Process Incident - Vectra Detect

This playbook is used to initiate the processing of an incident. This playbook runs when a pending incident is selected for investigation. It will change the state from pending to active and it will list the available users in Vectra and request the user ID to use for assignment. Once the data collection is complete, it will call the Dispatch Incident - Vectra Detect playbook.

Pack

Vectra_AI

Tasks

12

Inputs

• entity_id — ID of the entity.
• entity_type — Type of the entity.

Commands used

• vectra-search-users