Dispatch Incident - Vectra XDR

This playbook is called from the Process Incident - Vectra XDR playbook. It will fetch all active detections for the entity under investigation. It will then assign the entity to a user; if an assignment already exists, it will update that assignment and add a note in Vectra.

Vectra XDR · 11 tasks · 1 input · 0 outputs

Inputs

  • UserID — User ID for entity assignment.

Commands used

vectra-assignment-list vectra-entity-assignment-add vectra-entity-assignment-update vectra-entity-detection-list vectra-entity-note-add

Flowchart

yes yes yes Start Start Fetch Entity Active Detections - vectra-entity-detection-list Fetch Entity Active Detec... vectra-entity-detection-list Assign Entity in Vectra. - vectra-entity-assignment-add Assign Entity in Vectra. vectra-entity-assignment-add Add Note in the Entity. - vectra-entity-note-add Add Note in the Entity. vectra-entity-note-add Does the assignment already exist? Does the assignment alrea... Update the assignment with the provided user ID. - vectra-entity-assignment-update Update the assignment wit... vectra-entity-assignment-update Done Done Is the assignment already resolved? Is the assignment already... Is VectraXDR Integration enabled? Is VectraXDR Integration ... Get the current assignment for the entity. - vectra-assignment-list Get the current assignmen... vectra-assignment-list Delete the context for the assignment list command. - DeleteContext Delete the context for th... DeleteContext