Populate alert with filehash/filepath etc

I am new to FortiSOAR and need some help understanding how to achieve one of my use cases.

I am getting alerts from Microsoft Defender for Endpoint through Data Ingestion and all is well on that front. However, when an alert that indicates that a suspicious file has been observed I want to add the filename, filehash and so on to the alert with a playbook. This is where I struggle.

I need some pointers to know HOW to get the information from the Sourcedata to populate the alert itself. I have tried by looping through the objects array but I can't get it working.

I can provide screenshots and config if needed.

Thanks in advance

Alexander