The NotifyMessage component sends event notifications from Security Orchestration, Automation, and Response (SOAR) playbooks via Alibaba Cloud Message Center or custom channels such as email and DingTalk.
Actions
| Action | Description | Use case |
|---|---|---|
notifyByMessageCenter | Sends notifications through Alibaba Cloud Message Center with message type "Security Message - Cloud Security Information Notification" | Notify recipients about security event generation, security alert generation, or security event updates using channels already configured in Message Center |
notifyByCustom | Sends custom messages directly via email or DingTalk | Send notifications to specific email addresses or DingTalk groups outside the Message Center configuration |
Output
Both actions return the following fields.
| Field | Type | Description |
|---|---|---|
message | String | Result message from the notification action |
status | Boolean | Whether the notification was sent successfully |
notifyByMessageCenter
Parameters
| Parameter | Description | Required |
|---|---|---|
aliuid | Alibaba Cloud account UID of the notification recipient | Yes |
eventId | The event ID that maps to a notification template. See Notification templates. | Yes |
channelTypeList | Notification channels. Valid values: sms, email, webhook, pmsg (internal message). Supports multiple selections. If left blank, all channels configured in Message Center > Message Receiving Management are used. If specified, the actual channels are the intersection of the values set here and the channels configured in Message Center > Message Receiving Management. For example, if this field is set to pmsg and email, and Message Center is configured for email and webhook, notifications are sent via email only. | No |
lang | Console language for the notification | No |
params | Variable values for the notification template. Set values according to the variables defined in the selected template. Supports constants or output parameters from preceding nodes, such as ${event._tenant_id}. | No |
Notification templates
The eventId parameter maps to one of three built-in notification templates. Each template contains variable placeholders that are replaced with actual values when the notification is sent.
| Template | eventId value |
|---|---|
| Security event generation | yundun_soar_incident_generate |
| Security alert generation | (see template list in console) |
| Security event update | (see template list in console) |
Set the params field with the variable values expected by your selected template. For example, for the security event generation template:
{
"incidentName": "Event generation test",
"incidentID": "xxx",
"startTime": "2025-02-03 00:00:00"
}notifyByCustom
Before using email sending with notifyByCustom, set up an SMTP resource instance. See Set up the resource instance.
Email parameters
| Parameter | Description | Required |
|---|---|---|
email | Sender email address. Must be configured in the resource instance first. | No |
receivers | Recipient email address | No |
emailTitle | Email subject | No |
emailcontext | Email body | No |
DingTalk parameters
| Parameter | Description | Required |
|---|---|---|
dingdingWebhooks | Webhook URL of the DingTalk group. Manage webhook URLs in Message Center. | No |
dingdingMsgType | Message format for the DingTalk notification | No |
dingdingcontext | Message body for DingTalk | No |
SMS and custom receiver parameters
| Parameter | Description | Required |
|---|---|---|
telephone | Recipient phone number for SMS notifications | No |
telephonecontext | SMS message body | No |
sms | SMS sender configuration | No |
smscontext | SMS message content | No |
customReceiver | Custom receiver configuration in JSON format | No |
jsonInput | Full notification payload in JSON format | No |
Set up the resource instance
Configure an SMTP resource instance before using the email parameter in notifyByCustom.
Email provider constraints
emailUsername supports only the following mailbox providers:
QQ mail
NetEase mail (163, 126)
Gmail
Alibaba Mail (Aliyun)
Only SMTP protocol is supported. Port 25 is blocked by Alibaba Cloud server security controls — use port 465.
Important
If your email provider requires authorization verification (such as an app password or authorization code), use that code as the emailPassword value. Authorization codes expire — replace the code before it expires, or email sending will fail with an authentication error.
Steps
In the visualization flow editor, click the NotifyMessage component node.
In the Basic Information Configuration tab, click Instance Configuration.
On the Resource Instance Configuration page, click Add.
Fill in the following fields:
Parameter Description Required assetnameA name for this resource instance. Choose a name that identifies the sender account. Yes emailSendServerSMTP server address in host:portformat. If left blank, the server is inferred from the email domain (for example,1*@aliyun.commaps tosmtp.aliyun.com:465). Port defaults to 465 if omitted.No emailUsernameSender email address Yes emailPasswordSender email password or authorization code Yes Save the configuration.
Configuration example
The following JSON file contains a test playbook that demonstrates both actions — notifyByMessageCenter followed by notifyByCustom. Import it into the visualization flow editor to explore the parameter configuration for each action interactively.
Save the example data as a .json file before importing. For the import procedure, see Playbook import.{
"cells": [
{
"position": {
"x": -660,
"y": -170
},
"size": {
"width": 36,
"height": 36
},
"attrs": {
"body": {
"fill": "white",
"strokeOpacity": 0.95,
"stroke": "black",
"strokeWidth": 2
},
"label": {
"text": "start",
"fontSize": 12,
"refX": 0.5,
"refY": "100%",
"refY2": 4,
"textAnchor": "middle",
"textVerticalAnchor": "top"
}
},
"visible": true,
"shape": "circle",
"id": "58d87b7d-28d9-4f0e-b135-4adc4f1a70e4",
"zIndex": 1,
"data": {
"nodeType": "startEvent",
"appType": "basic",
"nodeName": "start",
"icon": "icon-circle",
"description": "Playbook start node. A playbook must have one and only one start node, which requires input data configuration for the playbook."
