Last name of the user who created the project         |
| `{project.link}`               | Link to the project                                   |

**Project totals**

| Metatag                                              | Number of                           |
| ---------------------------------------------------- | ----------------------------------- |
| `{project.total_vulnerabilities}`                    | Vulnerabilities                     |
| `{project.total_zero_day_vulnerabilities}`           | Zero-day vulnerabilities            |
| `{project.total_easily_exploitable_vulnerabilities}` | Easily exploitable vulnerabilities  |
| `{project.total_owasp_top_10_vulnerabilities}`       | OWASP Top 10 vulnerabilities        |
| `{project.total_cwe_top_25_vulnerabilities}`         | CWE Top 25 vulnerabilities          |
| `{project.total_critical_vulnerabilities}`           | Critical vulnerabilities            |
| `{project.total_high_vulnerabilities}`               | High vulnerabilities                |
| `{project.total_medium_vulnerabilities}`             | Medium vulnerabilities              |
| `{project.total_low_vulnerabilities}`                | Low vulnerabilities                 |
| `{project.total_info_vulnerabilities}`               | Info vulnerabilities                |
| `{project.total_pending_vulnerabilities}`            | Pending vulnerabilities             |
| `{project.total_open_vulnerabilities}`               | Open vulnerabilities                |
| `{project.total_closed_vulnerabilities}`             | Closed vulnerabilities              |
| `{project.total_retest_vulnerabilities}`             | Vulnerabilities ready for retesting |
| `{project.total_retests_requested}`                  | Retests requested                   |
| `{project.total_retests_completed}`                  | Retests completed                   |
| `{project.total_assets}`                             | Assets                              |
| `{project.total_testcases}`                          | Test cases                          |
| `{project.total_not_tested_testcases}`               | Test cases not yet tested           |
| `{project.total_tested_testcases}`                   | Test cases tested                   |
| `{project.total_in_progress_testcases}`              | Test cases in progress              |
| `{project.total_not_applicable_testcases}`           | Test cases marked not applicable    |

Totals by priority and status follow the pattern `{project.total_<priority>_<status>_vulnerabilities}`, where `<priority>` is `critical`, `high`, `medium`, `low` or `info`, and `<status>` is `open`, `retest` or `closed`. For example, `{project.total_critical_open_vulnerabilities}` is the number of open Critical vulnerabilities, and `{project.total_high_retest_vulnerabilities}` is the number of High vulnerabilities ready for retesting.

**Project request metatags**

Loop: `{project_requests}...{/project_requests}`

| Metatag                                | Description                                           |
| -------------------------------------- | ----------------------------------------------------- |
| `{project_request.id}`                 | Project request ID                                    |
| `{project_request.created}`            | When the request was created                          |
| `{project_request.modified}`           | When the request was last modified                    |
| `{project_request.name}`               | Name                                                  |
| `{project_request.code}`               | Code                                                  |
| `{project_request.start_date}`         | Expected start date                                   |
| `{project_request.end_date}`           | Expected end date                                     |
| `{project_request.status}`             | Status                                                |
| `{project_request.organization_code}`  | Organisation code                                     |
| `{project_request.custom_field_[key]}` | A custom field. Replace `[key]` with the field's key. |
| `{project_request.user.id}`            | ID of the user who created the request                |
| `{project_request.user.first_name}`    | First name of the user who created the request        |
| `{project_request.user.last_name}`     | Last name of the user who created the request         |
| `{project_request.link}`               | Link to the project request                           |

**User metatags**

Loop: `{users}...{/users}`

| Metatag                       | Description                                              |
| ----------------------------- | -------------------------------------------------------- |
| `{user.id}`                   | User ID                                                  |
| `{user.created}`              | When the user was created                                |
| `{user.modified}`             | When the user was last updated                           |
| `{user.first_name}`           | First name                                               |
| `{user.last_name}`            | Last name                                                |
| `{user.username}`             | Username                                                 |
| `{user.email}`                | Email address                                            |
| `{user.last_logged_in}`       | When the user last logged in                             |
| `{user.status}`               | Active or Blocked                                        |
| `{user.role}`                 | client, consultant, librarymod, projectoperator or admin |
| `{user.failed_logins}`        | Number of failed logins                                  |
| `{user.mfa_enabled}`          | Yes or No                                                |
| `{user.last_active_on_app}`   | When the user was last active in the app                 |
| `{user.last_active_on_ssapi}` | When the user was last active on the Self-Service API    |
| `{user.account_expiry}`       | When the account expires                                 |

Inside the `{users}` loop, `{user.first_name}` is the listed user's name. Outside it, `{user.firstName}` is the recipient's name.

**Writeup metatags**

Loop: `{writeups}...{/writeups}`

| Metatag                                | Description                                           |
| -------------------------------------- | ----------------------------------------------------- |
| `{writeup.id}`                         | Writeup ID                                            |
| `{writeup.created}`                    | When the writeup was created                          |
| `{writeup.modified}`                   | When the writeup was last updated                     |
| `{writeup.title}`                      | Title                                                 |
| `{writeup.reference_id}`               | 15-digit reference ID                                 |
| `{writeup.description}`                | Description                                           |
| `{writeup.attack_scenario}`            | Attack scenario                                       |
| `{writeup.remediation_recommendation}` | Remediation recommendation                            |
| `{writeup.likelihood_of_exploitation}` | 1 to 10                                               |
| `{writeup.severity}`                   | 1 to 10                                               |
| `{writeup.custom_library_key}`         | Custom library key                                    |
| `{writeup.imported_library}`           | Yes or No: whether it's in the Imported library       |
| `{writeup.project_library}`            | Yes or No: whether it's in the Project library        |
| `{writeup.tags}`                       | Tags, as a bulleted list                              |
| `{writeup.custom_tag_[name]}`          | A custom tag. Replace `[name]` with the tag's name.   |
| `{writeup.custom_field_[key]}`         | A custom field. Replace `[key]` with the field's key. |

### Examples <a href="#examples" id="examples"></a>

#### **Example: vulnerabilities that will breach their SLA in 7 days**

This email tells clients, administrators and the compliance team about the open vulnerabilities they can access whose SLA will be breached in exactly 7 days.

* **Type:** Vulnerabilities
* **Recipients:** Project Team – Clients; Project Group Members – Clients; Administrators; Compliance Team (group)
* **Subject:** `Vulnerability SLA Breaches In 7-days`

**Filter:**

```
{
    $and: [
        {
            status: { $eq: 'Open' }
        },
        {
            sla: { $lte: datetime('now', '+7 days') }
        },
        {
            sla: { $gte: datetime('now', '+6 days') }
        }
    ]
}
```

**Body:**

```html
<p style="text-align: center; font-size: 20px;"><b>Vulnerability SLA Breaches In 7-days</b></p>
<p>Hi {user.firstName},</p>
<p>The following vulnerabilities will breach their SLAs in 7-days.</p>
<p>Please ensure you have reached out to the security team to schedule a retest, or discuss remediation plan.</p>
<p>
<table style="border: 1px solid;">
<tr>
<th style="width: 35%; text-align: center; border: 1px solid; background-color: #0a1f33; color: white;">Vulnerability</th>
<th style="width: 10%; text-align: center; border: 1px solid; background-color: #0a1f33; color: white;">Priority</th>
<th style="width: 15%; text-align: center; border: 1px solid; background-color: #0a1f33; color: white;">SLA</th>
<th style="width: 40%; text-align: center; border: 1px solid; background-color: #0a1f33; color: white;">Projects</th>
</tr>
{vulnerabilities}
<tr style="vertical-align: text-top;">
<td style="border: 1px solid;">{vuln.title}</td>
<td style="border: 1px solid; text-align: center;">{vuln.priority}</td>
<td style="border: 1px solid;">{vuln.sla_date}</td>
<td style="border: 1px solid;">{projects}{vuln.project_name} - {vuln.project_vuln_link}<br/>{/projects}</td>
</tr>
{/vulnerabilities}
</table>
</p>
```

<figure><img src="https://372186556-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M8s1QY2Q6YTHB4a6DMu%2Fuploads%2F3V1EKUIKu5L1LlldMyCu%2FScreenshot%202026-11-01%20at%2011.33.12%E2%80%AFam.png?alt=media&amp;token=5659d61f-a068-4d1f-8a27-6a42dfb779a7" alt=""><figcaption></figcaption></figure>

**More filter examples**

Open Critical or High vulnerabilities whose SLA was breached two to three days ago, for escalation:

```
{
    $and: [
        {
            status: { $eq: 'Open' }
        },
        {
            $or: [
                {
                    priority: { $eq: 'Critical' }
                },
                {
                    priority: { $eq: 'High' }
                }
            ]
        },
        {
            sla: { $lte: datetime('now', '-2 days') }
        },
        {
            sla: { $gte: datetime('now', '-3 days') }
        }
    ]
}
```

Open Critical or High vulnerabilities with a target remediation date six to seven days away, as a reminder:

```
{
    $and: [
        {
            status: { $eq: 'Open' }
        },
        {
            $or: [
                {
                    priority: { $eq: 'Critical' }
                },
                {
                    priority: { $eq: 'High' }
                }
            ]
        },
        {
            target_remediation_date: { $lte: datetime('now', '+7 days') }
        },
        {
            target_remediation_date: { $gte: datetime('now', '+6 days') }
        }
    ]
}
```

### Colour-code priorities with dynamic CSS styles <a href="#colour-code-priorities-with-dynamic-css-styles" id="colour-code-priorities-with-dynamic-css-styles"></a>

Colour-coding makes it easy to spot the most serious vulnerabilities in an email.

1. In the email header template, define a CSS class for each priority: `critical`, `high`, `medium`, `low` and `info`.
2. In the email body, use the `{vuln.priority}` tag as the class of a table cell. Each cell then takes the colour of its vulnerability's priority.

Step 1, in the email header template:

{% code overflow="wrap" %}

```html
<style type="text/css">.critical{ background-color: maroon; }.high{ background-color: red; }.medium{ background-color: yellow; }.low{ background-color: blue; }.info{ background-color: green; }</style>
```

{% endcode %}

Step 2, in the email body:

{% code overflow="wrap" %}

```html
<td class="{vuln.priority}" style="border: 1px solid; text-align: center;">{vuln.priority}</td>
```

{% endcode %}

### Format dates and times <a href="#format-dates-and-times" id="format-dates-and-times"></a>

Add the `dateFormat` filter to an email metatag to format a date or time the way you need, for example `{now | dateFormat:["dd-mmm-yyyy"]}`. See [Template filters: dateFormat](https://support.attackforge.com/attackforge-enterprise/modules/reporting/template-filters#dateformat).

