Click the gear icon to the right of the workflow for which you want to customize the message.
For the Phishing workflow and Suspicious phishing workflow: In the Phishing alert body prefix format field, you can edit and add HTML tags and content for the message.
Malicious attachment workflow: Edit the content in the Quarantine notification subject and Quarantine notification body fields.