Hey @DonHouk ,
Thanks for posting here.
I would accomplish this by first creating a new rule to create a global variable that contains all of the email addresses, separated by a pipe (or any other character). For example, I would create global.to_addresses and set it to contain all addresses, like:
|[email protected]|[email protected]|[email protected]|
Then, in any subsequent step, you can check to see if global.to_addresses contains the address you care about, surrounded by pipes (example: |[email protected]|).
I like to include the pipe in this way to ensure it’s a full and complete match. For example, I don’t want [email protected] to match when searching for [email protected]. By including the pipes, |[email protected]| won’t match if searching for |[email protected]|.
Specifically, here are the steps I would create:
First, a new rule with a single action to render all addresses into a single variable:
Notes:
- Double-click
custom.to change it toglobal. - The contents of the Text to Render field is
|{{implode email.to glue="|" property_name="address"}}|(notice the pipes at the beginning and end, as well is in the “glue” field)
Second, add an expression to the rule you care about:
Notes:
- To get the long free-form entry field, hold
SHIFTwhile clicking the new stanza icon
) - Because this is using a regular expression, you must start and begin the expression with a slash
/, and then escape all special characters (pipes and periods) with a double-backslash. - Pro-tip: to have MSPintegrations create the escaped regular expression for you, temporarily add any other “contains” stanza and copy the regular expression from the bottom:
Usually, I would create a video to explain something like this, but I’m not able to do that today. Please let me know if this makes sense and if you have any trouble.