Process Incident - Vectra XDR

This playbook is used to initiate the processing of an incident. This playbook runs when a pending incident is selected for investigation. It will change the state from pending to active and it will list the available users in Vectra and request the user ID to use for assignment. Once the data collection is complete, it will call the Dispatch Incident - Vectra XDR playbook.

Vectra XDR · 8 tasks · 0 inputs · 0 outputs

Commands used

vectra-user-list

Flowchart

Start Start Done Done Get the Vectra UserID to assign the current entity. Get the Vectra UserID to ... Delete the context of GetUserID - DeleteContext Delete the context of Get... DeleteContext List Available Users for Assignment - vectra-user-list List Available Users for ... vectra-user-list Dispatch Incident - Vectra XDR - Dispatch Incident - Vectra XDR Dispatch Incident - Vectr... Dispatch Incident - Vectra XDR Add Note - Vectra XDR - Add Note - Vectra XDR Add Note - Vectra XDR Add Note - Vectra XDR Add entity notes to the layout. - VectraXDRAddNotesInLayout Add entity notes to the l... VectraXDRAddNotesInLayout