### List the users in user and group custom fields <a href="#list-the-users-in-user-and-group-custom-fields" id="list-the-users-in-user-and-group-custom-fields"></a>

A user or group custom field can hold several users or groups, such as the asset owners for a project. To list them in an email, loop over the field:

```
{<PROPERTY>.custom_field_<KEY>.each}
  {first_name} {last_name} ({email_address})
{/<PROPERTY>.custom_field_<KEY>.each}
```

* `<PROPERTY>` is the object the custom field belongs to, such as the vulnerability or project.
* `<KEY>` is the custom field's key.
* Inside the loop, use `{id}`, `{first_name}`, `{last_name}` and `{email_address}` for each user or group.

## Brand your emails with a header and footer <a href="#brand-your-emails-with-a-header-and-footer" id="brand-your-emails-with-a-header-and-footer"></a>

A header and footer wrap every email in your branding, so all notifications look consistent and professional. Put `{content}` where the email's content should go. You can manage your global email header and footer in **Administration > Notifications > Templates > Header and Footer**

* **Basic configuration:** a simple HTML wrapper, with a dark band at the top, a white content area containing `{content}`, and a dark footer with a system-generated email notice and the copyright year, using `{now | dateFormat}`.
* **Advanced configuration:** a full responsive HTML email template, with meta tags, Google Fonts, dark-mode colours, styled tables and buttons, and Outlook (MSO) conditional styling.

**Basic configuration:**

```html
<html>
  <body>
    <style type="text/css">
      .critical { background-color: maroon; color: #FFFFFF}
      .high { background-color: red; color: #FFFFFF}
      .medium { background-color: yellow; color: #FFFFFF}
      .low { background-color: blue; color: #FFFFFF}
      .info { background-color: green; color: #FFFFFF}
    </style>
    <table style='width:900px; background:#0a1f33; display:block;'>
      <tr>
        <td style='padding-top:30px;'>
        </td>
      </tr>
    </table>
    <table style="width:900px; background:#fff; color:#222222; font-family:Helvetica,Arial,sans-serif; text-align:left; font-size:14px; padding-top:10px; padding-left:10px; padding-bottom:10px;">
      <tr>
        <td>
          <p>
            {content}
          </p>
        </td>
      </tr>
    </table>
    <table style='width:900px; background:#0a1f33; display:block;'>
      <tr>
        <td style='padding-top:10px; padding-left:10px; padding-bottom:10px; color:#fff;'>
          <p style='font-size:12px;'>
            <i>This is a system generated email and reply is not required.</i>
          </p>
          <p style='font-size:14px; padding-top:10px;'>
            2018-{now | dateFormat:["yyyy"]} AttackForge&reg; Enterprise
          </p>
        </td>
      </tr>
    </table>
  </body>
</html>
```

