Solved: Close Source alert while closing SOAR case - Page 2

migueltubia · 03-13-2024 04:13 PM

Hi,

we have several sources of alerts integrated in the SOAR. We'd like that, when we close the case in the SOAR, we could automatically close the alert in the origin (like SIEM, MS Defender, etc.). We can execute a playbook manually but we'd like to automate this...

As we cannot create a trigger for this in a playbook, do you know if we can create a job to check this every XX minutes/hours? Is this possible? Any idea?

Thanks!

M.

SoarAndy

Many of the Integrations in the marketplace have a Job to monitor for closures and sync to the remote platform

e.g.

For integrations where this does not exist you can log a feature request, or potentially implement one using the IDE

Failing that, yes I would consider adding "close incident" action into your playbooks at the end.

I hope this helps

Andy

View solution in original post

Webinar May 29th: Log Ingestion: Bindplane + Google SecOps

Close Source alert while closing SOAR case