Find Detection State and Expire Inactive Detections - Vectra RUX

This playbook identifies the detection states of incidents and updates the investigation status of inactive detections to "expired".

Vectra RUX · 12 tasks · 1 input · 0 outputs

Inputs

  • incident_type — The XSOAR incident type to search for inactive detections. Default is 'Vectra RUX Events Detection'.

Commands used

vectra-detection-describe vectra-detection-investigation-status-update

Flowchart

yes yes yes Start Start Get Detection Details by ID - vectra-detection-describe Get Detection Details by ID vectra-detection-describe Done Done Update Investigation Status to Expired for Inactive Detections - vectra-detection-investigation-status-update Update Investigation Stat... vectra-detection-investigatio... Are Inactive Detections Present? Are Inactive Detections P... Increment the Page Number - Set Increment the Page Number Set Search for Incidents - VectraRUXGetIncidents Search for Incidents VectraRUXGetIncidents Are Incidents Present? Are Incidents Present? Loop Exit Condition - Set Loop Exit Condition Set Clear Previous Outputs - DeleteContext Clear Previous Outputs DeleteContext Are more Incidents Present? Are more Incidents Present? Search for the Next Set of Incidents Search for the Next Set o...