**Advanced configuration:**&#x20;

```html
<!doctype html>
<html lang="en" xmlns:v="urn:schemas-microsoft-com:vml" style="color-scheme: light dark">
  <head>
    <meta charset="utf-8">
    <meta name="x-apple-disable-message-reformatting">
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <meta name="format-detection" content="telephone=no, date=no, address=no, email=no, url=no">
    <meta name="color-scheme" content="light dark">
    <meta name="supported-color-schemes" content="light dark">
    <link rel="preconnect" href="https://fonts.googleapis.com">
    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
    <link href="https://fonts.googleapis.com/css2?family=Nunito+Sans:wght@400;700&display=swap" rel="stylesheet" media="screen">
    <style>
      .body-sub {
        margin-top: 25px;
        border-top-width: 1px;
        padding-top: 25px;
        border-top-color: #eaeaec;
        border-top-style: solid;
      }
      body, .email-body, .email-body_inner, .email-content, .email-wrapper, .email-masthead, .email-footer {
        background-color: #1e293b !important;
        color: #fff !important;
      }
      p, ul, ol, blockquote, h1, h2, h3 {
        color: #fff !important;
      }
      .sm-w-full {
        width: 100% !important;
      }
      h1 {
        margin-top: 0; 
        text-align: left; 
        font-size: 24px; 
        font-weight: 700; 
        color: #333333
      }
      p {
        margin-bottom: 5px; 
        margin-top: 6px; 
        font-size: 16px; 
        line-height: 24px; 
        color: #51545e
      }
      .styled-table {
        width: 600px;
        border-collapse: collapse;
      }
      .styled-table th {
        border-collapse: collapse;
        border: 1px solid white;
      }
      .styled-table td {
        border-collapse: collapse;
        border: 1px solid white;
        padding-left: 20px;
      }
      .styled-button {
        border: none;
        border-collapse: collapse;
      }
      .styled-button td {
        border: 1px solid;
        border-radius: 5px;
        border-color: transparent;
        background-color: #469cf0 !important;
        padding: 15px 30px;
      }
      .styled-button a {
        background-color: #469cf0 !important;
        display: inline-block;
        font-size: 17px;
        color: #ffffff;
        text-decoration: none;
        font-family: sans-serif;
      }
    </style>
    <!--[if mso]>
      <style>
        .styled-button td {
          border: 1px solid;
          border-radius: 5px;
          border-color: #469cf0;
          background-color: #469cf0 !important;
          mso-padding-alt: 15px 30px;
        }
      </style>
    <![endif]-->
  </head>
  <body style="margin: 0; width: 100%; background-color: #f2f4f6; padding: 0; -webkit-font-smoothing: antialiased; word-break: break-word">
    <div role="article" aria-roledescription="email" aria-label lang="en">
      <table
        class="email-wrapper" style="width: 100%; background-color: #1e293b; font-family: &quot;Inter&quot;, ui-sans-serif, system-ui, -apple-system, &quot;Segoe UI&quot;, sans-serif;"
        cellpadding="0"
        cellspacing="0"
        role="none"
      >
        <tr>
          <td align="center">
            <table class="email-content" style="width: 100%" cellpadding="0" cellspacing="0" role="none">
              <tr>
                <td align="center" class="email-masthead" style="display: flex; justify-content: center; gap: 8px; padding-top: 25px; padding-bottom: 25px; text-align: center; font-size: 16px">
                  <img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAlgAAABnCAYAAADc1TyNAAAEDmlDQ1BrQ0dDb2xvclNwYWNlR2VuZXJpY1JHQgAAOI2NVV1oHFUUPpu5syskzoPUpqaSDv41lLRsUtGE2uj+ZbNt3CyTbLRBkMns3Z1pJjPj/KRpKT4UQRDBqOCT4P9bwSchaqvtiy2itFCiBIMo+ND6R6HSFwnruTOzu5O4a73L3PnmnO9+595z7t4LkLgsW5beJQIsGq4t5dPis8fmxMQ6dMF90A190C0rjpUqlSYBG+PCv9rt7yDG3tf2t/f/Z+uuUEcBiN2F2Kw4yiLiZQD+FcWyXYAEQfvICddi+AnEO2ycIOISw7UAVxieD/Cyz5mRMohfRSwoqoz+xNuIB+cj9loEB3Pw2448NaitKSLLRck2q5pOI9O9g/t/tkXda8Tbg0+PszB9FN8DuPaXKnKW4YcQn1Xk3HSIry5ps8UQ/2W5aQnxIwBdu7yFcgrxPsRjVXu8HOh0qao30cArp9SZZxDfg3h1wTzKxu5E/LUxX5wKdX5SnAzmDx4A4OIqLbB69yMesE1pKojLjVdoNsfyiPi45hZmAn3uLWdpOtfQOaVmikEs7ovj8hFWpz7EV6mel0L9Xy23FMYlPYZenAx0yDB1/PX6dledmQjikjkXCxqMJS9WtfFCyH9XtSekEF+2dH+P4tzITduTygGfv58a5VCTH5PtXD7EFZiNyUDBhHnsFTBgE0SQIA9pfFtgo6cKGuhooeilaKH41eDs38Ip+f4At1Rq/sjr6NEwQqb/I/DQqsLvaFUjvAx+eWirddAJZnAj1DFJL0mSg/gcIpPkMBkhoyCSJ8lTZIxk0TpKDjXHliJzZPO50dR5ASNSnzeLvIvod0HG/mdkmOC0z8VKnzcQ2M/Yz2vKldduXjp9bleLu0ZWn7vWc+l0JGcaai10yNrUnXLP/8Jf59ewX+c3Wgz+B34Df+vbVrc16zTMVgp9um9bxEfzPU5kPqUtVWxhs6OiWTVW+gIfywB9uXi7CGcGW/zk98k/kmvJ95IfJn/j3uQ+4c5zn3Kfcd+AyF3gLnJfcl9xH3OfR2rUee80a+6vo7EK5mmXUdyfQlrYLTwoZIU9wsPCZEtP6BWGhAlhL3p2N6sTjRdduwbHsG9kq32sgBepc+xurLPW4T9URpYGJ3ym4+8zA05u44QjST8ZIoVtu3qE7fWmdn5LPdqvgcZz8Ww8BWJ8X3w0PhQ/wnCDGd+LvlHs8dRy6bLLDuKMaZ20tZrqisPJ5ONiCq8yKhYM5cCgKOu66Lsc0aYOtZdo5QCwezI4wm9J/v0X23mlZXOfBjj8Jzv3WrY5D+CsA9D7aMs2gGfjve8ArD6mePZSeCfEYt8CONWDw8FXTxrPqx/r9Vt4biXeANh8vV7/+/16ffMD1N8AuKD/A/8leAvFY9bLAAAAOGVYSWZNTQAqAAAACAABh2kABAAAAAEAAAAaAAAAAAACoAIABAAAAAEAAAJYoAMABAAAAAEAAABnAAAAAOLtLv4AADQ/SURBVHgB7Z0HvBXF9cfvAykC9oqiYgNjj738Y9eoqAkW1GgUC2JDjGKsMcbYS2woYAmKLfZeExVr7CViF0GsKFZEEIX7//6e78pl3+zu7N699Z3z+fze3p05c+bMb2d3z8zO7svlaljy+XwXsE4SF9GfH6yWpIzpGgPGgDFgDBgDxoAx0CYYIEjaBjwPbkrSYPR7ga/AhaBHkrKmawwYA8aAMWAMGAPGQEMyQFC0CrgRzASSK5M0FP2eYIoKIh+Bw0HXJDZM1xgwBowBY8AYMAaMgYZggCBoUXAW+BYUy7AkDaTgYuDLYgP8fhH0TWLHdI0BY8AYMAaMAWPAGKhbBgh8OoODwHjgkrOSNA4DWoP1icsQaXeCtZLYM11jwBgwBowBY8AYMAbqigGCnW3B0yBKjknSKAxpYfy7EQa/J0/rs5ZIYtd0jQFjwBgwBowBY8AYqGkGCG5WAzcBH9kvSWMw2AS0OD5OPkbhCGDrs5IQbLrGgDFgDBgDxoAxUFsMEMxondU5YDLwlT5JW4Hh+3yNo/cS2DFpHaZvDBgDxoAxYAwYA8ZAVRkggNE6q0PA+yCJzEB5zaTOU+ayJJW06N7Fdu2kdZm+MWAMGAPGgDFgDBgDFWeAoKUPeLYliEm6+ZoCiyd1mjLHJ62oRX8q26FgyaR1mr4xYAwYA8aAMWAMGANlZ4AgZXVwCyhF3qJwp6TOUqZfKZVSVm8hDgHdktZt+saAMWAMGAPGgDFgDGTOAEFJd3Au+A6UKvencZBK1wB6vFiqvIyBndL4YGWMAWPAGDAGjAFjwBgomQECkTnBoWACyErOSeMYlS8AJmblBHbuAeum8cXKGAPGgDFgDBgDxoAxkIoBgo/twXMga9kjjUM4oU81PJWxM9OwdwlYKo1PVsYYMAaMAWPAGDAGjAEvBgg2fg1uBeWQ6RhdxcsRhxJltVi9HKL1WUeBuRzVWpIxYAwYA8aAMWAMGAPpGCC40P/7+wfIYp0VZpwyltQu6TzM5Si7p9NqdomvYGqXtP5ZOWPAGDAGjAFjwBgwBpoZIKDQv6E5DHwAyi03lEI7zvUG+uxCueVeKlivFF+trDFgDBgDxoAxYAy0UQYIInYAPv+CJquA5qBSqMaJDkBvAVZCtD5rGOhZis9W1hgwBowBY8AYMAbaCAMEDfrkwe2gkvIDla1UKsXYuKCSTlPXp+BoYOuzSj14Vt4YMAaMAWPAGGhEBggSFgfngymg0vICFc5RKq/Y2LrSjrfU9ypbfey0qdQ2WHljwBgwBowBY8AYaAAGCAq0zupw8CGolpyaBZU4Py+oZjvup/71s2iL2TAGjAFjwBgwBoyBOmWAYOD3QLNH1ZSfqHydrCjE1shqNoa69bhzBFg6qzaZHWPAGDAGjAFjwBioAwa4+a8J7gC1IC/iRIesaMPWtrXQKHzQl+WPAfNk1TazYwwYA8aAMWAMGAM1ygA3/APB96BW5JgsqaJRXcE7tdI4/HgGWJCV5UE2W8aAMWAMGAPGQI0x0A5/VgNz1ohf3+HHjVn60tTUNCVrmyX615vytcJ3iU2x4saAMWAMGAPGgDHgYkAB1o+ujCql3UdA9F4Z6r4am1PLYDeNyZ8olE9T0MoYA8aAMWAMGAPGQH0woACrVkRBx6XlcIag7U3s3lcO22bTGDAGjAFjwBgwBoyBIAMlf2sqaLCE/WcoO7qE8nFFL0ahL7BvU8UxZfnGQJ0xwLrGbrjcFejxuwaOGrBp1vo7BlhaemDShhigP+g6z6FvmtmGml1zTeU4KMboDAqTOXpiNo3j0iae4tRSgHUBpOvxWbnkUQw/AX5Trgrakl1OHL3puYhnm3/i2H7qqetUa7lgqr5a6rNOX8uYqJvFp6XeNOByYex09PTzc+r7wVO3Imr4Px8Vae3oumB1oE+gqG/oPyh0AoUAazq/v0H/Y7avgafBU7RHM9qpBXsLUlg3jTj5lrq+jVNy5VOH/tH9/K68kLT2pH/g6hvYUrCxKJBONWQ6fn1Wjopp20LYXRGsCnqBJYD6h/hrT/40tgqwJ4JxQP3gVfAuPql/lE2oW0H/vGWoYAY2p6TtW2Xwp9kk7dV1RcdhDaD/xLIU0LnSfCzYSsT51+h+yPYN8AJ4nra8zzYzwb5eJKvmf1SZTJu+acKRC3FkUGYtS2foFYqth0M6GcomtHV7jN9Ztgr8DH+B2kq0VSd83QpcHo3zx3s2YCp6m9FmXdxSCfXphqYb5DKpDDRGoUk0Yx141DaVwKNuQE8C3wv/cOr7c6rKMiyE3woItwC7gk2B2pFG1BefA9eDW2jb50mN4Mu/KLOtR7nTsH+Gh95sKtjXjeEOsNZsGeE7GnTcDPajvlZrarGnWb1nQE9QDXkav7bKqmLaoxu5+O8L1gEKHpOIBgxvgf8A8Sb/Mp9Rwc8DsX0WyFo0EaGg8RMwBjwGHqENE9hWVGijglkdi52BPqq9CEgq31JA56SOxe2049OkBoL6+HUiaUOC6RXc/wftOCmHIxeCasvulWg4jZwDPFblxk6i/jSdsBIUedWB//OA8Ql5HOplPESJujqDsQnrbDR19R2N2FML5U9KSMrn6HdPXWGJBam7I+gPyvEB5AnYPQEskMRN9O8EPnJSErvSxagGvVf6GC/SeYnfof2CPP13jnGgWvJUUh5c+ji/FDgTZPnfOWZg7xGwI9DMZ2aCvcGgUvIlFV0N1s6sARGGqGdhoHNnHMhSPsHYWUCzX6mF8qdl6VQKW80Dq0w7VEo2NLK6xbfs8kPz6y4/Ij98+WH5x3oNz98Hjuh5Xt5rNE5Eqcj/78Cey/sS7tbrR3LSE2B3OmkPtznv1LZ+3EpqP/xrtLmvN9s/Ky7Ipn/CMpmo4+/GGHoEjAR67JC1aBZM14P/UtduCYznPXV99YrNHc3O3sUJMb8/IL8f17a4mbiS+k6MD3HZJdXNsdHgSrOozwJtF4+rMEG+7oGbAN2D9K/N1mKblaQ5/mnr1rm9J3icNpwP5k5rKKocdjUA2B8dHQudOz1BlqLZyKOAvhc5BOiRfxqpJPcu/5rrr3aApRPvr1wcvJ6FLzc0v39Tx9zodnPkBja1Zy1V+9zW7J/bsXPuwV7D8r4n3X+os9qPCV0HpC7SWjr8wSmcnZ8