Use macros in incident workflows

Macros are supported by these incident workflow actions:

Macros only apply to alerts. This means that when you include a macro in an incident workflow action, that macro evaluates the alerts comprising the incident and not the incident itself when the workflow is triggered. For this reason, when you are creating an incident workflow, you must select alert fields as the target for macros. For example, if you want to get a list of unique services, you must use ${unique(service)}, which is the name of the alert field listing service names, and not services, which is the name of the incident field.

For details on the macros available in Moogsoft Cloud and how to use them, refer to Macro and substitution syntax reference.