},
"markup": [
{
"tagName": "circle",
"selector": "body"
},
{
"tagName": "text",
"selector": "label"
}
],
"isNode": true
},
{
"shape": "custom-edge",
"zIndex": 1,
"id": "5293c3f9-e1c9-4a49-b0eb-635067dc67e8",
"data": {
"nodeType": "sequenceFlow",
"appType": "basic",
"isRequired": true,
"icon": "icon-upper-right-arrow"
},
"isNode": false,
"source": {
"cell": "58d87b7d-28d9-4f0e-b135-4adc4f1a70e4"
},
"target": {
"cell": "88d3ff93-4f11-4d82-b43b-31dfd0530774"
},
"visible": true,
"router": {
"name": "manhattan",
"args": {
"padding": 5,
"excludeHiddenNodes": true,
"excludeNodes": [
"clone_node_id"
]
}
},
"vertices": [ ]
},
{
"position": {
"x": -70,
"y": -170
},
"size": {
"width": 36,
"height": 36
},
"attrs": {
"body": {
"fill": "white",
"strokeOpacity": 0.95,
"stroke": "black",
"strokeWidth": 2
},
"path": {
"r": 12,
"refX": "50%",
"refY": "50%",
"fill": "black",
"strokeOpacity": 0.95,
"stroke": "black",
"strokeWidth": 4
},
"label": {
"text": "end",
"fontSize": 12,
"refX": 0.5,
"refY": "100%",
"refY2": 4,
"textAnchor": "middle",
"textVerticalAnchor": "top"
}
},
"visible": true,
"shape": "circle",
"id": "317dd1be-2d20-460e-977e-1fc936ffb583",
"zIndex": 1,
"data": {
"nodeType": "endEvent",
"appType": "basic",
"nodeName": "end",
"icon": "icon-radio-off-full",
"description": "end"
},
"markup": [
{
"tagName": "circle",
"selector": "body"
},
{
"tagName": "circle",
"selector": "path"
},
{
"tagName": "text",
"selector": "label"
}
],
"isNode": true
},
{
"position": {
"x": -551,
"y": -185
},
"size": {
"width": 137,
"height": 66
},
"view": "react-shape-view",
"attrs": {
"label": {
"text": "NotifyMessage_1"
}
},
"shape": "activity",
"id": "88d3ff93-4f11-4d82-b43b-31dfd0530774",
"data": {
"componentName": "NotifyMessage",
"appType": "component",
"nodeType": "action",
"icon": "https://img.alicdn.com/tfs/TB1mO0AeAL0gK0jSZFAXXcA9pXa-200-200.svg",
"ownType": "sys",
"zIndex": 1,
"tenantId": "baba",
"customInput": false,
"description": "Notification function of Alibaba Cloud Message Center",
"id": 0,
"name": "notifyByMessageCenter",
"operateType": "general",
"output": [
{
"dataType": "String",
"name": "message",
"tags": ""
},
{
"dataType": "Boolean",
"name": "status",
"tags": ""
}
],
"parameters": [
{
"dataType": "String",
"defaultValue": "",
"description": "",
"enDescription": "",
"name": "aliuid",
"needCascader": false,
"required": true,
"tags": ""
},
{
"dataType": "String",
"defaultValue": "",
"description": "If not selected, all channels will be sent",
"enDescription": "",
"formConfig": "{\"component\":\"Select\",\"options\":{\"selectMode\":\"pureSelect\",\"remote\":false,\"optionList\":[{\"label\":\"SMS\",\"value\":\"sms\"},{\"label\":\"Email\",\"value\":\"email\"},{\"label\":\"webhook\",\"value\":\"webhook\"},{\"label\":\"Internal message\",\"value\":\"pmsg\"}],\"mode\":\"multiple\",\"labelKey\":\"label\",\"valueKey\":\"value\"}}",
"name": "channelTypeList",
"needCascader": false,
"required": false,
"tags": ""
},
{
"dataType": "String",
"defaultValue": "",
"description": "Message event ID",
"enDescription": "",
"name": "eventId",
"needCascader": false,
"required": true,
"tags": ""
},
{
"dataType": "String",
"defaultValue": "",
"description": "Parameter variables",
"enDescription": "",
"name": "params",
"needCascader": false,
"required": false,
"tags": ""
},
{
"dataType": "String",
"defaultValue": "",
"description": "Console language",
"enDescription": "",
"name": "lang",
"needCascader": false,
"required": false,
"tags": ""
}
],
"riskLevel": 2,
"nodeName": "NotifyMessage_1",
"actionName": "notifyByMessageCenter",
"actionDisplayName": "notifyByMessageCenter",
"cascaderValue": [ ],
"valueData": {
"lang": "zh",
"channelTypeList": [ ],
"eventId": "yundun_soar_incident_generate",
"aliuid": "1766xxxx",
"params": "{\"incidentName\":\"Event generation test\",\"incidentID\":\"xxx\",\"startTime\":\"2025-02-03 00:00:00\"}"
}
},
"zIndex": 1
},
{
"shape": "custom-edge",
"zIndex": 1,