y+6QoZ0WyY0AzxWkerQ3guJflgu1qGnV1AH8j7wGwgUsn47TlsXc9dY4E6qdVEer+PRWfnKDyyej+gevnOwnK1JUqnKyIw+oHZ4KFy+z8lth/hDqPBE1lrqtc5hWQDAYP0oZls6wEe7rHKhC9DCyVpW2HLT3lORs8QL0rO/JrPam5/+jZfTXlNi4OOnlipfcl+VVntstdwLtBnWf+MEs9/yMrWjvn1p45jbyfnwPPynT8oj6OV/4vZOlk6upQsaRoBrYme/VoldDc/eH+Io7B16EallEWBuC9M4YPSml8acrtDP6Zsrx3MfzUbPQVYEfvQtkp9sfUqviwJ330jezMxluiTi0O1o2rQ7x2s8YM/g7Ezyc89auppvVziQVOtqWQ+lzckgo9mXgXvAbeAR8BBZ+aRZgTKDBTsKFgrTeIGix0I/8csDL1Hwy/U/mdtXyFQa9JBUfFmhTRuax1elGyLpl304ZtaMP4KEWfPOysid61QPzFyUQU/gfGgPfAZ0B3bQUd8luDvBWA7iO9QNQs1cbkP0z96uu38btUIWIo+3co1U71yaq+kaUTQIFOvDCamDksd2rTHLkueUe3JLjKkbfj8pfk+7xzcNM9cQY5UGM4YBejp+lmE08G4EwdZ5CnukttSRJ3BSNcmZZWVgb6YL2UkeAhHP9rOHccZ2A2fmN/ASxphKyLarVkDSrWBf23tFU3ibILdS1EJdcAPY71lePx73pf5RA9BSXHheRllaxrRtzjy1Z1wUk/EkeCLq0yZyW8wU9xcDd4Az64E4QLNuXLUmBT8AewGQh7itOfPK01/SN2p/A7SxmAsdEpDaoNmhjoATYAOwEFUy5REHMtbVBf/s6l4JNG+Q3R03m5SIS+OLoL/AvoTd3YY45dDSYUsP0W6L6wNnCJzo+b0O+PXZ0naUVB3u/B+2kNeJbTMZok3WrOYF0IWTpBYqXXcEhpn9vOFVwVFVajTltsRP6Rjwc2fV+UHvbzbDJ0UHXCmfgxoBN6Ez/VUK2DOVGu5NgXzUOG6lpGBgzAt24ipQTG8kKBx1ZAN7PMBR9109DNsprBVaFd4/jxZWGnnFvarZvM5WCVBPUM4/zRI7NSZRJ2birVSNbl4WRrbI4EYcHVWPLOAP/Cf+/AAd08ZcYD2R5JPRuxPQFsCVzSl8TL0NuLsj+5FFKmfY29L1KWVTHdvBUkPIlv57FVkCU+eoKg6Jp9LDg+mOGzj331S/WRsOBqJnlXg7Np02tsvQV9zSaNEajnQrZbgCFAgW9QNOun416K6Pi/Sb3jSzGSpGxY9J7ERhpdEXWuT8GVLs53y+dzpzRPLkYUyNP923XMrdrtJ7/HIJCsTvq3CJOW1ZqBQ0lq3zo5UYoehWybqMQs5WoOCGZ5Ub1fadv/G1wWSpXDuBBqIFMO0Y0i7EZXjvrCbD5Kxg5cHz4MU8g4/VTVl8Dmvej+KYF+lGq1rv+hPtG/fkXmVSAsuLqSvA05PpcD7+CKMq2E8o+RqGBO17XJrRR+TtidjYKwLCUz3mmDvjF4A85tCp4LcVJvM64QkheaTJkFyLwOdA9RGke6zhXNLCUKroL2KP8juI90XQP2BsXn31T29dj+v2xLlbTX0FT1VrSyIg+1sF0Raaz82JQbROC04szpsao5BVmM1Y9e5oL8Te8N9vomyDVY3QdkcfOJd7CONVoufEluBFGtHYS9O+gDGv34ikYf41uU9dtX1McXB3EXNdn8CGhUlVYUfKquuCBUdX0MPHo1Wj9LExuNeme07CfZDEI5rv0+9nQRXxc87aPsq0Nf2AvdAb76AT1xORa8Ct4BnwI9KtJxnx/0BLppC3ODKHmYTL2RJ57LLrRb1x6N2H3lJRT3xr+GnP2Fjzlp32VgYQchulYcS9vPcuSlTmq5Bl1M3eo/mkFdzGHsOPIfR/chR15NJOHbeHzcGWceBT0DTml2+GBwWCA9bleTICuHKD1F+h6qNyQ/VXLL8RhFWxT8qi9sAQ4h/YFUBqtcSBehSosuYoq4Y6X3RfmlCZiGzPScnM1zChKMLcRt+0SM7x9XAQftRw7kseg9AjrE6bfx/ANpf9ioMik1G1FAU9dP+BbkWP3AseqDfpJAQTdfvfb7PNDi6ShRsLMdeBc0RSlG5GmtgEaRGvlFyY9kai3AGyBJXWqPz+Nv1H4WONMFUrxlIbpeHAoyC7Dwrwf2zkzh3JeU0Q1ReJn+MSXMBnWI46XA5uCPYGMQFI2ed8fON8GMcuzj0/9hV49FfI//h+juhn+TyuFPjdjUQGDDEF+G0HbNcpZFsK3vI+qcvAssEqhE94bzyN8AvZJmzQJ2M93FN33X7QiM3gKC/aoveSei87VPpehqML1XiK6u232xVba+iG0FjDtSzyb81jGpS0lys8qigRp5HQdhXiHTjPa5v7F4ff4kX62aqVtX+9xeyw5rXpgX6zO+PInS1bGKbViBjq5R3R4eFIj9f3voaYZHF9NEwrH6HjT/bznPrW66k4ECEx+Rbf0LiiR1/KJLBeWuS775tqXQXo1cOxd2IrYKDD+KyC9k/Z7+0Luwk8H2BGwoCE4io1DWF+0PBU+C0OBKRsUZGA+uYHdToJvHK6Ag9/BDwUulgqslqU9t6FZwIGarm7oekbwdo1e32fQpBcBHhzRA63XLFlwV6qQOnQP9gWuGcBXSDwC1LnfgoO5pQdFAZu1gomufY6GB9CkgGKRJ/V1QkUCf46F/N1O3wZXIqnSANRLCnlHFcbLcsPwm7drldm8OmOKUi/N1+2mf69Aunzt9zRHNC0iLc8N+/42MskXjYZXWUXp/fF3Aw98x6AwAn3nobs+JvKKHXqkqSfp4El2XX0nKJ9F11RWbBr9LoLRbrOLPCprJvc5Dtys6Az30YlVajn/YKNlVfiqJB3AN0WOysS6FuDTKKdjSRXtjcA1QcKWZq2/Zll1os/gbBZb2rGwGegfi36Oe+vWqpsdX8zucf4E09c2KCDzfT0Vnh1R2OMdvvpC8mkjG/5k4on7tknVciY60XUlTQBkUBZ4DqMNnIBYs2yb3y36RL2J1Ir8VFcfKSjfmO9JNTiNQmsN77qHIqr6N1dQh95tvf/KaddEIdwLF0zymKKq1MX9yQZmblu3v2ToF0O+je5OH/pzoHOShZyrpGdiXoj43hFfRGw00k+savZM8m+xJv0g66zSbgZYdHX/1Ax+ZhpICq8t8lON0sKPZKgV3O/J7cpx+hvnnY0vBna/osc61vsr1qNfSl1yBtp50HEX7Ez0Wz4CDM7HxusOOBiz9HOm1lvQUDulpQlB6BROC+xyLDqRp1tslIzgWo10ZluZmoJIBlv7xqVfk++OkXP+mjrn1FSilFuL4pqbcSSsM9f4/Y8Oo63+p62vcgrvQNJ/R9kT0bmih4XK2WtMUJ3/ghF48TsnykzMAr/NSSgGWj+iNrBlAgdZDHgUWQmdvD71QFfxbkEz1LV85Bv98AndfexpYaTbLp59624xSpM1HkO87WJGpS/HvtCibDZLXl3aoPwTlHtr/SDCx3PvUqUeyZ4TUsxfHUUscalk+wTnXWiudt3GyHgprOJT0VCKME4e6JYmBSgVYL1KX18iTtVMLsyT1L0nWXbkOZZ6J9aZOuaVYx/VnV34wjZNqCmnHg3wwr63ucyHpSNsP8Wz/9XDY/GiQ7cuUedijnB4J7OOhZyrJGdiNIkt6FNMx+1eR3vCi31E/9e9z5opSiMnbkvxFYnQK2ffy46LCTj1u4aoPfp+ewPf70R2cQL8uVeGlCcd3djiv6/BQR3qlkm6honccla1F2q8c6bWUpFnoaQ6HOjnSgkk7keCKC67kuq7AzSQBAy4iExT3UmUuqfn1Wq2fiBXWTh3Lm4A9FCCVKvq0A7NYhxC0rexp6x707vDUbQtqW9PIX3s0VCfzFQE93xu1/n3OPIGytlsCA/DZmeJh0/xBy78Exi0Z/2Y7Jqjk2F+WNF2M08r2ngV13dCLMbqO1KVwPFbE8X8CDVh85BWU9DjUdZP0KV9POkvg7NoOh/WI7nFHekWS4P57KirMyBfXqWO4eXFCDf5WIKVrQFAiH//TT/V4cLNgIfZVbpQj3ZJiGKhEgHUznfXBGD+as5e/NL86sfNAn29e+dhrnotqn+tK0HZqzuMDifipUZNmsb7zst/ASpxsGlkO8mzig3AXvCnrmOsiGSdLodAvTsnyEzGwLdqreJRoFRhzHFulRdg5tOWiHKHSOosyXUhdt3WOM0WPiRRw1KP8RFvnwvFrwcKeDfgYPb2l9Zmnfr2rrUkDxFFQ7oeDyIAgWKAM+3dj0zXU36gMdWVpUjPDWiIQlLgXuZahQK9gIfafBz7XckfRtp1U7gDrK+hVwBIvJ+Xb8aHQ05ras+g1w4d0zQve58htv9yw3PbxTmjGq0kd6R8+ug2usx7t28SzjcOCevComYfgrFZQrbCvf5/jM31d0LdtCAPwqHN6UEh2MPnfHKdXg4ns65Hh5470YJJujlsFEz32Nfu1pIeeVEZ56tWimmY7hoLVPZ3TwE4fb3zTU78R1NSHXDLalVjhNA0aP3DUqX8EXcvXK80IajYqKGODCYF9Pelxtesh+mSGd+VArZXdrWg7yh1g/Z0Do+9mxMryi+T6tpsjt01JC9vDa9FszKmrjmp+RTpca1bOOfx03XhmaTT+L92k5/Bo5kvoPByidz3pcaMmFdUNSI8jTUpnYENM/MbTTKvAWOU4Zz9lc6OnjTT/Pqc3tn36lvx40tOPWlQ7AKf28nRsJnoHw/1oT/1GUVvR0ZDvSav6jAnHQutyX3P41500zRLVquwa4phmoqIkbG3Z01GF6iyvHcFxUzlRzIfPRa5YP8nv0Shf7FOg9xX5uXgseIqPbhod/Qud9h1zK0+d3Lxg+6w4G5xYkzkAWmD6AHCNBOJM1HU+bV+BBvzOsxGXwZfzTSzSP8GW3vw6yMOWbtR3UUY3GpP0DCgwbu9RXC8iPBShpzdBBwDNwkTJZmSuA56JUgrkLRPYD9t9lf7wZVhmHaQvmsDHv9LWqxPoZ6Fa0dF80GHOdw18lwimsz8RKLiuBXkLJ/SCQrF0Y0fHdkJxYi38htMt8EMIimaknw0mBvaXDuxrdxrwmiRxlK21JF3LbgXlfPSs4O38wrlcrgDraxqhryw7b7xB1mdOzQ1u1zm3QmZrr4IVsK9/t9PULvfnpYfmbxh3aPO3mhxas5Lw/RGIOo+UP89KbTO/BtLSLh6t/QSdG2P0dKPeD8TdqDdGZ31QzzMWuF89ob+uRO3beXoQGhirPP3/ZexpZnLrGHu6hhwKkgRY3WNsFrLfKPxo8K3OkVOr0MaOHOOFy1ivAqhp9KVvQuqYk/T5HHmfUeZ7R3o1klyPCNWuBavhTFSdHMvFyL8IuO7rd8OpgqwocfUFDXDiykXZZPlz/hgUVotU8s98inaojWlET+xWTlMwYRkdh2ZxHYhCXilbfbPGNbXayuZyI/LL8nT3CN//N9jKgG8C8yJ8W2uBOWbmTqLIPp7FTkZPN/51PfXrXo2TQTe/PT0bci3H+YsY3ZfIHw22itHTrItu1BZgxRAVkX0QebppxYkC4xvilMgfDuICLJnR/znrRV94WzseMo+HjlQ+8tSrZ7XHcV6PBqsxm7QKdXtdp0sg+C7K7htSXoMuV3/VAL1W5KsQR7qFpFclmfOvNxVfA/T0ISiasfEJSuYOFmT/W1BqsPtbbGwCshD1GZ+2ZFFXWhszCgUV0WUtV2PwUl+jTT/mTub/Dc5X6nevfOrTv92hrj16XZL3WqPCRW8KdvcH9fyYwoeaYp292fEZnU1F74rigq7fLTcO3ah9ZAcuFL/yUTSd2RmAtx6k7D57aujedRyXuMBYhR8APjfgrugNVAFP6eCpp/Ov0UWPyHRzrIZogK1zvZyYN6Jh6ge6YQblp2BCFfcVnLhEA8K0Mj1twWA5zvtFwZGkPwbWCua37OsL7BroxonrvFT7fwkY4gyE5IdxGKIemZwZd5G1ZJSpEyxL0bqOwS031Vi7fJ9qMz7LsGvi/zcYazlEQWPEdrkOM2c0/5/CTV8YSHgXI7RlDB1YMysaHZQjII3xoHLZtFMjmAGeNd4LN2966t6Pnh73xAVPeix5IBgMTJIxoFlZfbg1TrwCYxnh+E6jT/yTn+fGGSVf/z7nbMp86qHrO1tTyk3Mw42aUOmJFzfD3VZwN6EmPMrWiag1lQqkXMFULR33TiF0uPwOUW2VvAHHu3OrVP8EzZ4tA9YBmixYBITJM2ScGJYZSHedlw19zwu0P6vdXwLVLAMsPafdi4tE2JTqbM4vd2G+E5Pip/Mh0PZ512GdTTu7Hb2l2K5DbsNvpje/3RM7A6OaadP1nBCaTj82O09q0tLOeKUTN050xHxnpcTfVPjTjfrsOMPk74HumZT52EPXVGAAvjRLsL8nGffBrYJdX7keRfV7zXJEidZv7AXOilJqyfN95LCAh61GUNEM1g0cxz4cm7Y0W67ZCAX8QXE9qgrqVGo/bAbuuxIcOK2EskmKataqH30qbA1c0JbrWOgRrmYZXXnB8mH7rlnKMN1ypmtCRdyXtKYsxkGtz3uyoJNVgKUpwH05kK8WDMduO+T2JdBZp5wL20N9YEzFgvcTl/tn/s53941d+Fcwo1HAcmCXQkIjbbm46yQ4xLNNz6P3qKduQe06fhwD4m6ayu8PdCKY+DHQD7UlPVQTBcayxzmd5E1Q/fucYZSZHOOLz+NJmVg6xk6tZ2uWw/caux66V8HfLvA3rdYblsC/qBkQ3bRdN/+F4aFzjfDQw9FWnUeTHOm1lHQbzmhtn8+McsFvV3CvlxDmAqUEWCdT/rJCJZ5bcazrWl9PfR81PerUyz0f+ShnoeN78sfVdThO3x2nVMjvNSK/YH5m7rgs/h1OwWaSrept1ym35IxpuT9R7jifsrRPX2XW47Pu4P98ytSZzlb46/onn65m6J/Qxj5eLS6I/sfwdzNpA4vTQ37rRj2UMlpgaRLBADzpEcbBESrFWS+wM7o4wfO3Lo77gY4x+hqA7AiuitHzvcCtSPva0Q8YEtWlaIZ8dbCup/fboXcxbR5QoTa/SX0HefqWRk2j+c/CCqqNtFV9QRwVy6LsaEZ0QnFilX5rdjEomr2aGEyskX1NcpwLRsGvgpQk4jovNYO3OAg9jnEV4MfoOB1XPn1jedKzDLBUjWbkKiZZBFj6fsvwJB6zBmrT5v83WMXlavo2FkOrnXqOzJ88fh+/ESPt/IaDvhttvQ+skqTNtaxLm3QhHOTp44fo3eKpG1TTjXpf0CGYEdjvyb5GL5cH0m23NQPbkLRa62RnSuLAuMXKy2wfAb91Wp098RD6kxbRRwXg781eJHRvBXJ6Al/9UENVyhhPvWeAx4FrJoTkVqLzQzdvr4Ffq9LJEr5Oe/NLVk2k9lvk9glodGN/RVDVAIt+3AUfVgr4pt1PQK0EWHp69AH4L9Cs1QMc0+/ZppG3HYXak6bry0uOvHInxd0nyl1/yfaJMUoSLWo9OakFHs8txtqrqorWfYH5un7l9b2nX3ylvYryFVW7OuMvenX2QyPszTx9vgYOvvLUDaq9SMLoYGLIvv59TtyMSUjRtpEMPzp/D/NsrQJjzSAmFo63RsIjPAuujd4WMbrvku/zyKEregog61U6wd14nN8dfJOgEcdybAcn0E+rWur1P229xeV0TXDJJq7ECqcpuFrKUecYjqsCm7SimcOnwTMxkE7YzNEX5GkQuipYDX+0/vk2kDa4wkzoP3nfVJkmyRko5QQ7l+qOTl4lgc3M3DhQVSHIY4EJo5Aeyf+xM514LKV/B96paiOyq/xQTPnMZuq1+X+mrRbedKP2ne38Nbpbp62rjZTbgHZu5NlWfbMsbWCsKu4Hb3jWFffvcyZgZ7ynrX0INup6JAvvT9BWPWKNmtUL0nEO7dZseaPLczRwmqOR29D+ag+w+uCXZnCC8ngwIeH+YfSJ9cF6MVgfu7oGumbLtFZVA/13sVFKUIWJX+R1frnq2pxjoUeFJgkZSBtgncVBHQJ0w0wsM9vnHuVtvreaqnjZ5HtYklGv9fP72nywkbT9TdK0ZsL3phM0URP7nDi9ceT3ns7oa8ClBpW6UYs7HxmEf1We6/Rxs2o6eqzrugEEHSopMJYxjrtmnHyD683R1UyWU7A1nYynnJmtE9ckaZfWyfWVQpv1WP3IBF7rCnUZ/V9cNrJosKp1Q0FZmYQNg4mV2of3OalrV0d9CpIfdqQnSfK+b9JvXsLwnkDncFA0Mzo8q2skdWlWTAFvUBYnYftgou3HM5AmwPoLB+LoeNPhGu8NbPqGu+YAZrEmtuvMxZtLScVAUMcC91x+Wu6mqdOa/9N9uKMxOfCgx4TbAFenjCldM9kD8aSrhzcz0RnuoRepAmcabY2MVJqVqanp9Wbt2q8CA1xUtUbF96J3T0tfLRRPu72OgroIx4mGTpoVjZJ7ojIDeafS3u6BtLrb5RhchNNnJnC8G7rX0fbVE5SpK1U44ZWj3B0Op3Vv8n387ShecpKeUKzgsKKA5zVHepKkRINGOPoPxg8E4iooA0g4NZhYwv7tIWU12NV5bZKAgZ/ncfwKTENNHxG91E89Wuvtg5seX2ZofqNcPncQvW1tFr6zXoG9Mkpzr26X+3zGjNyt87TPjXr7iMiFuF6ewMf7dDxNJV8JtvUqVCNK+L0ormh05CPPovSEj6KHzrXoKEiP+zCmZmcGgf8Ck9kZOIhdjbLjJJPAWJXQ1/Um6E381MU+TvTvc5anTNiM5yMY+BD0iDNEfk9wOfZ2wp6uQ5kJNnthTIu9w9a6ZFZXi6Hj2S4G/uhpeGH0bsLPLfFxvGeZelO7EYePBcGB3na0exPaPbqSDaLOLi3+uKrVGlRXoOPSzSyNOq/BL80kneEwqjV7n6NzniMvaZIGPpNA8Lt3a5OmPus7i42qiT5SeCGIE30LZ1ujK5wB+JkTDIsjkvxJYJFwS5XLwY+jPfwtqOydpWcYHVEwHLOdQr5rJOnlDmX1ryS+jKlD2fpq+fJeRkOUKK/v93wO4uQHFFYMMRObTNnFwRdxlbTkP802yUAqsn5srQmmt9iO25wdZYzC58YZCOQr0MhsLQi2dAP/FDwMNFvkJejeAXzkry6DFOwCHvQxUKTzLL8XcNmLS6Oc6htbZKvw85m4spXKxyHN1LnkeRKDgVdZ3aK+E1yOkKb74EK+laOrtYgu2dLXRlAPY2H3a31GyDdoD5qdbR87F7mcJk0DrKVmUy7jDnWd7PDjep8qKadZ76Dog9fL+ZTPSsfnEeFzVLYF0fG9WVXaiHbgZyrQrMJgMLXW20hHmwsfD/D08330wqaOPU20UruMlB9bpbZO0GjSZ8akdcnGTdmHpsXN/hVar/9D9lNhJ4Ot3voa7WlnL/pZ1GBiOHYme9qS2s5AgckGCcq0UtVFFmgmXn1a/m0KriCtI9uyC8dDj8k1c/xygso0g6BZDJ0PjSjn0KgfHA1bk7TTHellSYJf9YXjQoxfwrH7PCSvUslHUtHNjso026/1WNs48pImXUgB13mpx/Q6T3xmzpPW6dLPuxLrKS0uwLqCxmhq+rV6alQ1fYUrdc7twDvV9MOj7p3QWcZDTyr6aF2S18x9zL6A0qM+iujo3+fU/Rocz7ZGqsHDPCjsF6k0K3MCP2+dtVv6L/qBLnoKjHxEj7dCR9XY0jlyuY+hIh0FGppxGgnWB16zc+h1Br8BIyivQeMAoJtSQfrx4wLymwoJ5dzS9s+wvyvQMfKVrVHULHmx375la1oPPhS4jwxxUut/hoTkZZZMHStj7GrgCiDGkj40s8pSGoInDUr3B084TCj4VhC+niPPO6nlvAxr6+YY0ssXnbwNpleMi0/SW65USYhyTTnqMcc+lfKhEeuBv+5A/8MwKFV/RIhDHYCm3n1kMkq+gViiQ4ndnX0caNE5NpHxFmXKNtQjQtqjr9z7yt/TcBZXhsr1OPwNTyfeRq9bmE3yFgLjQBqZQaGXgB5p7As2A6uDlcFqLfsHsNUN4XXgI6eE+VpIx0hJjwgLdrTF1gbgKx/HinTOKrYR95tyNf+IsIWLRfB1XFE7i3/OZCdsZimOgth8bK8LxgGXqG59EiGRUCbzR4QFB7DdA4SdgxPI+1VBN82W8vOAMSBMbiXD+3FpUh+wrc90qB1BqatHhK41WPfRopIOTlIyG1kfLvcDWudRkFoIsPoUnPHYnl+u40PduvC/6eGDVN4Dcyf1hTINE2DRlk5AAYWPaL1E2Wb9sH2UjxMtOntFHTd0tgNaQ5KFKOj6EZRi7/AYfzMLsFQPvvYFWpeXRPSoyEswWhcBlhqDr7qxTo8g4mryMu3X2FNwHrVOM2w2J5J/bJYtwGrhalXqKL63sPuLKDhaPNLBmEzKa4b4u18stv6hOraIMZMoG3vzgzNBWB9wPR5tVQfla2INljp0YUGbFvAdDBpu+rkV+xVOgNNlwQ1A8i2IWpdSVu+ouwncD3xEJ1dJC7/jGoP9o30cadHZN85eMJ9yjRRg/S4BV663jYL0pN7Hj8WA70L7Z9DtEFUZ+X8BtSIKzvYGzseFpGcaYIkXbOram0Tko9ZxxQp6dRNgqTH4e2QMEePJPwgkHnAVk0V5BRB3gij5N5mp1r1RrqwBVgtX+ghoWBD0JHnzFbc56W/K7w00aAkTDWZGgTWT2i7Wp/y8QLPNb4EwUV2Rg7WCTfTCAqySgs6Cfd/tHCjqme514ASevY7zLWh6/gzAq57f78pBv4mtFsFXM4hdh/r1HN1H9P2kd3wUS9C5lrJHA58LwSFwqNekp5dQX10Wpd1aj6BPVviIFlGHrWfxKR+rwzHQDJlGkz4vSmjdlPrc/RGG9WhOA49DInQqlaXzU6+8PwQ+rESl8HkJfC5GXcd71icfR1BGr+c/4FmmLtRoj94u1UscYY8ElyLvEvAn9G5kezd4lXJT2IYKugqYlwAbg93AliAq8H+K/D2wq/OpJgXfHqJdA3HuKqA+USwbsKPgpx96U4szfH9T7irKz4v+P4BrTZRiiD8C3d9Gs70VPAbGUXYa21BBX9f8VcH2QI9glwFh8gMZB2NzVJiCR7r42Z16J7J1Dp48bCRSETmn4fSkRKVMORUD8HwzB/ceCmf5VldSXw6lgI57nOj7SSPilErNh5MP4eQW7OzvYWsNdLYCuqC2NVmfBm/i2WgFxm956paidhmF9wFRNynZ18XsMBAaYOEv3aD5/+/pRjAEVFN0PRwAPq6wEydS3+Kgv2e9hUXNW8OfXhppGKE9x9MfvqNBp4B2IQ1bnnQFpArExqH/Btt3gI6b3oLLg45gQdAT6HMvvYFeFImTB1HYEz+q/dZgnJ/6Pt21tF395kyH8nakDSN/P/RmOPJjkyh3AeW/QfEi0C2kgHjeqgUKhsZR5l22E4A4LARb6rPdwbKgF5DfcaKA6AD8uDNOMSZf16mzY3QyzZ4Dp3UxqZpwEPQ2wtxAnV4RrX7PBeYEyksrChB0UHWS6mT7ugXqKJNpt06+igv1phpJZOEoXOuCpJGCjzyH0mM+ihnoXIaN/sAn8NO0uwKIqhy/DNqa1sShFNQILE7Ey4g4pYzydVN/FGzhYW8LjttaHLfnw3TJ0w1Aa7t0k9TNQiPnSsszVDgQX16pdMXUqcXUB1OvbkC/9axfwYO+D6a3vcd6lqkLNdpzOu3STfp8sFiE0wrgl2lBhJpXls4fvQl+LPVX7Vrt5WmREr6eBVcKVjSQCcreJCjIOSqY4buP/Suxr/NSM4erxpTTfVvBrFCq6PqimavXSzVUjfI+N7RM/OLgdMZQD6CodUUg8pcGOnEWAIqMpaOTpRyiWSNN9SrA+gx/PmCrDqNRj/AeB/Ezto0sA2lcV88GXgof4qwSUgjmNvOobFN01gVPe+g2hAp99Vc0ZAfPxohLXZTKLvQPXGv+7IFPgKXRo4LE/nGOYfdS7CrQOR1sE6efUf632NGN/Gzq16CsKkLdU2m7Hrlotk8ztj6i6+iNlNNMlm6kDSO0R8GjAvlTwG6gXPcHcfYq0FKZUmdKZKsaMoRKdT/d2VH5EHicRNvOdOR5JVFWa7o2RlmBmgYC5RwAqR+fAy6k3sLsF7smzQxwILqCtcFg8C/wBpgCalUUdD0Bzge7gJ6NdChpT3egNxh9RK/HlvPkaUUt9fXzcaxF5/pWBkIS0Nci9689bGsBpWb4Ugvl9SV3n4XfWqCsQYaXoFt4EYWfsbKfl9GMlPCmC4hamFrssM5/DbC8BF1FcDuCx0C5RC+dXAGSHI+7PJ05yauhDiXsLwfGedZTUNN6nFbnLWk6RnoLNyjPOqqu2SSc1yzoPWB6sCEl7uvepPuUnpxkJi02Xa7pUVpZhMrmBlHny4AsKqaO3kD3Sr0cl6VMxNh5QIOG1EL507J0Kq2tTGewcEJT2xuBrcH/AU3btgP1IAvhpLAh0EL0ybTnf2z/Ax4ALxJJ/8C2XkWPBvWI6UuPBlxOW7/20MtS5R6M6fGR+kycbMixWRYffR6J6FHxF0CPn6JExzZOJ6q88gp1xelNR8GrLtq5CLq6IPsct4/RuxVUTDgG3+PjcCo8waNSXQv6Ac1GxAq29bjmVuzfzlbXFc1gbAl8+ghqoaKZ2TFAdq+nnrdDNd0ZmgX3OR6aMU8l+PQu7VZ7NZjwWTOketYGB4IztBOQqewH/VFa3Qic6Fr8H3hZk636ke4zK4COIKnoXHkc3AQewHY5Zi3Fr6uf6Pwvi9AODRh2x/gdIBikaPbvb+SPRe/hUhyg/FuUPxxb6ms6DjuAdYAeUyYV3Ws0S3kbuB3bHyU14NCfQpqLe4dq+ZJKnm6FYD3e0yMCTUtuAhYEjSa60L8G7ga3gufpBEqrG+E4zY+zvheiL2jfj5VuHD7qRjKnR726UX+Fj7E3CGxKV31S2yjR8dQUulfg4zKUsC5xrBt9pGCzEwo6xxS8xck0bFY6MNZr9Rqo+Z73P+HjpLiGhOVTl2YZVgHrg18DzTouCgp9R77oWOt4it9pQAGRbqhvAM3a/BeMwY9UfRwf5qV8ZxAn31HHd3FKUfkJ6iqY+YE6vyrsaIsNXeeXAB20XyTqL1nczIpMVu4n7dL1rBdQP1gVLAvUF3R8Ctc6nc+62arPvQ9eBy8CHX8NvMom+NcF43M7KviSussWZKk+6u7KRudKUHRuqI9k3nbq1D1GAa/OTx2XJYGuC/JDg3uJzrnC+aiBzSsC/nzANjPBl24YE6oqqQMsGqBo9Y/gd0Anb1sRXbS1PuQacBsdY2Jbabi10xioRQa4FukmJuiCqsBHN1edp5qVnAy+4TzVRd2kDTBAf9Dx1w1d9zcNTKZz/H0GKKiaZM0Ax0PHoTDAncmxqKvJiVL4SBRgQZQuXtuBA8CmQKPFtiyf0PgbgB6paYbLxBgwBowBY8AYMAaMAb83MgisNNW5KxgENB1rMjsDmoK+FVxEoPXc7Fm2ZwwYA8aAMWAMGANtjYHIGSwCK63/0GLCIWDVtkZOivbqkcSN4BwCLS2QNzEGjAFjwBgwBoyBNshAaIBFcLUwfFwHNm+DvJTaZK3/GEyQdUmphqy8MWAMGAPGgDFgDNQfA1FrqL6kOScBvYXTB5j4MTAJtQvBbX7qpmUMGAPGgDFgDBgDjcZA6AxWcUOZzdqR/b+A1YvT7fdsDOj101HgdGauxs6WYzvGgDFgDBgDxoAx0KYY8AqwxAhBlr6rMRBoPVZ3YDKLgX/z82QCqydmJdkvY8AYMAaMAWPAGGirDHgHWAWCCLT0zas/g/2Az0chC0Ubcfs6jToF3EBwZd9ZacQjbG0yBowBY8AYMAZSMJA4wCrUQaC1Fr9PBNsX0trQ9nPaeh64hMDKPmDYhg68NdUYMAaMAWPAGPBhIHWAVTBOoNWX31qf1Ra+j6V/b3AVOIPA6j22JsaAMWAMGAPGgDFgDJSHAa3PAn8CH4FGlQdo2AblYdCsGgPGgDFgDBgDxoAxEMIAAUgPcAH4HjSKjKEhu4GSZ/tCaLNkY8AYMAaMAWPAGDAG4hkgGFkT3AHqWSbi/DFA/0TWxBgwBowBY8AYMAaMgdpggODkd+AFUE8yDWeHg6Vrg0XzwhgwBowBY8AYMAaMgQADBCpdwGDwIah1uR8H1w80wXaNAWPAGDAGjAFjwBioTQYIXBYH54MpoNbkfzjUD9g6q9rsPuaVMWAMGAPGgDFgDEQxQBCzBrgd1IJ8ihNHg7mifLY8Y8AYMAaMAWPAGDAG6oIBgpodwPOgGqJ1VsNAz7ogy5w0BowBY8AYMAaMAWPAlwECnDnBIPABqJTcS0Xr+fpoesaAMWAMGAPGgDFgDNQlAwQ8i4F/gO9AueQVDO8CbJ1VXfYSc9oYMAaMAWPAGDAGUjFA8PNrcCvIUj7B2FHA1lmlOipWyBgwBowBY8AYMAYaggGCoe3As6AUmUrhi8GSDUGKNcIYMAaMAWPAGDAGjIFSGSAw0vqsQ8EEkFTuocC6pfpg5Y0BY8AYMAaMAWPAGGhIBgiUuoNzgc/6rJfR26khibBGGQPGgDFgDBgDxoAxkDUDBE6rg1uASz4m8UjQLet6zZ4xYAwYA8aAMWAMGAMNzwBBVB/wDJB8D4aCJRq+4dZAY8AYMAaMAWPAGDAGyskAAVVnoC+wb1zOesy2MWAMGAPGgDFgDBgDaRj4fwiA0POb8QTHAAAAAElFTkSuQmCC" alt="AttackForge Logo" style="width: 200px">
                </td>
              </tr>
              <tr>
                <td class="email-body" style="width: 100%; background-color: #fff">
                  <table align="center" class="email-body_inner sm-w-full" style="margin-left: auto; margin-right: auto; width: 800px; background-color: #fff" cellpadding="0" cellspacing="0" role="none">
                    <tr>
                      <td style="padding: 45px">
                        {content}
                      </td>
                    </tr>
                  </table>
                </td>
              </tr>
              <tr>
                <td>
                  <table align="center" class="email-footer sm-w-full" style="margin-left: auto; margin-right: auto; width: 570px; text-align: center" cellpadding="0" cellspacing="0" role="none">
                    <tr>
                      <td align="center" style="padding: 45px; font-size: 16px">
                        <p style="margin-bottom: 20px; margin-top: 6px; text-align: center; font-size: 12px; line-height: 24px; color: #fff">
                          This is a system generated email and reply is not monitored.
                          <br>
                          For any queries please reach out to
                          <span style="text-decoration-line: underline">support@attackforge.com</span>
                        </p>
                        <p style="margin-bottom: 20px; margin-top: 6px; text-align: center; font-size: 12px; line-height: 24px; color: #fff">&copy; 2018-{now | dateFormat:["yyyy"]} AttackForge&reg;</p>
                      </td>
                    </tr>
                  </table>
                </td>
              </tr>
            </table>
          </td>
        </tr>
      </table>
    </div>
  </body>
</html>
```

