Expire Inactive Detections - Vectra RUX

This playbook identifies incidents with inactive detections and updates their investigation status to "expired".

Vectra RUX · 5 tasks · 1 input · 2 outputs

Inputs

  • incident_type — The XSOAR incident type to search for inactive detections. Default is 'Vectra RUX Events Detection'.

Outputs

  • Vectra.Detection.id — The detection ID.
  • Vectra.Detection.investigation_status — The detection investigation status.

Flowchart

yes Start Start Done Done Find Detection State and Expire Inactive Detections - Vectra RUX - Find Detection State and Expire Inactive Detections - Vectra RUX Find Detection State and ... Find Detection State and Expi... Is Vectra RUX - Network Detection & Response Integration Enable? Is Vectra RUX - Network D... Clear Previous Outputs - DeleteContext Clear Previous Outputs DeleteContext