MDR Escalation Process - Vectra XDR

This playbook retrieves the MDR ticket number associated with the given entity by parsing its notes. It then collects the entity's active detections, performs a detection assessment, and sends the results to the designated recipient via email.

Vectra XDR · 17 tasks · 4 inputs · 0 outputs

Inputs

  • entity_id — The ID of the entity.
  • entity_type — The type of the entity.
  • recipient_email — The recipient email address for MDR escalation process.
  • detection_assessment_limit — The number of the active detection to be assessed.

Commands used

send-mail vectra-entity-detection-list vectra-entity-note-list

Flowchart

yes yes yes yes yes Start Start Is Vectra XDR Integration Enabled? Is Vectra XDR Integration... Done Done Fetch Entity Active Detections - vectra-entity-detection-list Fetch Entity Active Detec... vectra-entity-detection-list Detections Assessment - Vectra XDR - Detections Assessment - Vectra XDR Detections Assessment - V... Detections Assessment - Vectr... Send Email - send-mail Send Email send-mail Provide Recipient Email Address. Provide Recipient Email A... Generate Mail Body - VectraXDRGenerateMailBody Generate Mail Body VectraXDRGenerateMailBody List the Notes of an Entity - vectra-entity-note-list List the Notes of an Entity vectra-entity-note-list Set MDR Ticket Number - Set Set MDR Ticket Number Set Is the MDR Ticket Number Available? Is the MDR Ticket Number ... Are the Entity ID and Entity Type available? Are the Entity ID and Ent... Provide Entity ID and Entity Type. Provide Entity ID and Ent... Is Recipient Email Address Provided? Is Recipient Email Addres... Delete Context - DeleteContext Delete Context DeleteContext Print MDR Ticket not found Message - Print Print MDR Ticket not foun... Print Is Mail Sender (New) Integration Enabled? Is Mail Sender (New) Inte...