## Send custom emails with the REST API, Actions and Flows <a href="#send-custom-emails-with-the-rest-api-actions-and-flows" id="send-custom-emails-with-the-rest-api-actions-and-flows"></a>

The built-in emails cover the most common needs. When you need an email the built-in options can't send, such as one triggered by an event in another system, or one with content you build yourself, use the **sendEmail** REST API method. You can call it from your own scripts, or automate it with **Flows** and **Actions**.

### The sendEmail method <a href="#the-sendemail-method" id="the-sendemail-method"></a>

`POST https://HOSTNAME/api/ss/email` sends a custom email. Authenticate with your Self-Service API key in the `X-SSAPI-KEY` header.

| Field     | Type   | What it's for                                                           |
| --------- | ------ | ----------------------------------------------------------------------- |
| `to`      | array  | Recipients. Each one is an email address, or an object with a `user_id` |
| `cc`      | array  | Copy recipients, in the same format as `to`                             |
| `bcc`     | array  | Blind copy recipients, in the same format as `to`                       |
| `subject` | string | The subject line                                                        |
| `text`    | string | The body, as plain text                                                 |
| `html`    | string | The body, as HTML                                                       |

```
curl --request POST \
  --url 'https://HOSTNAME/api/ss/email' \
  --header 'X-SSAPI-KEY: YOUR_API_KEY' \
  --header 'content-type: application/json' \
  --data '{
  "to": ["support@attackforge.com", {"user_id": "6698cbabba716055c969a658"}],
  "subject": "EMAIL SUBJECT",
  "text": "EMAIL BODY",
  "html": "<p><b>EMAIL BODY</b></p>"
}'
```

Things to know:

* A `user_id` is sent to that user's email address. If it doesn't match an active user, it's dropped without an error.
* A response of `{"status": "Accepted"}` means the email is queued. It doesn't confirm delivery, and a later delivery failure isn't reported back.
* sendEmail is in the **Administration** group of the API. You must first be granted access to this API method to be able to use it.

