How to send notification if new case comment is added by analyst on case wall

[skadav]

Hello,

I am looking for getting notification on Teams or Email if our analyst adds any comment to Case Wall.

I already have Teams and Exchange integration, but not able to get any Action/Option/Feature on SecOps SOAR to send notification for comments added in Case Wall.

Please help me with solution if anyone have.

Thanks & Regards,

Suraj Kadav

[f3rz · Accepted solution]

@skadav this kind of notification is not existing within platform, SOAR has only Case Wall mentions (e.g user mentioning you).

Available notifications (email and system notification/under bell icon):

However, I believe it can be done by using custom job that will:

1. Get a list of open cases using SDK function:

• https://cloud.google.com/chronicle/docs/soar/reference/siemplify-module#get_cases_ids_by_filter
• https://cloud.google.com/chronicle/docs/soar/reference/siemplify-module#get_cases_by_filter

2. Get case comments per specific case using GET /api/external/v1/cases/comments and use timestampt filter

• https://cloud.google.com/chronicle/docs/soar/reference/siemplify-module#get-case-comms-siemplify

3. If in step 2 comments were found send notification.