You need to add a new parameter in Send email action. That parameter specifies who you want to send to.
https://docs.microsoft.com/en-us/azure/sentinel/tutorial-respond-threats-playbook#run-a-playbook-on-demand

Explanation
To use the Fusion rule to detect multi-staged attacks that include suspicious sign-ins to contoso.com followed by anomalous Microsoft Office 365 activity, you should perform the following two actions:
Create an Azure AD Identity Protection connector. This will allow you to monitor suspicious activities in your Azure AD tenant and detect malicious sign-ins.
Create a custom rule based on the Office 365 connector templates. This will allow you to monitor and detect anomalous activities in the Microsoft 365 subscription.
Reference: https://docs.microsoft.com/en-us/azure/sentinel/fusion-rules

In Microsoft 365 Defender advanced hunting, if you want to automatically receive alerts based on a KQL query-such as detecting when a process disables System Restore-you must convert that query into a custom detection rule . According to Microsoft's official documentation, custom detection rules "run hunting queries on a schedule and create alerts and incidents when results are found." In order for the detection rule to function properly and correlate results across devices and incidents, the query must output DeviceId and ReportId . These fields are mandatory for any advanced hunting query that you want to convert into a detection rule be cause they uniquely identify the device and event instance. Without them, the rule cannot properly generate correlated alerts.
Therefore:
* Create a detection rule (A) - ensures the query runs automatically and alerts are generated.
* Add DeviceId and ReportId (E) - required for detection rule creation and accurate device/event correlation.
Other options are incorrect:
* Suppression rule (B) filters alerts, not generate them.
* Order by Timestamp (C) is optional for display, not alerting.
* DeviceNetworkEvents (D) is unrelated to this process query.