See [sendEmail](https://docs.attackforge.com/resources/docs/ssapi/rest/methods/sendEmail) for full details.

## Automate emails with Flows <a href="#automate-emails-with-flows" id="automate-emails-with-flows"></a>

A **Flow** can call sendEmail as one of its steps, so emails are sent automatically. Store the API key as a secret in the Flow. A Flow can start from:

* **an event**, such as a vulnerability being created or updated
* **a schedule**, such as every Monday morning
* **an HTTP request** from another system, such as a ticketing tool
* **an Action** that someone runs in AttackForge

For example:

* when a Critical vulnerability is created, email the asset owners named in a user custom field, as well as posting to Slack or Microsoft Teams
* when a Jira ticket for a vulnerability is closed, email the tester to say it's ready for retesting

See [Flows](https://support.attackforge.com/app/modules/flows).

## Put a button on it with Actions <a href="#put-a-button-on-it-with-actions" id="put-a-button-on-it-with-actions"></a>

An **Action** adds a button to an Actions menu in AttackForge. Clicking it runs one or more Flows. Actions can run on projects, vulnerabilities, project requests, test cases, portfolios, assets, writeups, users, groups, or across the whole application. A form on the Action can collect extra details from the user, which the Flow can read.

Use an Action when an email should be sent on demand, but with content or recipients the built-in emails don't support. For example:

* **Email a remediation pack:** on selected vulnerabilities, send each asset owner a summary of their findings and the remediation advice
* **Send a testing-complete notice:** on a project, ask for a short message in a form, then email the client contacts using your template

Administrators create **System Actions** and roll them out to roles, groups or users. Any user can create **User Actions** for themselves and share them. Actions need the Flows module to be enabled. See [Actions](https://support.attackforge.com/app/actions).

## Which option should I use? <a href="#which-option-should-i-use" id="which-option-should-i-use"></a>

| Need                                                                | Use                                        |
| ------------------------------------------------------------------- | ------------------------------------------ |
| A standard email about testing progress or new findings             | Built-in daily or new vulnerability emails |
| A one-off message to the project team                               | Custom one-off email                       |
| A regular reminder or report based on a filter                      | Custom time-based email                    |
| An email triggered by an event or another system                    | A Flow calling sendEmail                   |
| An email someone sends on demand, with custom content or recipients | An Action that runs a Flow                 |
| Emails from your own scripts or tools                               | The sendEmail REST API                     |

## Custom email meta tags <a href="#custom-email-meta-tags" id="custom-email-meta-tags"></a>

Meta tags insert live details, such as the project name, a vulnerability's priority or a link, into the subject or body of an email. They make system emails clear and specific, without anyone having to type the details.

Administrators can customise the subject and body of each system email under **Administration > Notifications**. Each email is configured separately, and supports HTML and the meta tags below. Custom one-off emails (4.17) support them too.

### Emails that support meta tags <a href="#emails-that-support-meta-tags" id="emails-that-support-meta-tags"></a>

Each email has a number. The "Works in" column of the tag tables uses these numbers.

| #    | Email                                                                                  |
| ---- | -------------------------------------------------------------------------------------- |
|      | **Project requests**                                                                   |
| 1.1  | Email Project Request Owner when request is created                                    |
| 1.2  | Email Project Request Owner when request is approved                                   |
| 1.3  | Email Project Request Owner when request is rejected                                   |
| 1.4  | Email Project Request Owner when information is requested                              |
| 1.5  | Email when new Project Request is created                                              |
| 1.6  | Email when Project Request is updated                                                  |
|      | **Groups**                                                                             |
| 2.1  | Email User when invited to Group                                                       |
| 2.2  | Email Group Member when project is added                                               |
|      | **Users**                                                                              |
| 3.1  | Email User when Password Reset is requested                                            |
| 3.2  | Email User on change of IP address from last login                                     |
| 3.3  | Email User on New Registration                                                         |
| 3.4  | Email New User with Welcome Message                                                    |
| 3.5  | Email Admins when New User is created                                                  |
| 3.6  | Email User on Invitation                                                               |
| 3.7  | Email User on Daily Project Update                                                     |
| 3.8  | Email User on Weekly Project Update                                                    |
|      | **Projects**                                                                           |
| 4.1  | Email User when invited to new project                                                 |
| 4.2  | Email Project Coordinator when new Project is created                                  |
| 4.3  | Email Project Team when Project is placed On Hold                                      |
| 4.4  | Email Project Team when Project is placed Off Hold                                     |
| 4.5  | Email Vulnerability Owner when Review Note is posted                                   |
| 4.6  | Email User when someone replies to their Vulnerability Review Note                     |
| 4.7  | Email Additional Team Members when Vulnerability Review Note is posted                 |
| 4.8  | Email Additional Team Members when someone replies to a Vulnerability Review Note      |
| 4.9  | Email Review Note Owner when someone replies to an Executive Summary Review Note       |
| 4.10 | Email Additional Team Members when an Executive Summary Review Note is posted          |
| 4.11 | Email Additional Team Members when someone replies to an Executive Summary Review Note |
| 4.12 | Email Project Team when Vulnerability Status is updated                                |
| 4.13 | Email Team Member when Project Role is updated                                         |
| 4.14 | Email Project Team when a Retest is completed                                          |
| 4.15 | Email Admins when a new Retest is requested                                            |
| 4.16 | Email Admins when a Retest is cancelled                                                |
| 4.17 | Email Project Team with one-time Custom Email                                          |

The tag tables use these shorthands for groups of emails:

* **All 1.x:** 1.1 to 1.6
* **All 4.x:** 4.1 to 4.17
* **Review notes:** 4.5 to 4.11
* **Vulnerability emails:** 4.5 to 4.12

### General tags <a href="#general-tags" id="general-tags"></a>

| Tag                                                            | Inserts                                                  | Works in                        |
| -------------------------------------------------------------- | -------------------------------------------------------- | ------------------------------- |
| `{tenant_url}`                                                 | Your AttackForge URL                                     | All emails                      |
| `{now}`                                                        | The current date and time                                | All emails                      |
| `{now \| dateFormat:["mm/dd/yyyy"]}`                           | Today's date, formatted. See dateFormat for all options. | All emails                      |
| `{now \| dateSubtract:[1, days] \| dateFormat:["mm/dd/yyyy"]}` | Yesterday's date, formatted                              | All emails                      |
| `{now \| dateAdd:[7, days] \| dateFormat:["mm/dd/yyyy"]}`      | The date in 7 days, formatted                            | All emails                      |
| `{recipient.first_name}`                                       | The recipient's first name                               | All emails                      |
| `{link}`                                                       | A link to the relevant item                              | All 1.x, 2.2, 3.1, 3.3, all 4.x |
| `{link.url}`                                                   | The URL on its own, for your own buttons and links       | All 1.x, 2.2, 3.1, 3.3, all 4.x |

### Colour tags <a href="#colour-tags" id="colour-tags"></a>

These insert the colours configured for each priority and status, so emails match the colours in AttackForge. Each has a light and a dark version. They work in all emails.

| Tag                                                      | Inserts                         |
| -------------------------------------------------------- | ------------------------------- |
| `{config.vulnerability.priority.<priority>.color_light}` | The light colour for a priority |
| `{config.vulnerability.priority.<priority>.color_dark}`  | The dark colour for a priority  |
| `{config.vulnerability.status.<status>.color_light}`     | The light colour for a status   |
| `{config.vulnerability.status.<status>.color_dark}`      | The dark colour for a status    |

`<priority>` is `critical`, `high`, `medium`, `low` or `info`. `<status>` is `open`, `retest` or `closed`. For example, `{config.vulnerability.priority.critical.color_light}`.

### Recipient and account tags <a href="#recipient-and-account-tags" id="recipient-and-account-tags"></a>

| Tag                                       | Inserts                               | Works in  |
| ----------------------------------------- | ------------------------------------- | --------- |
| `{recipient.project_role}`                | The recipient's role on the project   | 4.1, 4.13 |
| `{recipient.password_reset_link}`         | A password reset link                 | 3.1       |
| `{recipient.password_reset_link.url}`     | The password reset URL on its own     | 3.1       |
| `{recipient.account_activation_link}`     | An account activation link            | 3.3       |
| `{recipient.account_activation_link.url}` | The account activation URL on its own | 3.3       |
| `{invite_link}`                           | An invitation link                    | 3.6       |
| `{invite_link.url}`                       | The invitation URL on its own         | 3.6       |

### User and group tags <a href="#user-and-group-tags" id="user-and-group-tags"></a>

| Tag                            | Inserts                                       | Works in |
| ------------------------------ | --------------------------------------------- | -------- |
| `{user.first_name}`            | The user's first name                         | 3.5, 3.6 |
| `{user.last_name}`             | The user's last name                          | 3.5, 3.6 |
| `{user.username}`              | The user's username                           | 3.5      |
| `{user.email_address}`         | The user's email address                      | 3.5      |
| `{user.role}`                  | The user's role                               | 3.5      |
| `{user.ip_address}`            | The IP address the user logged in from        | 3.2      |
| `{user.created_by.first_name}` | First name of the person who created the user | 3.5      |
| `{user.created_by.last_name}`  | Last name of the person who created the user  | 3.5      |
| `{group.name}`                 | The group's name                              | 2.1      |

In 3.5 and 3.6, `{user.*}` is the new or invited user, and `{recipient.first_name}` is the person receiving the email.

