Dispatch Incident - Vectra Detect

This playbook is called from the Process Incident - Vectra Detect playbook. It will fetch all active detections for the entity under investigation. It will then assign the entity to a user; if an assignment already exists, it will update that assignment and add a note in Vectra.

Vectra AI · 12 tasks · 3 inputs · 0 outputs

Inputs

  • user_id — User ID for entity assignment.
  • entity_type — Type of the entity.
  • entity_id — ID of the entity.

Commands used

vectra-account-note-add vectra-assignment-assign vectra-host-note-add vectra-search-assignments vectra-search-detections

Flowchart

yes yes Account Host Start Start Assign Entity in Vectra. - vectra-assignment-assign Assign Entity in Vectra. vectra-assignment-assign Add Note for a Host. - vectra-host-note-add Add Note for a Host. vectra-host-note-add Does the assignment already exist? Does the assignment alrea... Update the assignment with the provided user ID. - vectra-assignment-assign Update the assignment wit... vectra-assignment-assign Done Done Is VectraDetect Integration enabled? Is VectraDetect Integrati... Get the current assignment for the entity. - vectra-search-assignments Get the current assignmen... vectra-search-assignments Delete the context for the AssignmentID. - DeleteContext Delete the context for th... DeleteContext Is entity Account or Host? Is entity Account or Host? Add Note for an Account. - vectra-account-note-add Add Note for an Account. vectra-account-note-add Fetch Entity Active Detections. - vectra-search-detections Fetch Entity Active Detec... vectra-search-detections