Email feed items deliver written communications from simulated stakeholders directly to participants' inboxes during a scenario, with configurable sender, subject, body, delivery timing, and optional attachments.
What email feed items are
Emails represent written communication between stakeholders during a crisis — internal teams, executives, customers, partners, or external parties. They can carry critical information, requests, or updates that participants need to interpret and act on. Done well, they introduce clarity, confusion, urgency, or escalation at exactly the right moment, and give participants practice at prioritizing decisions while managing a growing inbox under time pressure.
Configuring an email feed item
Add an email by selecting the Email item type from the Feed items panel. Once added, you'll see the default configuration fields:
From
This is the email address the message appears to come from. Use realistic addresses that indicate the sender's role or organization — participants should be able to make a quick judgment about credibility and relevance from the address alone. Good examples include soc@orchidcorp.com, ceo@orchidcorp.com, legal@orchidcorp.com, or vendor-support@thirdparty.com.
Subject
The subject line appears in the live feed and the email preview. Keep it short and purposeful — it should signal urgency or importance without giving everything away. Subjects like "URGENT: Suspicious VPN Login", "Customer Data Exposure – Initial Findings", or "Immediate Action Required" prompt participants to make a quick call about whether to open the email now or come back to it.
Content
The body of the email. Use it to deliver updates or findings, requests for decisions or action, and conflicting or incomplete information. Emails can intentionally introduce ambiguity, forcing participants to interpret what matters and what needs follow-up. Keep the tone realistic and appropriate to the sender's role.
The content field supports basic markdown formatting — lists, links, and inline code snippets — controlled through the editor.
The From address, Subject, and Content all appear in the inbox preview, so participants get a sense of the email before they open it.
Delivery timing
The Deliver after X seconds field sets how long after the scenario reaches this inject before the email appears. Set it to zero for immediate delivery, or add a delay to simulate how information arrives unevenly during real incidents. Staggered emails can model delays in internal communication, escalate pressure after a decision is missed, or introduce new information at a critical moment.
Attachments
You can attach files to an email to add depth and realism. Useful examples include logs or screenshots, draft statements or reports, and customer complaints or evidence. Attachments may contain additional clues that reward closer inspection.
PNG, JPG, and PDF files are supported, up to 5 MB each. You can add up to two attachments per email. They appear as clickable file names inside the email view.