Created a quick action which allows users to quickly create a HTML report based on multiple values across all alerts/events.
Added quick action via SOAR Settings -> Case Data -> Views -> Default Case View -> Quick Actions
Problem I am facing:
The Action does not allow me to pre-configure the "Run on Alerts" field. If a user does not uncheck all but one alert, my action executes up to 20 times flooding the case wall with report comments.
Is there a setting/configuration I am missing?
If it's a Quick Action added to the case via Default Case View then the action will be executed on all Alerts by default.
If it's a Quick Action added to the Alert via Playbook or Default Alert View then by default it will be executed only on that specific Alert:
Let me know, if it makes sense.