### Daily and weekly project update tags (3.7, 3.8) <a href="#daily-and-weekly-project-update-tags-37-38" id="daily-and-weekly-project-update-tags-37-38"></a>

| Tag                                 | Number of                           |
| ----------------------------------- | ----------------------------------- |
| `{vulns_count}`                     | Vulnerabilities                     |
| `{critical_vulns_count}`            | Critical vulnerabilities            |
| `{high_vulns_count}`                | High vulnerabilities                |
| `{medium_vulns_count}`              | Medium vulnerabilities              |
| `{low_vulns_count}`                 | Low vulnerabilities                 |
| `{info_vulns_count}`                | Info vulnerabilities                |
| `{closed_vulns_count}`              | Closed vulnerabilities              |
| `{retest_vulns_count}`              | Vulnerabilities ready for retesting |
| `{project_requests_count}`          | Project requests                    |
| `{projects_in_progress_count}`      | Projects in progress                |
| `{projects_completed_count}`        | Completed projects                  |
| `{projects_overrun_count}`          | Overrun projects                    |
| `{projects_waiting_to_start_count}` | Projects waiting to start           |
| `{users_registered_count}`          | Registered users                    |

### Project request tags <a href="#project-request-tags" id="project-request-tags"></a>

| Tag                                               | Inserts                                               | Works in |
| ------------------------------------------------- | ----------------------------------------------------- | -------- |
| `{project_request.id}`                            | Project request ID                                    | All 1.x  |
| `{project_request.name}`                          | Name                                                  | All 1.x  |
| `{project_request.status}`                        | Status                                                | All 1.x  |
| `{project_request.created_datetime}`              | When the request was created                          | All 1.x  |
| `{project_request.last_updated_datetime}`         | When the request was last updated                     | All 1.x  |
| `{project_request.start_date}`                    | Requested start date                                  | All 1.x  |
| `{project_request.end_date}`                      | Requested end date                                    | All 1.x  |
| `{project_request.scope}`                         | Requested scope                                       | All 1.x  |
| `{project_request.groups}`                        | Groups                                                | All 1.x  |
| `{project_request.test_suites}`                   | Test suites                                           | All 1.x  |
| `{project_request.testing_hours}`                 | Testing hours                                         | All 1.x  |
| `{project_request.onsite_testing}`                | Whether onsite testing is needed                      | All 1.x  |
| `{project_request.justification}`                 | Justification                                         | All 1.x  |
| `{project_request.organization_code}`             | Organisation code                                     | All 1.x  |
| `{project_request.link}`                          | Link to the project request                           | All 1.x  |
| `{project_request.custom_field.<KEY>}`            | A custom field. Replace `<KEY>` with the field's key. | All 1.x  |
| `{project_request.requestor.first_name}`          | Requestor's first name                                | 1.5, 1.6 |
| `{project_request.requestor.last_name}`           | Requestor's last name                                 | 1.5, 1.6 |
| `{project_request.rejected.reason}`               | Why the request was rejected                          | 1.3      |
| `{project_request.requested_information.details}` | The information requested                             | 1.4      |

### Project tags <a href="#project-tags" id="project-tags"></a>

| Tag                               | Inserts                                               | Works in     |
| --------------------------------- | ----------------------------------------------------- | ------------ |
| `{project.id}`                    | Project ID                                            | 2.2, all 4.x |
| `{project.name}`                  | Project name                                          | 2.2, all 4.x |
| `{project.code}`                  | Project code                                          | 2.2, all 4.x |
| `{project.created_datetime}`      | When the project was created                          | 2.2, all 4.x |
| `{project.last_updated_datetime}` | When the project was last updated                     | 2.2, all 4.x |
| `{project.start_date}`            | Start date                                            | 2.2, all 4.x |
| `{project.end_date}`              | End date                                              | 2.2, all 4.x |
| `{project.organization_code}`     | Organisation code                                     | 2.2, all 4.x |
| `{project.link}`                  | Link to the project                                   | 2.2, all 4.x |
| `{project.custom_field.<KEY>}`    | A custom field. Replace `<KEY>` with the field's key. | 2.2, all 4.x |
| `{project.on_hold.status}`        | On-hold status                                        | 4.3          |
| `{project.on_hold.details}`       | Why the project was put on hold                       | 4.3          |
| `{project.off_hold.status}`       | Off-hold status                                       | 4.4          |
| `{project.off_hold.details}`      | Details of taking the project off hold                | 4.4          |

### Vulnerability tags (4.5 to 4.12) <a href="#vulnerability-tags-45-to-412" id="vulnerability-tags-45-to-412"></a>

| Tag                                          | Inserts                                               |
| -------------------------------------------- | ----------------------------------------------------- |
| `{vulnerability.id}`                         | Vulnerability ID                                      |
| `{vulnerability.code}`                       | Vulnerability code                                    |
| `{vulnerability.title}`                      | Title                                                 |
| `{vulnerability.priority}`                   | Priority                                              |
| `{vulnerability.status}`                     | Status                                                |
| `{vulnerability.created_datetime}`           | When the vulnerability was created                    |
| `{vulnerability.last_updated_datetime}`      | When the vulnerability was last updated               |
| `{vulnerability.discovered_by.first_name}`   | First name of the person who found it                 |
| `{vulnerability.discovered_by.last_name}`    | Last name of the person who found it                  |
| `{vulnerability.affected_assets}`            | Affected assets                                       |
| `{vulnerability.likelihood_of_exploitation}` | Likelihood of exploitation                            |
| `{vulnerability.zero_day}`                   | Whether it's a zero-day                               |
| `{vulnerability.description}`                | Description                                           |
| `{vulnerability.attack_scenario}`            | Attack scenario                                       |
| `{vulnerability.remediation_recommendation}` | Remediation recommendation                            |
| `{vulnerability.proof_of_concept}`           | Proof of concept                                      |
| `{vulnerability.notes}`                      | Notes                                                 |
| `{vulnerability.tags}`                       | Tags                                                  |
| `{vulnerability.sla_date}`                   | SLA date                                              |
| `{vulnerability.target_remediation_date}`    | Target remediation date                               |
| `{vulnerability.cvssv3.base_score}`          | CVSSv3 base score                                     |
| `{vulnerability.cvssv3.temporal_score}`      | CVSSv3 temporal score                                 |
| `{vulnerability.cvssv3.environmental_score}` | CVSSv3 environmental score                            |
| `{vulnerability.cvssv3.vector}`              | CVSSv3 vector                                         |
| `{vulnerability.custom_tag.<KEY>}`           | A custom tag. Replace `<KEY>` with the tag's key.     |
| `{vulnerability.custom_field.<KEY>}`         | A custom field. Replace `<KEY>` with the field's key. |
| `{vulnerability.link}`                       | Link to the vulnerability                             |

Two tags only work in 4.12 (vulnerability status updated): `{vulnerability.actioned_by.first_name}` and `{vulnerability.actioned_by.last_name}`, for the person who changed the status.

### Review note tags (4.5 to 4.11) <a href="#review-note-tags-45-to-411" id="review-note-tags-45-to-411"></a>

| Tag                                | Inserts                                     | Works in            |
| ---------------------------------- | ------------------------------------------- | ------------------- |
| `{review_note.creator.first_name}` | First name of the person who wrote the note | 4.5 to 4.11         |
| `{review_note.creator.last_name}`  | Last name of the person who wrote the note  | 4.5 to 4.11         |
| `{review_note.note}`               | The note                                    | 4.5 to 4.11         |
| `{review_note.topic}`              | The note's topic                            | 4.5 to 4.11         |
| `{review_note.original_note}`      | The note being replied to                   | 4.6, 4.8, 4.9, 4.11 |
| `{review_note.reply_note}`         | The reply                                   | 4.6, 4.8, 4.9, 4.11 |

### Retest tags <a href="#retest-tags" id="retest-tags"></a>

| Tag                                     | Inserts                                                       | Works in         |
| --------------------------------------- | ------------------------------------------------------------- | ---------------- |
| `{retest_round.date}`                   | Date of the retest round                                      | 4.14, 4.15, 4.16 |
| `{retest_round.vulnerabilities.total}`  | Number of vulnerabilities in the round                        | 4.14, 4.15, 4.16 |
| `{retest_round.requestor.first_name}`   | Requestor's first name                                        | 4.15             |
| `{retest_round.requestor.last_name}`    | Requestor's last name                                         | 4.15             |
| `{retest_round.actioned_by.first_name}` | First name of the person who completed or cancelled the round | 4.14, 4.16       |
| `{retest_round.actioned_by.last_name}`  | Last name of the person who completed or cancelled the round  | 4.14, 4.16       |

#### Example <a href="#example" id="example"></a>

A subject line for 4.12 *(example)*:

```
[{project.code}] {vulnerability.title} is now {vulnerability.status}
```

The daily started and stopped testing emails also support `{project.<tag>}`, and the new vulnerability emails support `{vulnerability.<tag>}`. In the one-email-for-all version, use them inside a `{vulnerabilities}...{/vulnerabilities}` loop.

## Tips <a href="#tips" id="tips"></a>

* **Agree the notification plan with the client at kick-off:** who gets daily emails, new vulnerability alerts and scheduled reminders.
* **Use the single summary email** when you release many findings at once, so recipients aren't flooded.
* **Test a time-based email on a small group first**, such as yourself, before sending it to clients.
* **Keep filters narrow.** An email that lists everything soon gets ignored.
* **Avoid Skip Access Check** unless every recipient may see all the data the filter returns.
* **Set up a header and footer once**, so every email is on brand.

## FAQ <a href="#faq" id="faq"></a>

**Why didn't I get an email for a new vulnerability?** Emails are only sent once a vulnerability is visible, and only to team members who've opted in. Check the vulnerability isn't Pending, and check your notification settings.

**Who can send daily started and stopped testing emails?** Project team members with Edit access.

**Can time-based emails go to people outside AttackForge?** Recipients are users, groups, roles or user and group custom fields. External email addresses can be added.

**Will a recipient see data they don't normally have access to?** No. Data is checked against each recipient's access before sending, unless Skip Access Check is turned on.

**How often can time-based emails be sent?** Daily or weekly, in an hourly window you choose.

**Can I use HTML in emails?** Yes. The body of time-based emails is HTML. One-off emails support limited HTML and CSS.

## Related pages <a href="#related-pages" id="related-pages"></a>

* [Creating and managing projects](https://support.attackforge.com/app/getting-started/creating-and-managing-projects)
* [Retesting](https://support.attackforge.com/app/getting-started/retesting)
* [Reviewing and QA vulnerabilities](https://support.attackforge.com/app/getting-started/reviewing-and-qa-vulnerabilities)
* [Reporting](https://support.attackforge.com/app/getting-started/reporting)
* [Flows](https://support.attackforge.com/app/modules/flows)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://support.attackforge.com/app/getting-started/notifications.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.