WEBVTT

1
00:00:00.624 --> 00:00:10.016
Welcome to NxSAM training. This module covers Custom Email Templates, and the first thing to say is that the name undersells it.

2
00:00:10.636 --> 00:00:27.421
This is a reporting engine that happens to deliver by email. What makes it different from the Reports module is not the format - it is that one template produces many emails, each containing a different slice of the data, sent to a different person.

3
00:00:28.031 --> 00:00:43.567
That idea is worth sitting with, because it is the whole module. You do not build a report and decide who to send it to. You build one definition, choose what to group by, and the product produces one email per group.

4
00:00:44.169 --> 00:00:46.890
Here is the problem it solves.

5
00:00:47.152 --> 00:01:02.810
A security team has ten thousand open findings across two hundred applications, owned by forty different teams. Sending everyone the same report means nobody reads it, because ninety-nine percent of it is somebody else's problem.

6
00:01:03.409 --> 00:01:12.159
Sending forty tailored reports by hand means somebody spends a day a month on it, and it stops the first time that person is on leave.

7
00:01:12.722 --> 00:01:25.983
So you group by owner, and the product sends forty emails - each one containing only that owner's findings, addressed to that owner. Built once, sent every month, by nobody.

8
00:01:26.570 --> 00:01:38.051
The list screen shows your definitions with their name, data type, dispatch, status, trigger and when they were last updated. New Definition starts one.

9
00:01:38.650 --> 00:01:45.640
A definition is built across five tabs, and they follow the order you would think about the problem in.

10
00:01:46.270 --> 00:01:49.135
We will open one and go through them.

11
00:01:49.738 --> 00:01:57.813
Scope and Data is where you choose what population the email is about, and - the important part - what to group by.

12
00:01:58.401 --> 00:02:17.420
The population can be open findings, or closed ones from Network V A, Policy Compliance or Application Security. Closed sources matter more than people expect: a report showing what your teams fixed last month is a different conversation from one showing what they have not.

13
00:02:18.013 --> 00:02:37.417
Group by is the field that turns one template into many emails. It can be any standard dimension - severity, module, asset type, status, age band, S L A status, the tool that found it - or any asset property your organisation has defined.

14
00:02:38.010 --> 00:02:53.646
That second option is the powerful one. If you record a business owner, a tower lead or an owning team against your assets, you can group by it, and the product will produce one email per person in that field without you listing them.

15
00:02:54.270 --> 00:02:59.464
The Body tab builds what the email actually looks like, out of blocks.

16
00:03:00.040 --> 00:03:14.998
A block is one piece of content: a rich text passage you write, a summary table, a matrix table crossing two dimensions, a bar chart, a rendered chart image, or a data table listing the findings themselves.

17
00:03:15.568 --> 00:03:33.317
Each block carries a width - full, two thirds, a half, a third or a quarter - and that is the whole layout system. Anything narrower than full width sits beside its neighbour on a desktop and stacks cleanly on a phone, without you writing anything for either.

18
00:03:33.912 --> 00:03:50.454
Keeping it to a fixed set of widths rather than a free-form grid is deliberate. Email clients render layout inconsistently enough that a finer grid would look different in every inbox, and a report that arrives broken is worse than one that arrives plain.

19
00:03:51.075 --> 00:04:06.372
The blocks are ordered, and can be moved up and down or removed. Order matters more than it looks - a recipient reads the first block and decides whether to read the rest, so lead with the number that tells them whether they need to act.

20
00:04:06.966 --> 00:04:20.899
Your text blocks can carry tokens that fill themselves in - the group's name, totals from a data source, the reporting period. Which is how one written sentence becomes forty personalised ones.

21
00:04:21.491 --> 00:04:33.691
There is a display cap on the data table, deliberately. An email is not the place for four thousand rows; it names the top of the list and points at the attachment for the rest.

22
00:04:34.289 --> 00:04:37.251
Which brings us to the Attachment tab.

23
00:04:37.871 --> 00:04:55.641
An attachment can be a flat list of the findings in that group, or grouped - a spreadsheet organised by a dimension you choose, with a column for each severity and the labels you want on each column. A third mode splits it further again, one sheet per tool set.

24
00:04:56.276 --> 00:05:07.928
That grouped form is what most people actually want. A recipient opens it, sees their projects as sections with counts, and can act without filtering anything.

25
00:05:08.521 --> 00:05:25.739
One honest detail. A very large export is capped, because a spreadsheet has to be assembled in memory before it is sent. When a cap is reached the file says so, in a row inside the file itself - truncation is never silent.

26
00:05:26.337 --> 00:05:32.851
The Recipients and Dispatch tab is where the module differs most from anything else in the product.

27
00:05:33.475 --> 00:05:43.805
You do not type a list of addresses. You choose how recipients should be *worked out* for each group, and there are several ways.

28
00:05:44.402 --> 00:06:07.023
Asset owner resolves to whoever is named in a chosen property on that group's assets. Group owner resolves to the group value itself, when the thing you grouped by is a person. Asset access resolves to everyone who has access to those assets. And a static email list goes to fixed addresses regardless.

29
00:06:07.623 --> 00:06:20.232
Those combine across To and C C, which is how you get the pattern most organisations want: the email goes to the people who can fix it, copying the person accountable for that area.

30
00:06:20.832 --> 00:06:39.015
Two behaviours are worth knowing. A recipient appearing in both To and C C is kept once, in To. And a group that resolves to no recipients at all is skipped rather than sent to nobody - so a silent gap in your ownership data shows up as a missing email.

31
00:06:39.609 --> 00:06:44.127
The Schedule tab covers when it goes, and what it looks like.

32
00:06:44.751 --> 00:07:01.609
Alongside the schedule sits branding: your brand name, the frame colours, the chart series colours, and the overall width. Theme presets set all of them in one click, and the theme drives the frame, the tables, the bars and the accents together.

33
00:07:02.206 --> 00:07:13.976
The severity bar colours are deliberately not themed. They stay fixed whatever palette you choose, because that convention is worth more than consistency with your brand.

34
00:07:14.570 --> 00:07:19.933
Two things make this safe to work with, and both are worth using every time.

35
00:07:20.554 --> 00:07:35.493
Preview renders the real email, from the real data, for a real group, without saving or sending anything. Use it before every save - a layout that reads well in the builder can look quite different as an email.

36
00:07:36.103 --> 00:07:52.781
And a template can be exported to a file and imported elsewhere. That matters because the identifiers behind properties and clients differ between instances, so on import the product re-matches them by name and reports anything it could not resolve.

37
00:07:53.379 --> 00:08:04.525
An imported template always arrives as a draft, never active. So an import can never start sending email to anybody before somebody has looked at it.

38
00:08:05.155 --> 00:08:10.733
One more thing to know about this module, and it is about where the figures come from.

39
00:08:11.008 --> 00:08:37.829
Every email this module builds is assembled from the analytics warehouse rather than from the store that runs the application, which is what lets a template report over a long period without slowing the product down. There is no second source to choose between. If the warehouse cannot be reached the module disables itself and says so on this screen, rather than sending a report built on partial data.

40
00:08:38.426 --> 00:08:52.742
That is Custom Email Templates. One definition, grouped by whatever you choose, producing one email per group with its own body, its own attachment and its own recipients - worked out rather than listed.

41
00:08:53.015 --> 00:09:10.330
The habit that makes it work is to group by the field that identifies who can actually do something. Group by severity and you get five emails nobody owns. Group by owner and you get forty emails that each land on the person who can act on them.