ZTAP Alert

This playbok is triggered by fetching escalated ZTAP Alerts. The playbook fetches newly escalated alerts. Then, the playbook performs enrichment on the incident's indicators. Lastly, it adds comments/logs as Evidence.

Zero Trust Analytics Platform · 11 tasks · 2 inputs · 0 outputs

Inputs

  • Enrich — Determines whether to enrich all indicators in the incident.
  • OnCall — Set to true to assign only user that is currently on shift. Requires Cortex XSOAR v5.5 or later.

Commands used

extractIndicators ztap-get-alert-entries

Flowchart

yes yes Start Start Should indicators be extracted and enriched? Should indicators be extr... Assign analyst to incident - AssignAnalystToIncident Assign analyst to incident AssignAnalystToIncident Enrich indicators Enrich indicators Extract indicators from incident - extractIndicators Extract indicators from i... extractIndicators Calculate Severity - Generic v2 - Calculate Severity - Generic v2 Calculate Severity - Gene... Calculate Severity - Generic v2 Done Done Fetch initial entries - ztap-get-alert-entries Fetch initial entries ztap-get-alert-entries IsIntegrationAvailable - IsIntegrationAvailable IsIntegrationAvailable IsIntegrationAvailable Entity Enrichment - Generic v3 - Entity Enrichment - Generic v3 Entity Enrichment - Gener... Entity Enrichment - Generic v3 Take action(s) indicated by SOC Take action(s) indicated ...