"id": "6444c559-f58d-4d0c-8fdc-6988af2f766d",
"data": {
"nodeType": "sequenceFlow",
"appType": "basic",
"isRequired": true,
"icon": "icon-upper-right-arrow"
},
"isNode": false,
"visible": true,
"router": {
"name": "manhattan",
"args": {
"padding": 5,
"excludeHiddenNodes": true,
"excludeNodes": [
"clone_node_id"
]
}
},
"source": {
"cell": "88d3ff93-4f11-4d82-b43b-31dfd0530774"
},
"target": {
"cell": "6e34b2ec-3ac4-4f4c-8d0a-3cbebb00bd64"
},
"vertices": [ ]
},
{
"position": {
"x": -329,
"y": -185
},
"size": {
"width": 137,
"height": 66
},
"view": "react-shape-view",
"attrs": {
"label": {
"text": "NotifyMessage_2"
}
},
"shape": "activity",
"id": "6e34b2ec-3ac4-4f4c-8d0a-3cbebb00bd64",
"data": {
"componentName": "NotifyMessage",
"appType": "component",
"nodeType": "action",
"icon": "https://img.alicdn.com/tfs/TB1mO0AeAL0gK0jSZFAXXcA9pXa-200-200.svg",
"ownType": "sys",
"zIndex": 1,
"tenantId": "baba",
"customInput": true,
"description": "DingTalk, email notification function",
"id": 0,
"name": "notifyByCustom",
"operateType": "general",
"output": [
{
"dataType": "String",
"name": "message"
},
{
"dataType": "Boolean",
"name": "status"
}
],
"parameters": [
{
"dataType": "String",
"defaultValue": "",
"description": "",
"name": "emailTitle",
"needCascader": false,
"required": false
},
{
"dataType": "String",
"defaultValue": "",
"description": "",
"name": "receivers",
"needCascader": false,
"required": false
},
{
"dataType": "String",
"defaultValue": "",
"description": "",
"name": "telephone",
"needCascader": false,
"required": false
},
{
"dataType": "String",
"defaultValue": "",
"description": "",
"name": "telephonecontext",
"needCascader": false,
"required": false
},
{
"dataType": "String",
"defaultValue": "",
"description": "",
"name": "dingding",
"needCascader": false,
"required": false
},
{
"dataType": "String",
"defaultValue": "",
"description": "",
"name": "dingdingcontext",
"needCascader": false,
"required": false
},
{
"dataType": "String",
"defaultValue": "",
"description": "",
"name": "sms",
"needCascader": false,
"required": false
},
{
"dataType": "String",
"defaultValue": "",
"description": "",
"name": "smscontext",
"needCascader": false,
"required": false
},
{
"dataType": "String",
"defaultValue": "",
"description": "",
"name": "email",
"needCascader": false,
"required": false
},
{
"dataType": "String",
"defaultValue": "",
"description": "",
"name": "emailcontext",
"needCascader": false,
"required": false
},
{
"dataType": "String",
"defaultValue": "",
"description": "",
"name": "customReceiver",
"needCascader": false,
"required": false
},
{
"dataType": "String",
"defaultValue": "",
"description": "",
"name": "jsonInput",
"needCascader": false,
"required": false
},
{
"dataType": "String",
"defaultValue": "",
"description": "",
"name": "dingdingWebhooks",
"needCascader": false,
"required": false
},
{
"dataType": "String",
"defaultValue": "",
"description": "",
"name": "dingdingMsgType",
"needCascader": false,
"required": false
}
],
"riskLevel": 2,
"nodeName": "NotifyMessage_2",
"actionName": "notifyByCustom",
"actionDisplayName": "notifyByCustom",
"cascaderValue": [
{
"label": "NotifyMessage_1",
"value": "${NotifyMessage_1}",
"children": [ ]
}
],
"assetUuid": "acde2ae8-8b01-4bec-97c4-44ba6c9ba457",
"valueData": {
"email": 1,
"receivers": "[{\"userid\":-1,\"email\":\"xxx@163.com\"}]",
"emailTitle": "Custom notification test",
"emailcontext": "Custom notification test"
}
},
"zIndex": 1
},
{
"shape": "custom-edge",
"zIndex": 1,
"id": "5f2bddfd-ae71-423e-ac59-e4dde4a45238",
"data": {
"nodeType": "sequenceFlow",
"appType": "basic",
"isRequired": true,
"icon": "icon-upper-right-arrow"
},
"isNode": false,
"visible": true,
"router": {
"name": "manhattan",
"args": {
"padding": 5,
"excludeHiddenNodes": true,
"excludeNodes": [
"clone_node_id"
]
}
},
"source": {
"cell": "6e34b2ec-3ac4-4f4c-8d0a-3cbebb00bd64"
},
"target": {
"cell": "317dd1be-2d20-460e-977e-1fc936ffb583"
},
"vertices": [ ]
}
]
}