DSPM notify user in case of error

The DSPM Notify User in Case of Error playbook is designed to handle errors in DSPM incidents by notifying users and managing Slack notifications.

DSPM · 17 tasks · 1 input · 0 outputs

Inputs

  • rerunTime — Incident re-run time (in hours)

Commands used

addToList core-api-post createList getList setList

Flowchart

#error# #error# add Start Start Sending slack notification to ${userSlackEmail}. - SlackBlockBuilder Sending slack notificatio... SlackBlockBuilder Remove slack block from XSOAR list - core-api-post Remove slack block from X... core-api-post Add incident for re-run - DSPMIncidentList Add incident for re-run DSPMIncidentList Check Error message is set or not? - SetIfEmpty Check Error message is se... SetIfEmpty Create a slack block to send error notification to user - DSPMCreateSimpleSlackMessageBlock Create a slack block to s... DSPMCreateSimpleSlackMessageB... Check list exists for Incident ID : ${incident.id} - getList Check list exists for Inc... getList Create a new XSOAR list for Incident ID : ${incident.id} - createList Create a new XSOAR list f... createList Modify XSOAR list for Incident ID : ${incident.id} with new slack block. - setList Modify XSOAR list for Inc... setList Deleting error message from context data. - DeleteContext Deleting error message fr... DeleteContext Get DSPM Incident List - getList Get DSPM Incident List getList Check incident list status? Check incident list status? Add incident in DSPM Incident list - addToList Add incident in DSPM Inc... addToList Create DSPM Incident list - createList Create DSPM Incident list createList Done Done Save the above slack block to the XSOAR list. - createList Save the above slack bloc... createList Deleting slack block from context after saving into xsoar list. - DeleteContext Deleting slack block from... DeleteContext